Privacy Policy — Canvas Scout

Last updated November 2, 2026

Canvas Scout is a brand of Reform Marketing LLC, an Ohio limited liability company based in North Canton, Ohio (“Canvas Scout,” “we,” “us”). This policy covers canvasscout.com, the Canvas Scout app at app.canvasscout.com, our API at api.canvasscout.com, and the Canvas Scout app for Android phones (together, the “Service”). When our iPhone app is available, it will cover it too, and anything it collects beyond what is described here will be added before it is released.

The short version. The marketing site uses Google Analytics, Google Ads and the Meta Pixel only if you click Accept in its cookie bar. With that OK, Google and Meta can tell us which ads worked and show our ads to people who have visited the site. And if you arrive from one of our Facebook or Instagram ads and don't click Decline in the cookie bar, we tell Meta when your visit leads to a sign-up, trial or payment, using only the ad-click ID from the link: no cookies, and never your name, email or IP address. The app itself isn't tracked, has no advertising tags, and uses one cookie to keep you signed in. We don't sell your personal information, and nothing you or your team do in the app is used for advertising. Business owners can ask us to remove their listing, or just their own name and contact details, at any time.

Who this policy covers

We handle three kinds of information, and this policy covers all of them:

Visitors and customers. People who visit our site, sign up, or use the app.
Businesses in our maps. Information about local businesses that appears in the maps our customers use. See Business listing data.
Partners. People we invite to share Canvas Scout for a commission, and the customers their links bring. See Partners and partner links.

