Canva Magic Studio — privacy & data policy

Provider: Canva. PromptPrivacy score: 54/100. Last verified August 26, 2026.

What happens to your data?

Canva collects your account details, uploaded media, prompts, and activity to provide design tools and personalize your experience. By default, Canva may use your content and activity to train its machine learning and AI models unless you opt out in your privacy settings. Data is also shared with third-party service providers, AI partners like OpenAI, and advertising networks.

Does it train on your data?

Canva analyzes user activity, content, media uploads, and related data to train its algorithms, machine learning models, and AI products/services. Users can disable this AI training via their account privacy controls. For Canva Education, Canva explicitly commits to not using student User Content for AI training.

Can you opt out?

Yes. Users can manage and opt out of having their data used for training AI and machine learning models through their account privacy settings. Users can also opt out of marketing communications and third-party profile enrichment.

Data retention

Canva retains profile information and user content for a 'commercially reasonable time' and for as long as there is a valid purpose following account termination or deactivation, such as complying with legal obligations, audits, and backup purposes. For Canva Education, student accounts inactive for over 12 months are notified and deleted after 3 months if not accessed.

Encryption & security

The policy states that Canva implements appropriate safeguards and reasonable identity verification steps to protect information, but specific technical standards (like TLS or AES encryption) are not detailed in the policy text, and Canva explicitly notes it cannot guarantee absolute security.

Is it safe for work?

Canva provides enterprise features such as administered accounts, team permissions, and Data Processing Addendums (DPAs). However, because standard accounts permit AI model training on uploads and prompts by default and share data with marketing partners, businesses must ensure administrative privacy settings and training opt-outs are actively configured.

Source policy: https://www.canva.com/policies/privacy-policy/