Is Canva safe with your data?

Canva

50/100

Partial disclosure · high confidence

Canva earns a C (50/100) because it discloses its data practices only in part.

Dealbreaker flag

D1.4: you grant Canva a perpetual, royalty-free, sublicensable, license to display, host, copy, store and use your User Content

#74

of 216 apps ranked

score · Productivity avg 56

-6

vs category average

Grade scaleA · 70–100B · 60–69C · 48–59D · 35–47F · 0–34

Canva lets users turn off AI training in privacy settings and says users keep ownership of their content, but it names no retention period, takes a perpetual sublicensable licence over content in shared designs, and its data-portability right and international transfer safeguards reach only users in Europe, the UK and Brazil.

What Canva's privacy policy and terms of service say about your data

AI training is opt-out, not opt-in

Canva says it trains its algorithms and models on user activity, content and uploads, and points to a privacy controls page where that use can be managed. Education content is carved out of AI training entirely.

Content in shared designs carries a perpetual licence

Users are told they own their content, but including it in a design shared with others grants Canva a perpetual, royalty-free, sublicensable licence to keep hosting and using it.

No retention period is named

Profile information and content are kept for a "commercially reasonable time, and for as long as we have a valid purpose to do so," with no number given and no stated deletion timeline after account closure.

Some rights stop at the border

The structured-electronic-copy right is offered to individuals in the EU, UK and Brazil, and the EU Model Clauses and UK transfer addendum are promised for users in Europe, Switzerland and the UK, so other users are left without those commitments.

What the policy is silent or vague on

Not stated: your ownership of generated outputs
Not stated: data portability
Not stated: shorter retention for AI conversation logs
Not stated: marking of AI-generated output

Canva privacy rating

Training-data use0 of 4 disclosed

Keeps user inputs out of model training, or makes training opt-inPartial

Names a way to opt out of or into trainingPartial

Says whether training use differs by plan or tierPartial

Lets the user keep ownership of generated outputsSilent

Data-subject rights4 of 5 disclosed

Grants a right to access your dataDisclosed

Grants a right to delete your dataDisclosed

Offers data portability in a usable formatSilent

Grants a right to correct your dataDisclosed

Grants a way to object to or opt out of processingDisclosed

Retention and deletion0 of 4 disclosed

States a retention period for your dataPartial

States a deletion timeline after closure or requestPartial

Sets a shorter retention for AI conversation logsSilent

Commits to collecting only the data it needsPartial

Third-party sharing0 of 5 disclosed

Lists the categories of third parties it shares withPartial

References a sub-processor list or data processing agreementPartial

Does not sell or share data for advertising, or offers opt-outPartial

Names a safeguard for international data transfersPartial

States a standard for government and law-enforcement accessPartial

Transparency1 of 5 disclosed

Discloses that you are interacting with AIDisclosed

Marks AI-generated or synthetic outputSilent

Enumerates the categories of data it collectsPartial

Maps processing purposes to legal basesPartial

Is versioned and dated, with change noticePartial

Sensitive data and children1 of 2 disclosed

Discloses automated decisions and a human-review pathNot applicable

Limits the use of special-category dataSilent

Governs biometric data specificallyNot applicable

States protections for children's dataDisclosed

Security and accountability0 of 3 disclosed

Describes its security safeguardsPartial

Commits to breach notificationSilent

Names a certification or a privacy contactPartial

DisclosedPartialSilentAdverseNot applicable

Details

Category: Productivity
Modalities: image, video
Processes biometrics: No
Policy last updated: 2026-08-25
Region scored: Global / US-default
Last assessed: 2026-10-13

Documents examined

Other productivity apps

Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.