What we collect from visitors and customers

Information	When	Why
Email address	You asked for early access before we launched (that list is now closed)	To email you once that Canvas Scout is open. You can ask us to remove it anytime
Name, work email, company (optional on the website; the phone app asks for your first and last name and your business name, or your own name if you work for yourself)	You sign up or we create your account; you can change your name, email and team name in Settings	To create your account, send your sign-in link and contact you about your account. When you change your email, we send a one-time code to the new address to confirm it, and tell the old address about the change
Your territory, the industries you target, and your plan	Sign-up	To build your map and set up your plan
What business you do, what you sell and your goal	Sign-up	To set up your map and score businesses for what you sell
In the phone app's sign-up: the services you offer (your main one and any others you tick) and, if you give it, your business website. (Earlier test versions of the app also asked how long you've been selling and the hardest part of your day in the field.)	You sign up in the phone app	To set up your map and your Learn practice, and to know who uses Canvas Scout
A phone sign-up you started but haven't finished: your email (or the Apple, Google or Facebook ID, name and email they share), a one-way hash of the password you chose, and for Apple a sign-in token	You get past the phone app's sign-up page (email or Apple, Google or Facebook) but haven't made your account yet	So you can finish the next pages without signing in again. The password hash and Apple's token are erased after 24 hours (then you sign in again to finish); the rest is deleted after 30 days. Our team can see the email and when you started, to help if something went wrong
Before you have an account, the phone app's sign-up steps you reached: only the step and a random number the app makes, nothing about you	You go through the phone app's sign-up	To see where people stop, so we can make it better. If you sign up, those steps are linked to your account
A partner's link you opened: the partner's link code and when you clicked it	You sign up after opening a Canvas Scout partner's link. It's kept with any sign-up that carries one, whether or not the partner is credited	To credit that partner for your sign-up and your payments when you sign up within 60 days of the click. Kept with your sign-up and account. The partner sees you only as a numbered customer, never your name or contact details (see Partners and partner links)
How you found us: the ad or link you arrived from and its tracking tags (for example the campaign, ad set and ad names and numbers, and the click ID that Google or Meta adds to an ad's link), the first page you landed on, the name of the website that sent you (only its name, not the page) and when you arrived	You sign up on canvasscout.com. Until then it stays in your browser, for that visit only (see our Cookie Policy). A sign-up in the phone app is only noted as coming from the phone app	To see which of our ads and links bring people who sign up, so we spend on the ones that work. Kept with your sign-up and account, seen only by our team, and not sold. Meta's click ID is used as described in the Meta rows below; nothing else here is shared
Your agreement to our Terms: date, version and IP address	Sign-up	A record that you agreed, which the law expects us to keep for subscriptions
Password	You set it from your sign-in link	To sign you in. We store only a one-way scrypt hash, never the password itself. If you sign in with Apple, Google or Facebook, you have no password with us until you make one with “Forgot your password?”
Sign in with Apple or Google (phone apps; Google also on the website and its login page): Apple's or Google's ID for you, the name and email address they share with us (with Apple's “Hide My Email”, a private relay address that forwards to you), and for Apple a sign-in token	You choose “Continue with Apple” or “Continue with Google”	To sign you in without a password. We check each sign-in with Apple or Google; we never see your Apple or Google password. Apple's token is kept encrypted and used only to end your Sign in with Apple when you delete your account, as Apple requires
Sign in with Facebook (phone apps): Facebook's ID for you, your name and the email address Facebook shares with us	You choose “Continue with Facebook”	To sign you in without a password. We check each sign-in with Facebook (Meta); we never see your Facebook password, never post to Facebook and don't ask for your friends or anything else on your profile. Facebook doesn't tell us whether your email is confirmed, so we email you a link to confirm it, and a Facebook sign-in is never joined to a login that already uses that email
Two-step sign-in settings: your authenticator key, recovery codes (stored only as one-way hashes), devices you chose to trust	You turn on two-step sign-in	To ask for a code at sign-in, so a stolen password alone can't open your account
Payment details	When you start a trial or a paid plan on our website (a free account needs no card)	Processed by our payment processor, Stripe. We never see or store full card numbers. Stripe gives us an anonymous identifier for the card (not its number), which we keep so that each card gets one free trial
A plan bought in the phone app: the purchase record from Apple (App Store) or Google (Google Play): which plan, monthly or yearly, when it started and when it renews or ends, whether it's in its free week, its price, and the store's IDs for the purchase; and a random ID for your account that Apple or Google keeps with the purchase	You start a free trial or subscribe in the iPhone or Android app	To unlock the plan you bought and keep it in step when it renews, changes, is cancelled or refunded: Apple or Google tells us each of those, and we check every purchase with them. Apple or Google takes the payment; we never see your card or any of your Apple or Google payment details. The random ID only lets us match a purchase to your Canvas Scout account
Your profile picture	Only if you add one (Settings, then General)	To show your team who's who: next to your name on the Team page, the leaderboard, notes and visit history. Only people on your account can see it. The app crops and shrinks it on your device first, which removes the location and camera details your phone saved in it. Remove it anytime
Name and email of teammates you invite	An account owner invites someone	To email them an invitation and create their login
What your team saves about businesses: notes, pipeline status (for example “contacted” or “won”), who is working each one, a contact's name, the best time to visit, next steps and follow-up dates, deal values, which pockets are handed to which rep, saved routes (which businesses, in what order, and a start point if you save one), a timeline of visits (who logged them, when, and, for a visit logged from a phone, how far from the business it was), and photos your team adds to a business (who added them and when)	You use the app	To share them with your team, show your visit history and totals, and warn a teammate when someone was just there. Only people on your account can see them
Your weekly numbers (visits, meetings, wins) and follow-ups due	Every Monday, for account owners	To send the Monday recap email. Turn it off anytime in Settings, under Notifications
Your follow-ups due that day: which businesses, the next step and who to ask for	Weekday mornings when something is due, for anyone on a trial or paid plan	To send the morning follow-up email. Turn it off anytime in Settings, under Notifications
A customer list an account owner uploads: business names, addresses, phone numbers, websites, contact names, sales reps' emails, customer-since dates, yearly values, your own customer IDs and notes	Only if an owner uploads one (Settings, then Connections)	To mark your existing customers on your map and add the ones we don't have. The file is read in your browser; we receive and keep the rows. Only people on your account see them, and they're never added to the business data other customers see. An owner can undo an import
Your device's location	Only when you ask: the locate button on the map, Best order in the route planner, “save this spot as the start”, asking the assistant for businesses near you (or asking it to log a visit or change a status), an area search “around me”, saving a start for your mileage, or logging a visit or changing a status from your phone (a check-in; on a computer, only if you've already allowed location)	To show where you are, put your route's stops in the shortest order, find the businesses closest to you, and show your team whether a visit was logged at the business. For a check-in, we store only how far you were from the business and how accurate your phone said its location was, never the location itself. A start you save for mileage (for example “Home”) is kept with your settings until you clear it, and is used only to count the drive to your first stop and back from your last. Otherwise it's used in your browser or the app, and we only store it if you save it as a route's start. Your browser, or in the phone app your phone, asks before sharing your location (the app first explains why). The app reads it only while it's open, unless you turn on drive tracking (next row). If you say no, everything still works without it
