Privacy notice
Last updated 30 October 2026
Who we are
AuthCanvas is run by VERIDYNE SOLUTIONS S.R.L. (CUI 51635423, Trade Register J2025027184005, EUID ROONRC.J2025027184005), Str. Guliver 13, bl. C1, sc. 1, et. 5, ap. 49, Sector 6, Bucharest, Romania. We are the controller of your account data and the processor of the diagrams your company creates. Contact: solutions@veridyne.eu.
What we collect
- Your account: name, email address, sign-in identifier, your company and your role in AuthCanvas.
- Your projects: diagrams, block settings, notes, decisions and versions. Please don't put passwords, keys or personal data of your users in them.
- ACE activity: each paid step's full request and response, with its model, token counts and cost, for audit and billing.
- Access requests: the name, work email, company, platform and message you send with the request-access form, so we can set up your account and reply.
AuthCanvas does not connect to your identity tenants and does not read your users.
Why, and on what basis
We use this data only to provide the service you ask for (performance of a contract, GDPR Art. 6(1)(b)) and to keep it secure and billed correctly (legitimate interest, Art. 6(1)(f)). We do not sell data or show ads.
ACE and AI
When you start a paid ACE step, the diagram, its settings and notes are sent to Anthropic, which provides the AI model. Nothing is sent while you draw, check or apply a free fix.
How long we keep it
- Projects: until your company deletes them or stops using AuthCanvas.
- ACE activity and token records: kept after a project is deleted, for audit and billing.
- Your sign-in account: until you ask us to remove it.
- Access requests: in our mailbox for up to 12 months, or as long as you have an account.
Who processes it
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and running the application | Frankfurt, EU (fra1) |
| Neon (Databricks) | Database | Frankfurt, EU |
| Okta Inc. (Auth0) | Sign-in to AuthCanvas | EU |
| Anthropic PBC | The AI model behind ACE, for paid steps | United States (SCCs) |
| Resend Inc. | Sending account and access-request emails | United States (SCCs) |
Where a subprocessor is outside the EEA, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
Your rights
You can access, correct, export or delete your data, object to processing, and complain to the Romanian supervisory authority (ANSPDCP, dataprotection.ro). Write to solutions@veridyne.eu.
Cookies
One encrypted session cookie keeps you signed in. Your theme choice is kept in your browser. There are no analytics or advertising cookies.