Legal
Privacy Policy
This policy explains what information Graveyard Studios collects, why, where it is kept, and the choices you have. It covers our websites and the Graveyard Creative Suite (GCS) app, including the data GCS receives from Google when you connect a Google account.
Contents
1. Who we are
Graveyard Studios is a creative studio based in Ontario, Canada (“Graveyard Studios”, “we”, “us”). We are responsible for the information described here. You can reach us at info@graveyardstudios.art.
2. What this covers
- Websites: graveyardstudios.art, portfolio.graveyardstudios.art, campaigns.graveyardstudios.art and cloud.graveyardstudios.art.
- Graveyard Creative Suite (GCS): our desktop app for running creative projects, including its optional connection to Google services.
Paid client engagements may also be governed by a separate agreement. If that agreement says something different about client materials, the agreement wins.
3. What we collect
Information you give us
- Early-access list: your email address, and which page you signed up from.
- Portfolio access requests: your email address and, if you provide them, your name and a note.
- Sign-in: your email address when you sign in with a one-time email link or password, or your Google account name, email address and profile picture when you sign in with Google.
- Client campaigns and boards: content you or we add to a campaign or board (notes, images, links, comments), and who added it.
- Messages you send us by email.
Information collected automatically
- View counts for images in the portfolio. These are counted per image, not per person.
- Standard server logs kept by our hosting providers (such as IP address, browser type and time of request), used for security and reliability.
We do not run advertising trackers and we do not sell personal information.
4. Google user data
GCS can connect to your Google account, but only if you choose to. It asks for the permissions below, and uses each one only for the feature listed.
| Permission | What GCS does with it |
|---|---|
| Basic profile and email openid, email, profile | Signs you in and shows which account is connected. |
| Gmail, read-only gmail.readonly | Finds payment notices that match your open invoices, shows recent important mail in your inbox view, and tracks which of your sent emails are still waiting on a reply. GCS cannot send, delete or change email with this permission. |
| Calendar events calendar.events | Shows your calendar events in your GCS schedule and, only when you ask it to, creates or updates an event. |
| YouTube, read-only youtube.readonly | Reads your own channel’s public statistics and recent uploads for your content dashboard. |
If GCS ever needs a permission not listed here, we will update this policy before asking for it.
Limited Use. GCS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice that means:
- We use Google user data only to provide and improve the user-facing features described above.
- We do not sell it, and we do not use it for advertising.
- We do not transfer it to others except as needed to provide those features (see AI features), to comply with law, or as part of a merger or acquisition with notice to you.
- No person reads it unless you ask us to, for example for support, or it is needed for security or to comply with law.
- We do not use it to develop, improve or train generalized AI or machine-learning models.
Google data that GCS reads is processed and stored on the computer where you run GCS. The access tokens that let GCS reach your Google account are stored on that computer too, not on our servers.
You can disconnect Google at any time in GCS, or by removing access at myaccount.google.com/permissions.
5. AI features
Some GCS features use AI models. Examples are sorting your inbox, drafting a suggested reply for you to edit, or spotting a payment that matches an invoice. To do this, GCS sends the minimum text the task needs to the AI provider configured in the app. That provider may be Anthropic, OpenAI, Google (Gemini) or xAI.
- That text is sent only to run the feature you are using, through the provider’s business API.
- We do not permit it to be used to train the provider’s models.
- AI output in GCS is labelled as AI-generated. This includes anything financial, legal or client-facing. It stays a suggestion until you confirm it.
- GCS never marks an invoice paid, or sends anything, on an AI suggestion alone.
6. How we use information
- To provide the sites and GCS, and to show you the projects and campaigns you have access to.
- To review portfolio access requests and contact you about them.
- To tell you when GCS opens, if you joined the early-access list.
- To keep our services secure, prevent abuse, and fix problems.
- To meet legal, tax and accounting obligations.
8. Storage and security
Information for the websites and client campaigns is stored with Supabase and Vercel, which may be in Canada, the United States or other countries. Access to stored data is enforced on the server, so each person can reach only what they have been granted. All traffic uses HTTPS. API keys and access tokens are kept on servers or on your own device, never in web pages.
No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.
9. Retention and deletion
- Early-access list: kept until GCS opens or you ask to be removed.
- Access requests: kept while access is active, plus up to 12 months after.
- Campaign and board content: kept for the life of the project, then archived or deleted on request.
- Google data in GCS: kept on your computer until you disconnect Google or delete it in the app. Disconnecting stops new access straight away.
- Records we must keep by law, such as invoices, are kept for the period the law requires.
To delete your information, email info@graveyardstudios.art. We will confirm within 30 days.
10. Your choices and rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct it;
- delete it;
- get a copy of it;
- object to or limit how we use it;
- withdraw consent.
Canadian privacy law (PIPEDA), and laws like the GDPR and US state privacy laws, give these rights. Email us to use any of them. If you are not satisfied with our answer, you can complain to your local privacy regulator, such as the Office of the Privacy Commissioner of Canada.
12. Children
Our services are not directed to children under 16, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.
13. Changes
We will post any change on this page and update the date at the top. If a change materially affects how we use Google user data or other personal information, we will tell you before it takes effect. Where the law requires it, we will ask for your consent.
14. Contact
Graveyard Studios · Ontario, Canada
info@graveyardstudios.art