Your drives	Only in the iPhone and Android apps, and only after you turn on drive tracking (on the Drives page). You can pause it or turn it off anytime, there or in your phone's Settings	To give your mileage log the real miles you drove. While tracking is on, the app uses your location in the background, including when it's closed, to notice when you're driving (your phone shows that an app is using your location; on Android a notice shows while a drive is recorded). When a drive ends, the app sends us when it started and ended, the route (location points along the way) and the miles. Between drives it only watches for you leaving the spot where you stopped. Each drive is yours until you mark it: Personal and unsorted drives are seen only by you. Your account owner sees a drive only after you mark it Business, and never the part within about a quarter mile of the start you saved (for example Home). Places on a drive are named from the businesses you worked that day, your saved start, or the county, on our own server; nothing about where you drove is sent to an outside mapping or address company
The assistant: what you say or type to it (a short recording when you talk), its answers, your chat with it, and short notes it keeps about how you work (for example “focusing on dentists this month”)	Only when you use the assistant (the orb in the search box; paid plans and trials)	To understand what you asked for, do it for you (find businesses, update a business, set a follow-up, build a route), and read the answer out loud. When you talk, the recording is sent through our servers to our speech provider, ElevenLabs, to turn it into words; it isn't stored. The words, along with what the assistant looks up on your map to answer you, are sent to Anthropic, whose Claude model works out what to do (see “Who we share it with”). Each answer is sent to ElevenLabs to be spoken in a natural voice. When that service isn’t available, your browser’s own speech recognition and voice are used instead, which may send your voice to its maker (Google for Chrome, Apple for Safari) under their privacy policies. Your chat and the notes are private to you (not your team or account owner) and are deleted after 3 months, or sooner if you clear them in the assistant's settings. We also count what each person's use costs us, to keep it within a monthly allowance
Learn (sales practice): your answers to lessons and puzzles, and for the practice that's graded by AI (paid plans and trials) what you type or say and your side of a practice conversation	Only when you use Learn	To check your answers and keep your progress: lessons done and their stars, XP, your streak, your sales rating, your best Rush score, and which questions to bring back for review. Your teammates see your name, this week's XP, streak and rating on your account's Learn board. Typed and spoken answers and practice conversations are graded and not stored: a spoken answer is sent through our servers to ElevenLabs to turn it into words, and the words are sent to Anthropic, whose Claude model grades them or plays the practice business owner; the owner's lines can be read out loud by ElevenLabs. A warm-up uses only a business type from your map (for example “dentist”), never a real business. This uses the same monthly allowance as the assistant
Your follow-ups in your calendar: business names and towns, follow-up dates, next steps, who to ask for and the best time	Only if you turn on your calendar link (Settings, then Connections, or the Follow-ups screen), or tap “Add to calendar” on a follow-up	So your follow-ups show up in Google Calendar, Apple Calendar, Outlook or another calendar you choose. Your calendar fetches them from us through your private link and keeps them up to date. Anyone who has the link can see those follow-ups, so keep it private; you can replace the link or turn it off anytime, and the old link stops working at once. No phone numbers or addresses are in it
Map settings: light or dark mode, map type, filters	You change them	Saved to your login so the map looks the same on every device
IP address and browser type of each signed-in session, when it started and when it was last used	You sign in, and while you use the app	Security: you can see every place you're signed in and sign any of them out (Settings, then Security), and we can spot sign-ins you don't recognize and stop account sharing
In the phone app, if you allow notifications: a notification token from Apple or Google for that phone, and which notifications you switched on	You allow notifications on your phone	To send the notifications you chose: follow-ups due today, your map is ready, and the Monday recap; and, two days before a free trial ends, a reminder of when your plan renews and its price (we email it too). Switch each one off in Settings, under Notifications, or turn notifications off for Canvas Scout in your phone's Settings
In the phone app: which app it is (Android or iPhone) and its version number	With each request the app makes	To leave out what a phone app doesn't offer, and to ask you to update an app that's too old to keep working
App activity: which parts of the map you load and which business details you open	You use the app	To enforce plan limits, protect our data from bulk copying, and fix problems
Steps toward a plan: that your account opened the plans screen, changed its territory there, pressed a plan's button, reached or left the checkout page, or confirmed its email, and when	You do one of those things in the app	To see where people stop between a free map and a plan, so we can fix what's confusing. Kept with your account, never shared, and never what was on your screen
Web server logs: IP address, browser type, pages requested, time	Any visit	To keep the site running and secure
Site analytics (Google Analytics): pages you view on canvasscout.com, how you got there, your device and browser type, rough location from your IP address, and a random ID stored in a cookie	Only if you click Accept in the cookie bar on canvasscout.com	To see which pages and campaigns bring people who sign up. If you then sign up, we keep that random ID with your account, and when a trial starts or a payment goes through we tell Google Analytics the plan, amount and invoice number under that ID, so we can see which visits led to paying customers. Never your name, email, card or anything from your map
Advertising (Google Ads): pages you view on canvasscout.com, the ad you clicked, your IP address, and random IDs stored in Google's cookies	Only if you click Accept in the cookie bar on canvasscout.com	To see which of our ads lead to sign-ups, trials and payments (the same events described in the row above), and so Google can show our ads to people who have visited our site. Never your name, email, card or anything from your map
Advertising (Meta Pixel, for Facebook and Instagram ads): pages you view on canvasscout.com, that you created a free account (not your name or email), the Meta ad you clicked, your IP address and browser type, and random IDs stored in cookies	Only if you click Accept in the cookie bar on canvasscout.com	To see which of our Facebook and Instagram ads lead to visits, sign-ups, trials and payments (if you sign up, we later tell Meta when your trial starts and each payment's plan, amount and invoice number, under the same random IDs), and so Meta can show our ads to people who have visited our site. Never your name, email, card or anything from your map
Advertising (Meta, without the pixel): that you created a free account, started a trial or made a payment (with the plan, amount and invoice number), the click ID Meta added to the link of its ad (fbclid) and when you clicked, the page you landed on, and your browser type	Only if you arrived from one of our Facebook or Instagram ads and made no choice in the cookie bar. Not if you clicked Decline or your browser sends Global Privacy Control, and not if you didn't come from a Meta ad. (If you clicked Accept, the Meta Pixel row above applies.)	So Meta can tell us which of our Facebook and Instagram ads led to sign-ups, trials and payments. Our server sends it; the Meta Pixel doesn't load and no cookie is set in your browser. Never your name, email, IP address, card or anything from your map. To stop it, click Decline in the cookie bar before you sign up; after you've signed up, write to hello@canvasscout.com and we'll stop it
Territory change requests: what you ask us to change and your note	An account owner sends one (Settings, then Billing)	So our team can make the change and tell you about any change in price first
Reports you send from the app: what you reported (the text of an AI answer; for a team note, its text and who wrote it; for a photo, who added it and its caption), your reason and your note	You press Report on an AI answer, a teammate's note or a photo	So our team can look into it and act. The person whose note or photo you reported isn't told who reported it
Emails you send us, and feature requests you send from Settings (your idea, your note, how much it matters, with your name, email and team)	You contact us	To reply, help you and decide what to build next

