Canva AI and Magic Studio safety profile

What it does with your data

What Canva does with your content depends on the kind of account you use.

On individual accounts, Canva may look at your activity, content and uploads to train its algorithms, models and AI products. It does this only where that fits your Privacy Settings. The pages checked do not say whether that setting starts on or off, so check it yourself. Canva also uses usage data, such as design metadata and analytic events, to improve AI features. It says that data never includes your content.

On Canva Business, Teams and Enterprise accounts, Canva says your content is not used to improve AI features, and third parties may not use it either. Student content on Canva Education is also excluded. For users in the EEA, Switzerland and the UK, this kind of use is based on consent.

After an account closes, Canva keeps profile information and content for “a commercially reasonable time.” It keeps them longer where it has a valid purpose such as legal duties, audits, backups and archives.

Settings to change first

If anyone uses an individual Canva account for work, have them do this before they start:

1. Open the Privacy Settings page and turn off use of your data to improve AI-powered features. Canva says you can change this at any time.
2. Open AI personalization settings to review the memories Canva keeps.
3. Find the delete and download options in Account Settings so you can clear old files later.

On Business, Teams and Enterprise accounts, the AI improvement control on the Privacy Settings page is disabled because Canva does not use that content. Canva says an opt-in for admins is coming soon. When it appears, leave it off. Users in the EEA, Switzerland and the UK can withdraw consent on the privacy settings page or through Canva’s legal form.

Free and paid tiers

The biggest difference is between individual accounts and organization accounts. The pages checked do not separate free individual plans from paid individual plans, so treat them the same.

• Individual accounts, free or paid: content may be used to improve AI features, depending on each person’s Privacy Settings.
• Teams: content is not used to improve AI features, and the setting is disabled.
• Business and Enterprise: the same training exclusion applies. These plans also include a Data Processing Addendum that becomes part of the agreement automatically. In Europe and the UK, Canva acts as data processor for Business customers’ team data.
• Canva Education: student content is not used for AI training. Students see no ads, and their personal information is not sold or shared.

Admin controls

When staff sign up with an organization email, their account becomes an administered account. Your admin can then:

• access, transfer and control the account and all its designs
• change billing and privacy preferences and folder permissions
• delete the account

Canva may also share each user’s name, email address and account activity with your organization.

On Teams, the Team Owner or any Team Administrator can move, delete or edit shared folders and items. Canva can also reassign ownership of content when the Team Owner asks.

On certifications, iKeepSafe has certified Canva for Education as FERPA and COPPA compliant, and Canva Philippines lists an NPC Seal of Registration. Canva’s U.S. subsidiary adheres to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension. No checked page names a SOC 2 or ISO 27001 report.

Using it with donor and client data

Use Canva Business or Enterprise for any work that touches donor or client information. Those plans keep your content out of AI improvement and include the Data Processing Addendum. Teams also keeps your content out of training, but the pages checked offer the addendum only on Business and Enterprise.

Even on those plans, keep sensitive records out of Canva. Do not paste in:

• donor names with gift amounts or giving history
• client case notes or intake details
• health or payment details

Design with placeholder names, then add real details in your own systems.

Before staff use Canva with donor data, get 2 things in writing from Canva. First, where your data is stored. One page says the United States, but the privacy policy lists several countries, and no page offers a region choice. Second, which security audit reports, such as SOC 2, Canva can share. The pages checked name none.

Questions people ask

Does Canva train its AI on our designs?

It depends on the account. Individual accounts follow each person’s Privacy Settings. Business, Teams and Enterprise content is not used to improve AI features.

Can we choose where our data is stored?

No checked page offers a region choice. Canva’s FAQ says data is stored in the United States. Its privacy policy also lists Australia, Singapore, the European Union, the United Kingdom, the Philippines and New Zealand.

What happens to our files if we close the account?

Canva keeps profile information and content for a commercially reasonable time after closure. It keeps them longer for legal, audit, backup and archive purposes. Before you close the account, download what you need and delete your data in Account Settings.