How we handle your personal information.
This policy explains what Cherry Blossom collects when you use our website and editor, why, who handles it, how long we keep it, and the rights you have. It describes how the product works today.
Cette politique est aussi offerte en français.
The short version
- We collect what we need to run your account, save your projects, bill you and improve the product.
- Your designs are yours. We don't use them, or your chats with Sakura, to train our own models.
- When you use Sakura, your prompts and the relevant design data go to third-party AI providers, who may keep or use them as their own terms allow.
- We use analytics, including session replay, and link them to your account when you are signed in.
- We do not sell your personal information or use it for advertising.
- You can ask for a copy of your data, or have it deleted, at dev@trycherryblossom.com.
Who is responsible
Cherry Blossom is responsible for the personal information described here (under the GDPR, we are the controller).
- Company: Cherry Blossom
- Address: PLT, Université Laval, local 0314, Québec, Canada
- Privacy contact: dev@trycherryblossom.com
Our Chief Executive Officer is the person in charge of the protection of personal information, as Québec law requires. You can reach them at the same address. We have not appointed a data protection officer.
What we collect, and why
Each item says what we collect, where it comes from, why we use it, and the legal basis the GDPR gives us for it.
- Your account
- Your email address, your name if you gave one, and a user ID. They come from you, or from the account you choose to sign in with. We need them to give you an account and keep you signed in. Basis: contract.
- Your projects
- The projects you make in the editor, saved to your account, including any names and notes you type into them. If you used the editor from before October 2026, its boards, chats and images are still stored too. Basis: contract.
- Billing
- Your plan and its status, your billing IDs, your pay-as-you-go settings, and the credits you use. Our payment processor collects your card details and billing address; we never see your full card number. It also receives your email address and name. Basis: contract, and legal obligation for the invoice and tax records we must keep.
- Sakura requests
- Sakura is on the Pro and Ultra plans. When you send it a message, we process the message, the conversation so far, and the parts of your project it reads, so it can answer. We count your requests and credits to apply your plan's limits. The conversation itself stays in your browser tab and is not saved to your account. Basis: contract.
- Sakura logs
- Each Sakura request is also recorded in our analytics tool, linked to your account: the messages, the project data Sakura read, the reply, and the model's timing and cost. We use them to find where Sakura goes wrong and what it costs. Basis: legitimate interest in running and improving the service.
- Security and abuse
- Rate limits tied to your account, and the IP address of a request we refuse before we know who sent it. Basis: legitimate interest in keeping the service safe.
- Analytics and session replay
- How the website and the editor are used, on every page: pages viewed, the page address, clicks, errors, load times and session replays, with your IP address, your approximate location worked out from it, and your browser and device information. When you are signed in, these are linked to your account, your email address and your name. Basis: legitimate interest in finding bugs and improving the product. How to object is under Cookies and tracking, below.
- Messages to us
- What you send us by email or on our community server, and your email address, so we can reply. Basis: legitimate interest in answering you, or contract if you are a customer.
The law does not require you to give us any of this. Without your account details we cannot give you an account. We do not collect sensitive information, such as health data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
How the AI uses your designs
We don't use your designs or your chats with Sakura to train our own models.
To answer you, Sakura sends your prompts and the relevant design data to third-party AI providers. They process it under their own terms, and may keep or use it as those terms allow. We don't add your name or email address, but we can't control or guarantee what the providers do.
If that matters to you, don't put confidential or export-controlled designs in a request to Sakura. You can use the editor without Sakura: the Free plan has no AI at all.
Who handles your data
These kinds of service providers process personal information for us. Each one gets only what it needs for its job, and works under a contract that limits what it can do with it.
- Hosting and content delivery
- Runs the website and the editor, so every request passes through it. It also measures page views and load times on the public website.
- Database and backend
- Stores your projects, your plan and your usage.
- Sign-in
- Handles creating your account and signing in. It gets your email address, your name and your login details.
