Canva Privacy Policy

This document is Canva's global Privacy Policy governing the collection, use, storage, and disclosure of personal information across Canva's design platform and related services, with legal bases including consent, legitimate interests, and contractual necessity depending on jurisdiction. The policy states that Canva collects name, email address, payment information, usage data, device identifiers, log data, location-related data, and content created or uploaded by users, and the terms authorize sharing this information with service providers, advertising partners, analytics providers, integration partners, and in the context of business transfers. The policy asserts broad authority to use user-generated content and uploaded materials to improve Canva's services and AI features, including training of machine learning models, subject to limitations described in separate AI-specific terms; the scope of consent obtained for AI training purposes may require evaluation under GDPR and applicable consumer protection frameworks depending on how opt-in or opt-out mechanisms are implemented in practice. The policy engages GDPR and UK GDPR for EU and UK users, CCPA and CPRA for California residents, and Australian Privacy Act obligations given Canva's Australian incorporation, and the document describes regional rights including access, correction, deletion, portability, and objection; COPPA implications arise for the education product given its use by minors, and the policy references a separate Children's Privacy Policy for those contexts. Material compliance considerations include cross-border data transfer mechanisms (Standard Contractual Clauses are referenced), data retention practices, the adequacy of consent mechanisms for behavioral advertising, and the sufficiency of disclosures regarding AI training data use.