Contact names your team types in are business contacts (for example “Pat, the owner”). Please keep them to what you need to follow up, and don't record anything sensitive about a person.

We only ask for what we need to run the Service. We don't collect sensitive information such as government IDs or health information, and we don't keep a record of where you go unless you turn on drive tracking in the phone app (see “Your drives” above). Without it, mileage is worked out from the businesses you checked in at, in order, not from following your phone. Drive times and road miles are worked out on our own server; route stops and starts aren't sent to an outside mapping company. The app's “locate me” button uses your device's location only on your device to center the map; it is not sent to us. When you search an area “around me,” your browser sends us your location as the middle of that circle, only to show what's inside it; we don't store it. The Follow-ups screen's “Worth a revisit” list sends your location rounded to about half a mile to sort the closest first, only if you've already allowed location. When you log a visit or change a status from your phone, your browser sends us your location at that moment; we work out how far it is from the business, keep only that distance, and discard the location. If you sort the list view by “Closest to me,” your browser sends us your location rounded to about half a mile, only to sort that list. We don't store it. When you use the assistant, your browser sends us your location with each request if you've allowed it, to find businesses near you and, when it logs a visit or changes a status for you, to work out how far you were from the business, as a check-in does. We don't store the location, and Anthropic never receives it, only distances in miles.

How we use it

To provide the Service: build your territory, run your account, sign you in and bill you.
To keep the Service secure: rate limits, fraud and abuse detection, and investigating misuse of our data.
To communicate with you: account and billing messages, sign-in codes, and, if you opt in, product updates, tips and offers. The day after you sign up we send one email about what's on your free map and how to confirm your account, or, if you haven't opened your free map yet, one reminder that it's waiting; it mentions plans and prices only if you opted in. For a free account, opting in includes occasional emails about your territory (how many businesses are waiting and what changed, as counts only) and trial offers, which stop when you start a trial or unsubscribe. Every marketing email has an unsubscribe link that works with one click; account and security emails keep coming while you have an account.
To comply with the law and enforce our Terms of Service.

We don't sell your personal information or use it to train third-party AI models. The only ways information is shared for advertising are the Google Ads tag and the Meta Pixel on canvasscout.com, only if you click Accept there, and, if you arrive from one of our Facebook or Instagram ads and don't click Decline in the cookie bar, telling Meta from our server that your visit led to a sign-up, trial or payment, using only the ad-click ID from the link. Some U.S. state laws call that “sharing” or “targeted advertising”. You can opt out anytime from “Cookie settings” at the bottom of any page on canvasscout.com (click Decline), or by turning on Global Privacy Control in your browser; after you've signed up, write to hello@canvasscout.com to stop what we tell Meta about your trial and payments. Nothing from the app is used for advertising: not your account, your team's work or the business data.

