Privacy Policy

Account data. When you sign up we collect your email address, password (stored as a hash by our authentication provider) or the identity returned by a sign-in provider, and any name or company name you choose to give us. We generate an API key for your account.

Billing data. Payments are processed by Stripe. We store your Stripe customer ID, subscription status, and plan. Card numbers are entered directly with Stripe and never reach our servers.

Tool and API inputs. When you or an AI assistant acting for you calls the API or an MCP tool, we receive the request parameters. For the MCP server these are the tool name and its arguments, which can include:

• Amazon identifiers such as ASINs, product URLs, ISBNs, UPCs, and EANs
• Search terms and autocomplete prefixes
• Category, seller, and author IDs
• Filters such as marketplace/domain, price range, sort, condition, page, and limit

The MCP server only receives the arguments of the tool call. It does not receive your chat history, conversation content, or other files from the AI client. Please do not put personal or sensitive information into search terms.

Authentication data. If you connect an AI client with OAuth, we verify the access token issued for your Canopy account and use the account ID in it to look up your API key. If you connect with an API key, the key is sent in a request header. We never write API keys or tokens to logs.

Usage and log data. For each request we record the account or API key it was billed to, the endpoint or tool name, request parameters, timestamp, response status, timing, result counts, short error summaries, and user agent (which usually identifies the AI client, for example ChatGPT).

Website data. Our website uses Google Analytics and Vercel Analytics to measure page visits, and Crisp for the support chat widget. These collect device, browser, and page-view information and may set cookies. Messages you send through chat or email are kept so we can answer them.

• To run the Service: authenticate you, fulfil each tool or API call, and return results
• To meter usage and bill you, including free monthly allowances and usage-based charges
• To enforce rate limits and prevent fraud, abuse, and resale of keys
• To debug errors, monitor reliability, and improve tool quality
• To send account and billing emails (not marketing) and answer support requests
• To meet legal, tax, and accounting obligations

We do not sell your data, share it for cross-context advertising, or use your tool inputs to train AI models.

We share data only with service providers that help us run the Service, under their own privacy and security terms:

• Cloudflare hosts the MCP server and APIs and stores request logs.
• Supabase stores account records and API keys and issues OAuth sign-in tokens.
• Stripe processes payments and receives usage counts for billing.
• Vercel, Google Analytics, and Crisp host the website, measure site traffic, and provide support chat.

When you use Canopy through an AI client such as ChatGPT, that client's provider receives the tool results we return and handles them under its own privacy policy. We may also disclose data if required by law, to protect our rights or users, or as part of a merger or sale of the business.

• Request and tool-call logs (including tool arguments and user agent): kept for up to 30 days, then deleted.
• Usage totals for billing: kept while your account is open and as long as needed for billing records.
• Account data and API keys: kept while your account is open, and deleted within 30 days after you ask us to close it.
• Billing and tax records: kept for as long as the law requires (generally up to 7 years).

• Disconnect an AI client at any time by removing the Canopy connector or app in that client. To cut off access everywhere, regenerate your API key from the dashboard; the old key stops working immediately.
• Access, correct, export, or delete your data by emailing support@canopyapi.co. We respond within 30 days.
• Cancel billing from the Stripe customer portal in your dashboard.
• Cookies for analytics can be blocked or cleared in your browser without affecting the API or MCP server.

Depending on where you live (for example the EU, UK, or California), you may have additional rights, including the right to object to processing or to complain to a data protection authority. We will not treat you differently for using them.

Data is encrypted in transit with TLS. API keys and OAuth tokens are checked on every request and excluded from logs. Access to production systems is limited to the people who operate the Service.

The Service is for businesses and developers and is not directed to children under 16. We do not knowingly collect their data.

We are based in the United States, and our providers may process data in the United States and other countries. Where required, we rely on our providers' standard contractual clauses or equivalent safeguards.

We will update this page when our data practices or tools change, and change the date at the top. For material changes we will notify account holders by email.

Rhino Labs LLC, operator of Canopy API. Email support@canopyapi.co. Support hours are 9am to 5pm Eastern, Monday to Friday.