- Payments
- Charges your card, runs subscriptions and sends receipts and invoices. It gets your email address, your name, your card details and the credits we report for pay-as-you-go billing.
- AI model providers
- Produce Sakura's answers, as described above. They get your messages and the parts of your project Sakura reads.
- Product analytics
- Analytics, session replays, error reports and the Sakura request logs.
For the current list of providers by name, email dev@trycherryblossom.com.
We may also share information with our professional advisers, with authorities when the law requires it, and with a company that takes over our business, which would have to keep this policy's promises. Links to our community server, our code host or our booking page take you to those services, and what they collect is up to them.
Where your data goes
We are in Québec, Canada. Most of our service providers store and process data in the United States, and our analytics data is stored there. Some may process it in other countries where they operate. So your information leaves the province or country you are in.
Before we send personal information outside Québec, we assess whether it will be protected properly. For data from the European Union, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses (with the UK addendum where it applies), or on a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. Canada itself has an adequacy decision from the European Commission. Email dev@trycherryblossom.com for a copy of the safeguard that applies.
How long we keep it
- Account and project data
- For as long as your account exists. We delete it within 30 days of a deletion request.
- Billing and invoice records
- 6 years, as Canadian and Québec tax law requires.
- Analytics and Sakura logs
- Only as long as we need them for the purposes above. We aim to delete or anonymise them within 12 months. Session replays are deleted after a period set in our analytics provider's settings, 30 days today.
- Backups
- Our database provider keeps backups for a limited period set in its own settings, then deletes them. Data you delete can remain in a backup until that period ends.
How we protect it
Data is encrypted between your browser and our service. Access to personal information is limited to the people and providers who need it to run Cherry Blossom. No system is perfectly secure, so keep your own login safe too.
If a security incident puts your personal information at risk, we record it, act to reduce the harm, and notify you and the authorities when the law requires it: under Québec law when there is a risk of serious injury, and under the GDPR within 72 hours of learning of it, unless it is unlikely to harm anyone.
Your rights
Wherever you live, you can ask us to:
- give you a copy of your personal information
- correct information that is wrong
- delete your information
- send you your information in a structured, commonly used format, or to another company
- stop using it on the basis of our legitimate interest, including for analytics
- withdraw a consent you gave, at any time
To use any of them, email dev@trycherryblossom.com. We may ask you to confirm it is you, usually by writing from the address on your account. We answer within 30 days, at no cost. You can download any project yourself: in the editor, use Export, then Project file. You can delete a project from the dashboard, which removes it from our database.
- European Union and United Kingdom
- You also have the right to restrict how we use your data, and to complain to the data protection authority where you live or work, such as the ICO in the UK.
- Québec
- You also have the right to have us stop the distribution of, or de-index, information about you where the law allows, and to complain to the Commission d'accès à l'information du Québec.
- Elsewhere in Canada
- You can complain to the Office of the Privacy Commissioner of Canada.
- California
- You have the right to know, delete and correct your personal information, and we will not treat you differently for using these rights. We do not sell or share personal information, as California law defines those words, and we do not use sensitive personal information. An agent you authorize can make a request for you.
Deleting your account
To delete your account, email dev@trycherryblossom.com from your account's email address and ask us to delete it. We delete it within 30 days and tell you when it is done. There is no delete button. Cancel any paid plan first, and download the projects you want to keep.
We delete your account, your projects and the data linked to you in our systems and with the service providers that hold data linked to your account, including your analytics. Copies that AI providers keep under their own terms are outside our control. We keep only what the law makes us keep: your billing and invoice records, for 6 years. Copies can remain in backups until our database provider's backup period ends.
Children
Cherry Blossom is not meant for anyone under 16, and we do not knowingly collect their information. If you think a child has given us theirs, email dev@trycherryblossom.com and we will delete it.
Changes to this policy
We update this policy when the product changes how it handles personal information. The date at the top says when it last changed. If a change matters to you, we tell you by email at least 30 days before it takes effect. The terms of service cover the rest of how you use Cherry Blossom.