We share personal information with service providers who help us run the Service, under contracts that limit their use of it, and with Google and Meta for advertising as described here (on the marketing site with your OK, or for Meta's ad clicks unless you decline):

Hostinger: hosts our servers and databases.
Stripe: payment processing, billing, and the checkout and billing pages where you enter your card, update it or cancel. Stripe tells us your plan and payment status and an anonymous identifier for your card, never your full card number. Stripe (Stripe Connect) also pays our partners: it collects their bank and tax details on its own pages and sends their payouts (see Partners and partner links).
HighLevel (LeadConnector): runs the booking page for walkthrough calls. If you book one, it receives what you enter there (your name, email, phone number if you give one, and the time you pick) and sends the confirmation and reminders. Nothing is sent to it unless you open the booking page.
Hostinger also runs our mailbox: it sends our emails (sign-in links and codes, account emails, the launch announcement) and receives email to hello@canvasscout.com. We keep a log of what we sent and when, for 90 days.
Amazon Web Services (Amazon SES): delivers the app's emails from noreply@canvasscout.com (sign-in links and codes, account emails), alongside or instead of Hostinger. Like Hostinger, it sees each recipient's address and the email's contents. It tells us when an email bounces or is marked as spam: we then stop emailing that address (except sign-in codes and password resets you ask for), and Amazon keeps its own list of such addresses for the same reason.
Google (Google Workspace): runs the separate mailbox we use to email agencies and creators about Canvas Scout, and receives their replies.
Google (Google Analytics and Google Ads): measures visits to canvasscout.com and which of our ads led to them, only if you accept cookies there, and receives the conversions described above. With that same OK, Google also uses your visit to show our ads to you on Google and on other sites that show Google ads; for that, Google acts for itself, under its own privacy policy. Google's use is described in How Google uses information from sites that use its services. The app at app.canvasscout.com doesn't use Google Analytics or Google Ads.
Meta Platforms (Meta Pixel): only if you accept cookies on canvasscout.com, tells us which of our Facebook and Instagram ads led to a visit or a free-account sign-up, receives the trial and payment events described above (from our server, with only those random IDs and your browser type), and lets Meta show our ads to people who have visited canvasscout.com. Meta receives the pages you view here, that a sign-up happened (never your name, email or what you typed), your IP address, browser details and its cookie IDs, and may link that to your Facebook or Instagram account if you have one; for that, Meta acts for itself, under its own privacy policy. You can control ads from Meta in your Facebook or Instagram ad preferences. The app at app.canvasscout.com has no Meta Pixel.
Meta Platforms (Conversions API, without the pixel): if you arrive from one of our Facebook or Instagram ads and don't click Decline in the cookie bar, our server tells Meta when your visit leads to a free-account sign-up, a trial or a payment (the plan, amount and invoice number), with only the click ID Meta put on its ad's link, when you clicked, the page you landed on and your browser type. No cookie is set and the pixel doesn't load; Meta never gets your name, email or IP address from us, and may match the click to the Facebook or Instagram account that clicked the ad, under its own privacy policy.
Anthropic (Claude): runs the assistant. For each request it receives what you said or typed, your recent chat with the assistant and its notes about how you work, today's date, the business types and statuses on your map, and what the assistant looks up for you: businesses from your map (name, type, town, address, phone, score and why, distance from you), your team's status, follow-up, contact, next step and visit history for them (which names who logged each visit, so it can include your name and your teammates'), and, in the web app only, the owner's name where the business publishes it. Never the recording, your email or your location. For Learn's graded practice it receives the practice question, what you typed or said, and your practice conversation, plus what you sell and the business type you chose. Never the recording, your name, email or location. To draft our replies to emails you send to hello@canvasscout.com, it receives your email and, when it comes from the address on an account, that account's name, plan, status, territory, trial and billing dates (see When you email us). Under Anthropic’s commercial terms, they aren’t used to train its models.
Salesforce: only if an account owner connects your company's Salesforce. We send it the businesses your team works (name, address, phone, website, score and what we found) and your team's activity on them: statuses, visits, follow-up dates, notes and who logged them. To credit each rep, we look up Salesforce users by their work email. Salesforce sign-in tokens are stored encrypted. An owner can disconnect it anytime in Settings, under Connections; what's already in Salesforce stays there under your company's agreement with Salesforce.
HubSpot: only if an account owner connects your company's HubSpot. We send it the businesses your team works (name, address, phone, website, score and what we found), the contact name a rep saved for the business, and your team's activity on them: statuses, visits, follow-up dates, notes and who logged them. To avoid duplicates we look up Companies in your HubSpot by website and phone, and to credit each rep we look up HubSpot users by their work email. HubSpot sign-in tokens are stored encrypted. An owner can disconnect it anytime in Settings, under Connections, which removes Canvas Scout from your HubSpot; what's already in HubSpot stays there under your company's agreement with HubSpot.
ElevenLabs: turns what you say to the assistant or in Learn into words and reads the assistant's answers and Learn's practice owners out loud. It receives the recording or the answer text only, never your name, email or location.
Cloudflare: stores encrypted backup copies of our database (R2 storage), so we can restore the Service if our server is lost. It stores them for us and can't use them for anything else.
OpenFreeMap: serves the map background tiles in the app. Your browser requests tiles directly from them, which shares your IP address; they don't receive your account details.
U.S. Geological Survey (The National Map): serves the topographic and satellite map images if you choose those map types. Your browser requests them directly, which shares your IP address; they don't receive your account details.
U.S. Census Bureau (Census Geocoder): when you import customers we don't already have, their street addresses (street, city, state and ZIP, with no business names or anything else) are sent to this free public service to place them on your map.
Your calendar (for example Google Calendar, Apple Calendar or Microsoft Outlook): only if you add your calendar link to it, or add one follow-up. It receives the follow-ups described above and keeps them under its own privacy policy. “Add to calendar” with Google opens Google Calendar with that follow-up's business name, address, date and next step filled in, and nothing is sent until you tap it.
Apple, Google and Facebook (Meta), for the phone apps: only for what you use. If you sign in with Apple, Google or Facebook, we check that sign-in with them. If you allow notifications, Apple (iPhone) or Google's Firebase Cloud Messaging (Android) receives your phone's notification token and each notification's short text (for example “You have 3 follow-ups today”) to deliver it. If you buy a plan in the app, Apple (App Store) or Google (Google Play) takes the payment under its own terms and privacy policy, and tells us the purchase record described above.
Our partners: if a partner's link brought you, that partner sees you only as a numbered customer with your plan, your status and what they've earned from your payments, never who you are (see Partners and partner links).
Google Maps, Apple Maps and Waze: when you tap Navigate, Directions or Street View, that app or site opens with the business's location, and its own privacy policy applies. We don't send them anything else, and nothing is sent until you tap.

