Compliance

This page explains where Canora stands on privacy law, payments, AI and certifications today.

For how we handle personal information, see our Privacy Policy. For how we protect data, see our Security page. Your use of Canora is covered by our Terms of Service.

Canora is a product of Cast Hook LLC (“Cast Hook,” “we,” “us”).

For the store data you connect to Canora, including your customers' records, we process the data on your behalf to provide Canora to you. Under the GDPR, that makes you the controller of that data and us your processor.

For your own account, billing and sign-in details, and for visitors to canora.ai, we decide how the data is used. For that data we are the controller.

If you shop at a store that uses Canora, please contact that store about your data first. The store controls it, and we will help the store with your request.

The GDPR covers personal data of people in the EU and EEA, and the UK GDPR covers personal data of people in the UK. This is what we have in place:

• A Privacy Policy that sets out what we collect, why, and who we share it with, including a public list of our service providers.
• A way to handle your customers' access and erasure requests (see Privacy requests and deletion).
• Settings that limit how our main AI provider routes data (see AI transparency below).

Cast Hook does not currently offer a separate data processing agreement (DPA). We do not offer EU hosting; Canora is hosted in the United States (see Where data is processed below).

If we learn of a security incident that affects personal data we hold for you, we will notify affected account holders.

California law (the CCPA, as amended by the CPRA) gives California residents rights over their personal information. Where we stand:

• We do not sell personal information, and we do not share it for targeted advertising or use it for advertising of our own.
• canora.ai and the Canora dashboard do not use advertising or analytics cookies.
• We handle the store data you connect on your behalf, to provide Canora to you.
• California residents who use Canora can ask to know, correct or delete the personal information we hold about them by emailing trust@canora.ai. Requests about a store's customers should go to that store first.

As noted above, Cast Hook does not currently offer a separate data processing agreement.

We use a small number of service providers to run Canora. The full list, with what each one does and where it processes data, is on our Sub-processors page. Product lookup services receive only barcodes or product categories.

Approximate country at signup: IP Geolocation by DB-IP (CC BY 4.0).

OpenRouter, Wiro AI, Hive and Brandfetch do not publish a separate data processing agreement. For these providers we rely on their standard terms.

When we add a provider, we email the owners and admins of every Canora workspace. Whenever the list changes, we update the Sub-processors page and its effective date. The list there is the current record.

Canora is hosted in the United States on OVHcloud, and our databases, file storage and database backups are kept there. Database backups are kept within our hosting environment for a limited period. We do not currently keep a separate off-site copy.

Some of the service providers on our Sub-processors page, in particular AI model providers, may process data outside the United States.

We do not offer EU or other non-US hosting, and Canora is not currently available to businesses located in the EU, the EEA, the UK or Switzerland. Businesses elsewhere are hosted in the United States. So is your store data about customers who live anywhere, including the EU and the UK.

Payments to Canora run through Stripe's hosted checkout and billing pages. You enter card numbers and security codes on Stripe's pages, and they never reach Canora's servers.

To show your billing details, we read the card brand, last four digits and expiry date from Stripe. We do not store them.

Canora uses AI to draft product titles and descriptions, pull out product attributes, and prepare and generate product images.

• You review AI output. AI-written product text is a proposal, added to your products only after you approve it. Review AI-generated images before you publish or update the products they belong to.
• Labeling is up to you. Canora does not add an AI label, or machine-readable marking such as C2PA content credentials, to the text or images it publishes to your sales channels. You are responsible for labeling AI-generated content where the law or a sales channel requires it.

Most AI requests go through OpenRouter. We use OpenRouter's settings to send our requests only to model providers that OpenRouter lists as not storing or training on request data, and to turn off fallback to other model providers.

Wiro AI is one of our image generation providers and is used for every Canora workspace; there is no setting to turn it off. It receives your product photos, not customer records, but product photos can show people, such as models wearing your products. Wiro AI's own terms describe it as a data controller that may use customer data to improve its service, and we do not have a data processing agreement with it.

Images that Wiro AI generates are scanned by Hive for nudity and sexual content. An image the scan blocks is deleted, and is never shown to you or published. Other uploaded and AI-generated images are not currently scanned.

Your account. To access, correct, get a copy of, or delete the personal information in your Canora account, email trust@canora.ai from the address on the account. Requests are handled by a person; there is no self-serve data export.

Deleting your user in the dashboard. This closes your user account straight away and erases your personal details 7 days later. It does not delete your workspace's data, and you cannot do it while you are the only owner of an active workspace.

Your store data. In the dashboard, Delete catalog data removes products, variants, inventory, locations and product images (uploaded and AI-generated), related records such as reviews and AI suggestions, and customer records that no order belongs to. It keeps orders, the customers they belong to, and your store connections. Once every store is disconnected and no paid plan is active, the workspace owner can use Delete all data to delete all of the workspace's data, including orders, customer records and image files, apart from billing, legal and security records we keep on purpose. Disconnecting a store from its page in the dashboard deletes the catalog data synced from it and keeps its orders.

Your customers' data. Requests from your customers come to you, because you control their data. Email us any request you need us to act on, for any sales channel, and we will help. For Shopify, see Platform requirements below.

Backups and retention. Deleted data can remain in database backups for a limited period, until those backups expire. We do not delete most records automatically after a set period; they are kept while your account is active and removed through the steps on this page.

Cast Hook does not have a SOC 2 report or an ISO 27001 certification, and Canora has not had an independent security audit or penetration test.

We do not hold a PCI DSS certification of our own. Card payments are handled by Stripe (see Payments above).

Shopify app. Canora's Shopify app is distributed directly to merchants. It is not listed on the Shopify App Store and has not been through Shopify's App Store review.

Shopify privacy requests. Shopify sends apps three kinds of privacy request. Our Shopify app is built to handle them, but we have not yet confirmed on a live store that Shopify delivers them to Canora, so please also email us any request you need us to act on. Requests Canora receives are shown on the Privacy page of your dashboard and handled as follows:

• Customer data request. We gather the records we hold on that customer (their customer record, orders, reviews and review requests) into a file. An owner or admin of your workspace downloads it from your Privacy page and sends it to the customer.
• Customer erasure. We remove the customer's name, email address, phone number and default address from their customer record, anonymize their reviews, and delete their review requests. Order history is kept. Copies of that customer's details in the messages your store sent us are removed too.
• Shop erasure. When Shopify asks us to delete a store's data after the app is uninstalled, we delete that store's data, apart from billing, legal and security records we keep on purpose, such as billing history and the log of privacy requests. If your workspace is still in use, customer records that came only from that store have their personal details removed, and are deleted unless an order still belongs to them. Image files stored for that store are deleted too.

If you expect a request and do not see it on your Privacy page, please email us.

We will update this page and its effective date when anything on it changes.

Questions about this page, or privacy requests: Cast Hook LLC · trust@canora.ai