Privacy Policy
LAST UPDATED — JULY 8, 2026
This policy applies to the websites and products operated by Canela Technologies LLC, including canelahq.com and AssetBolt. Our products are built for organizations, so most people use them through an account their employer or team controls. Our default is to collect as little as possible and to be clear about what we do collect. We don’t sell personal information, we don’t run ads, and we don’t share your data with advertisers.
What we collect and why
Identity and access
When you sign up for one of our products, we ask for your name, your email address, and possibly your organization’s name. We use that to operate your account, send you product and billing notices, and respond when you contact us. We never sell this information, and we don’t use it for third-party marketing.
Billing information
When you pay for a Service, your card details go directly to our payment processor — they never touch our servers, and we never store full card numbers. We keep the card brand and last four digits, plus your billing address, for invoicing, tax calculation, and fraud prevention.
Product content
The content you put into our products — in AssetBolt, things like asset records, assignments, and attachments — is stored so we can provide the Service to you. Because AssetBolt is an asset-tracking product, the history of that content matters too: changes and deletions become part of the audit trail your organization builds, and we store that history on your behalf. It’s all yours. We access it only in the limited cases described below.
Logs and device information
Our servers log basic technical information about requests — IP address, browser type, timestamps, and the pages or endpoints requested — which we use for security, debugging, and abuse prevention. Logs are kept for a limited period and then deleted or anonymized.
Product analytics
Inside our products, we use an analytics service (currently PostHog) to understand how features are used and where people run into trouble, so we can improve them. Analytics events may be tied to your account. This data informs our own product decisions; it’s never sold and never shared with advertisers.
Cookies
Our products use cookies to keep you signed in and to remember your preferences, and our analytics service may set cookies to distinguish sessions. The canelahq.com website itself sets no cookies and runs no analytics or tracking scripts. One note: our websites load their typeface from Google Fonts, so when your browser fetches the font, Google receives your IP address and browser information — that request sets no cookies.
Voluntary correspondence
When you email us with a question or ask for help, we keep the correspondence, including your email address, so we have a history to refer back to if you reach out again.
When we access or disclose your information
To provide the Services
We use a small set of third-party subprocessors to run our products — for hosting, payment processing, email delivery, and analytics. Currently: Cloudflare (hosting and content delivery), Stripe (payment processing), PostHog (product analytics), and Google Fonts (typeface delivery on our websites). We’ll keep this list current as it changes.
To help you, or to keep the Services running
No one at Canela looks at your product content except: with your permission, to help resolve a support request; when necessary to diagnose or fix a technical problem; to investigate potential abuse, as a measure of last resort; or when required by law.
When required under applicable law
Canela Technologies is a U.S. company and our infrastructure is located in the United States. We don’t disclose your data to law enforcement or other government authorities unless a legally binding order compels us to. Unless we’re legally prohibited from doing so, we’ll notify you before we disclose anything.
Aggregated and de-identified data
We may use aggregated, de-identified data — feature usage statistics, for example — to understand and improve our Services.
If ownership of the business changes
If Canela or one of its products is acquired by or merged with another company, we’ll notify you before your personal information is transferred or becomes subject to a different privacy policy.
We never have sold personal information, and we never will.
Your rights with respect to your information
Wherever you live, you can always:
- ask what personal information we hold about you, and get a copy of it;
- ask us to correct or delete it;
- export the content in your product account;
- object to, or ask us to restrict, certain processing;
- lodge a complaint with your data protection authority.
If you’re in the European Economic Area or the United Kingdom: we honor the rights granted by the GDPR and UK GDPR. Our Services store data in the United States; for customers who need one, we offer a data processing agreement incorporating Standard Contractual Clauses — email us.
If you’re a California resident: we don’t sell or “share” personal information as the CCPA defines those terms, and we don’t use sensitive personal information for anything beyond providing the Services. You have the rights to know, correct, and delete described above, and we’ll never discriminate against you for exercising them.
If your information is in someone else’s account: content inside a product account — including its audit history — belongs to the organization that holds the account. If your personal information appears in another organization’s account (say, an employee record in your employer’s AssetBolt account), that organization controls it, and requests about it should go to them. We’ll support account owners in honoring those requests.
To exercise any of these rights, email us at hello (at) canelahq (dot) com. We may need to verify your identity before acting on a request.
How we secure your data
All data is encrypted in transit between your device and our servers using TLS. Access to production systems is restricted to the people who need it to operate the Services, and we maintain backups to protect against data loss.
Retention and deletion
- While your account is active, we keep your content — that’s the service. Our products are built for asset tracking, where a dependable history is part of the point: records you delete inside a product are removed from normal use, but they — and the record of their deletion — are preserved in your organization’s audit history for the life of the account.
- Deletion happens when you cancel your account. Your content becomes inaccessible immediately, and we remove it from our systems in the ordinary course of business; we don’t commit to a fixed schedule.
- Copies may remain in our backups until those backups expire on their regular rotation schedule. Backups exist for disaster recovery; we don’t use them to restore content that has been deleted, and if we ever restore from a backup, we’ll delete that content again.
- We retain some information for longer where we have a legal or legitimate business need to do so — for example, billing records that tax and accounting law requires us to keep, or information needed to prevent fraud, resolve disputes, or enforce our agreements.
- Once data has been permanently deleted, we cannot recover it.
Where your data lives
Canela Technologies is a United States company, and our Services are hosted in the United States. If you use the Services from elsewhere in the world, you understand that your information will be transferred to, stored, and processed in the U.S.
Children
Our Services are built for business use and are not directed at children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, email us and we’ll delete it.
Changes and questions
We may update this policy as our practices or the law change. When we make a significant change, we’ll refresh the date at the top of this page and give account holders reasonable notice.
Questions about this policy, or about your data? Email us at hello (at) canelahq (dot) com.
Adapted from the Basecamp open-source policies / CC BY 4.0