AI features (the assistant and Learn's graded practice). The first time you use one, the app explains what is sent to Anthropic and ElevenLabs and asks you to agree. Nothing is sent to them before you do. You can turn the AI features off anytime in Settings, General, AI features, and nothing more is sent from then on. The rest of the app works the same without them. Anything you see from the AI can be reported from the app with its Report button.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business (we'd tell you first).

Business listing data

Our maps show information about local businesses: business name, address, phone number, website, category, opening status and listed hours, star rating and review count, other details the business listing shows (for example, payment methods accepted, services offered and how busy it gets), and the results of automated checks of the business's public website (for example, whether it loads, uses HTTPS, and which booking, ordering or point-of-sale tools it links to). We use these details to score how well each business fits what our customer sells. We get this from publicly available sources, including business listing data from commercial data providers and the business's own public website.

Owner and contact details. Where a business itself publishes them, a business's entry can also show who to ask for and how to reach them: the name and job title of the owner or contact person, an email address and a phone number. They come from two places only: the business's own website (its home page and its about, team or contact pages) and the business's page in a chamber of commerce member directory. A program reads those pages for us. It identifies itself, follows each website's robots.txt instructions, reads three pages at most, and comes back about twice a year. It leaves alone email addresses a website hides from automated readers, keeps only addresses at the business's own domain or a mailbox provider, and skips websites shared by several locations. A customer sees these details only when they open one business, never in a list or an export.

This is information about businesses, not personal profiles. We don't collect owners' home addresses or personal social media, and we don't look people up in other sources. But a name, email or phone number published on a business's website is still information about a person, and some businesses are sole proprietorships, where the business name or phone can identify a person. So we treat this data with care:

Customers may use it only to prospect in their own territory, under our acceptable use rules, which require them to follow telemarketing and email laws.
We limit how much any customer can see per day and watch for bulk copying.
Any business can have its listing removed or corrected, and any owner or contact person can have their name, email and phone number taken off. See below.

Remove or correct a business listing

If you own or manage a business and want it removed from Canvas Scout, or want something corrected, email hello@canvasscout.com with the subject “Remove my business.” Include the business name and address (and phone number, if you can) so we find the right listing.

We remove it from every customer's map within 30 days, usually much sooner, and keep a minimal record (name, address and phone) only so it stays out of future updates. We won't ask you to create an account, and we won't charge you.

Only your own details. If you're happy for the business to stay but want your name, email or phone number taken off, say so in the same email (subject “Remove my details”). We take them off for every customer within 30 days, usually much sooner, stop reading that website for contact details, and keep only the business's name and website address so they stay off. If a detail is wrong, tell us and we'll remove it.

People we email about Canvas Scout

We email some marketing agencies, and YouTube creators who teach marketing, to tell them about Canvas Scout. Each email is written for that person and read and sent by Devin Daniels, our founder, from a separate Canvas Scout mailbox. Nothing goes out unless he approves it. We find them through public business listings and YouTube search, and use only business contact details they publish themselves: on their own website, their Google listing or their video descriptions. We don't buy email lists.

What we keep about each person: their name and business, the business email they publish, their website or channel, where we found them, short notes on why Canvas Scout may suit them (taken from their own public pages or videos), and the emails we send and their replies. Software helps us draft those emails: the public text from their pages or video, and any reply, is sent to Anthropic (Claude) for that, under Anthropic's commercial terms.

To stop hearing from us, reply “stop” or use the unsubscribe link in any of our emails, or email hello@canvasscout.com. We then add the address (and, for a business's own domain, that domain) to a do-not-contact list so it isn't emailed again.

When you email us

When you write to hello@canvasscout.com, we keep your email and our reply so we can help you and follow the conversation. Software helps us draft the reply: your email, and if it comes from the address on a Canvas Scout account, facts about that account (its name, plan, status, territory, trial and billing dates, and whether you're its owner), are sent to Anthropic (Claude) to write a draft. A person reads and edits every reply before it's sent, and nothing is sent by the software on its own. If you've turned AI features off in the app, or never agreed to them, your email isn't sent to Anthropic: we write the reply ourselves.

Partners and partner links

We invite some people, such as creators who teach sales and marketing, to share Canvas Scout with a personal link and earn a commission from the customers it brings (see our Partner Agreement).

If you're a partner, we keep your name and email, your link code, how many times your link was clicked each day (counts only), the customers your link brought and the commissions and payouts they earned you (amounts and dates), when you accepted the Partner Agreement and which version, and your Stripe connected account ID with whether it's ready to be paid. To avoid counting one person's repeated clicks, our server looks at the clicker's IP address for a short time in memory; it isn't kept with the click counts. Like any visit, the click appears in the web server logs described above. Stripe pays you through Stripe Connect and collects your bank and tax details (such as your W-9) on its own pages, under its own privacy policy. We never see or store them.

If a partner's link brought you, we keep which partner and when you clicked, with your sign-up and account. The partner sees you only as a numbered row (for example “Customer #3”) with your plan, when you joined, their commission rate, your status (free, trial, paying or cancelled) and what they've earned from your payments. They never see your name, your business, your email or phone number, or anything from your map. A partner link never changes your price.

How long we keep it

Account information: while your account is open, then 90 days after it closes in case you come back, then deleted. If you delete your account yourself (in the app: Settings, General, Delete account), it is deleted right away, with its map, notes, visits, photos and logins, and a plan that is still active ends at the same time. How to do it, with or without the app: Delete your account. We keep the record of your sign-up (including how you found us) and Terms acceptance, invoices held by our payment processor, and the 90-day log of emails we sent you.
A free account whose email address is never confirmed: we email you a link to confirm it. If you don't, you're signed out after 7 days, and the account is deleted after 30 days (after about six months if you asked for our emails, when those end).
The card identifier for free trials: kept for as long as we offer free trials, so a card can't be used for more than one.
Your profile picture: until you remove or replace it, or you're removed from your team or your account is deleted.
Photos your team adds: until someone on your team deletes them (the person who added a photo, or an account owner), or your account is deleted. The app shrinks each photo on your phone before sending it and removes the location and camera details the phone saved in it.
Team notes, pipeline statuses, contacts, deal values and visit history: while your account is open (including a free account after a paid plan ends), then deleted with it. An account owner can download them anytime from the Visits page. When a teammate is removed, the notes they wrote stay with the team under their name.
Your drives (phone app, with drive tracking on): while your login exists. You can delete any drive yourself on the Drives page. If you leave the team or your login is deleted, the drives you marked Business stay in your account's records for your account owner, without the route, and all your other drives are deleted. Everything is deleted with the account.
Steps toward a plan (see the table above): while your account is open, then deleted with it.
The phone app's sign-up steps (see the table above): 2 years, then deleted.
Your chat with the assistant and its notes about how you work: 3 months, then deleted automatically; you can clear them sooner in the assistant's settings. Recordings of what you say aren't stored. What each person's use cost is kept as a monthly total with your account.
Your Learn progress (lessons, stars, XP, streak, rating, review list, and a log of what you practiced and whether it was right): while your login exists; it's deleted with your login. What you type or say in practice isn't stored.
Reports you send: 2 years, then deleted, so we can show what was reported and what we did. They stay if the note or photo is deleted, and after the reporter's account is deleted, without the link to it.
Billing records: up to 7 years, because tax law requires it. That includes the purchase records Apple or Google send us for plans bought in the app.
Sign-in sessions: until they expire (30 days of inactivity) or you sign out.
Notification tokens (phone app): until you sign out on that phone, that sign-in ends, or Apple or Google tells us the token no longer works.
Your link to Apple, Google or Facebook sign-in: until you delete your login or account.
A phone sign-up you started but didn't finish: the password hash and Apple's token 24 hours; the email, ID and name 30 days; then deleted.
Addresses our emails can't reach: when an email to an address bounces for good or is marked as spam, we keep the address, the date and the reason on a do-not-email list, so we don't keep emailing it. It stays until the person tells us the address works again.
People we email about Canvas Scout (see above): what we found about them, our emails and their replies are deleted after 12 months, or after 90 days for people we decided not to email. The do-not-contact list (an address or domain, the date and why) is kept for good, so they aren't emailed again.
Emails you send us (see above) and our replies: deleted after 12 months.
Partner records (a partner's details, daily click counts, the customers they brought, commissions and payouts): kept as payment and tax records, like billing records above. A customer's entry in them holds no name, business, email or phone, and stays if that customer deletes their account, along with the commissions their payments earned, so the partner's history and totals stay correct.
Server logs: rotated automatically, generally within 30 days.
Google Analytics data: kept by Google for 14 months, then deleted. The random ID kept with your account is deleted with it.
Google Ads cookies on canvasscout.com last 90 days. How long Google keeps advertising data on its side is set by Google's own policy.
Meta Pixel cookies on canvasscout.com last 90 days. How long Meta keeps advertising data on its side is set by Meta's own policy.
Backups: nightly copies on our server, kept 14 days, with one copy a day also kept on our own office computer for up to 30 days; and a continuous, encrypted copy with Cloudflare that lets us restore any moment of the last 30 days. Both are overwritten on those rolling cycles, so something deleted from the Service is gone from every backup within 30 days.

How we protect it

All traffic is encrypted with HTTPS. Passwords are stored as one-way hashes. Sign-in cookies can't be read by scripts, and the app refuses to be embedded by other sites. The phone app keeps your sign-in in the phone's secure storage (the Android Keystore) instead of a cookie, and leaves it out of the phone's backups. Server access requires cryptographic keys, and the firewall only allows web traffic and SSH. No system is perfectly secure, but we work to protect your information and will notify you and the authorities as the law requires if a breach affects you.

Your privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other US states), you may have the right to:

know what personal information we have about you and get a copy;
correct inaccurate information;
delete your information;
opt out of the sale or sharing of personal information and of targeted advertising. We don't sell personal information. To opt out of the Google Ads, Meta Pixel and Meta ad-click sharing described above, use “Cookie settings” at the bottom of any page on canvasscout.com (Decline) or turn on Global Privacy Control, or after you've signed up write to hello@canvasscout.com; and
not be treated differently for using these rights.

You can delete your account, or just your own login on a team, yourself at any time in the app: Settings, General, Delete account (how, with or without the app). A plan that is still active ends at the same time. We honor these requests for everyone, wherever you live. Email hello@canvasscout.com with the subject “Privacy request.” We'll confirm your request within 10 business days and respond within 45 days. We may need to verify your identity, usually by confirming the email on your account. You can use an authorized agent; we'll ask for proof they're authorized. If we decline your request, you can appeal by replying to our decision, and if you're still unhappy you can contact your state attorney general.

Our sites respond to the Global Privacy Control signal. We treat the signal as an opt-out request: a browser sending it never loads Google Analytics, Google Ads or the Meta Pixel, never sees the cookie bar, and we never tell Meta about its sign-up, trial or payments.

Cookies

canvasscout.com sets Google Analytics, Google Ads and Meta Pixel cookies only if you click Accept in its cookie bar; you can change your mind anytime from “Cookie settings” at the bottom of every page. The app sets a sign-in cookie that's strictly necessary to keep you signed in, and keeps your map settings in your browser so the map opens the way you left it. If you open a Canvas Scout partner's link, a cookie of our own remembers that partner's code and when you clicked, for 60 days, so the partner can be credited if you sign up. While you browse canvasscout.com, your browser also keeps a note of how that visit arrived (the ad or link and its tracking tags, the first page, the name of the site that sent you), in session storage rather than a cookie; it's deleted when you close the tab and reaches us only if you sign up. Details are in our Cookie Policy.

The phone app. It doesn't use cookies: your sign-in is kept in the phone's secure storage, and your map settings on the phone itself. It asks your phone's permission, after a short screen that says why, before it uses your location, the microphone (the assistant and Learn) or notifications, and again before it uses your location in the background if you turn on drive tracking; the camera and your photos are opened only when you add a photo. You can change any of these in your phone's Settings. Links in our emails (setting your password, signing in, confirming your email) open the app when it's installed. Pages outside the app, such as our website or Salesforce and HubSpot sign-in, open in your phone's browser inside the app, where that site's own privacy policy applies. Files you download from the app, such as your history spreadsheet or a calendar entry, go to your phone's share menu, and you choose where they go.

Children

Canvas Scout is a business tool for people 16 and older. It isn't directed to anyone under 16, and we don't knowingly collect information from anyone under 16. If you believe a child gave us information, contact us and we'll delete it.

Where data is processed

Canvas Scout is for businesses in the United States. Our service providers may process information in the United States and other countries where they operate, under safeguards required by their contracts with us.

Changes to this policy

We'll update the date at the top when this policy changes. If a change is significant, we'll email customers or post a notice in the app before it takes effect.

Contact us

Reform Marketing LLC, dba Canvas Scout
6545 Market Ave. North, Ste 100
North Canton, OH 44721, USA
hello@canvasscout.com