Canva AI
Canva AI (Magic Studio / Canva AI)
Provider: Canva Pty Ltd · Based in: 110 Kippax St, Surry Hills, NSW 2010, Australia · Provider website
- Plans
- 4
- Sources
- 13
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 2 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- mixed: all 4 plans
- Training on inputs
- opt-out available: Canva Free, Canva Prono: Canva Business, Canva Enterprise
- DPA
- no: Canva Free, Canva Proyes: Canva Business, Canva Enterprise
- Provider
- Canva Pty Ltd
- Based in
- 110 Kippax St, Surry Hills, NSW 2010, Australia (privacy policy: Canva Pty Ltd as controller under the GDPR/UK GDPR)
Values from 4 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Canva AI
Compare with another toolCompared plan by plan with other tools in the category Image & design:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | Canva FreeCompare Canva AI Canva Free with another tool | Canva ProCompare Canva AI Canva Pro with another tool | Canva Business (Trust Center also lists 'Teams')Compare Canva AI Canva Business (Trust Center also lists 'Teams') with another tool | Canva EnterpriseCompare Canva AI Canva Enterprise with another tool |
|---|---|---|---|---|
| differs by plan | 0 | not publicly documented | not publicly documented | not publicly documented |
| Details: Price | 0 (free plan according to the pricing page; amounts for the other plans not readable on retrieval) | not publicly documented (pricing page lists Pro; amount not readable on retrieval, see gaps) | not publicly documented | not publicly documented |
| yes | yes | yes | yes | |
| Details: AI features included | yes (pricing page 2026-10-18: "Up to 20 Standard or Premium AI uses"; comparison table Standard AI: "Limited AI access") | yes (Pro page: “Access premium content, brand tools, and AI features”, including Canva AI 2.0, Magic Layers, Canva Code; pricing page: "10x more AI than Canva Free (Premium or Ultra AI)", comparison table "High AI access", "AI Pass add-on available (extra cost)") | yes (pricing page: "20x more AI than Canva Free (Premium or Ultra AI)", comparison table "Higher AI access", "AI Pass add-on and AI top-ups available (extra cost)"; including Canva AI 2.0, Canva AI connectors, Magic Layers) | yes (pricing page: "20x more AI than Canva Free (Premium or Ultra AI)"; Canva AI 2.0 and Canva AI connectors marked "Soon"; comparison table: "Contact Sales to learn more about AI access for Enterprise") |
| differs by plan | no | no | yes | yes |
| Details: DPA | no (DPA according to the Trust Center 'for Canva Business and Canva Enterprise only') | no (DPA according to the Trust Center 'for Canva Business and Canva Enterprise only') | yes (automatic) Provider’s DPA | yes (automatic) Provider’s DPA |
| differs by plan | opt-out available | opt-out available | no | no |
| Details: Training on inputs | Trust Center: 'Canva won't use your user content to improve AI-powered features unless this is consistent with your Privacy Settings'; setting can be changed at any time; also applies to partners/service providers. Privacy policy (updated 2026-08-25): analysis of activity, content and uploads 'to train our algorithms, models and AI products and services using machine learning'; controlled via the Privacy Controls. The default value of the setting for individual accounts is not stated. AI Product Terms: 'Your Privacy Settings control whether Canva and our Technology Partners, may use your data to improve our AI services for everyone.' Canva Education: setting disabled, student content is not used. | Trust Center: 'Canva won't use your user content to improve AI-powered features unless this is consistent with your Privacy Settings'; setting can be changed at any time; also applies to partners/service providers. Privacy policy (updated 2026-08-25): analysis of activity, content and uploads 'to train our algorithms, models and AI products and services using machine learning'; controlled via the Privacy Controls. The default value of the setting for individual accounts is not stated. AI Product Terms: 'Your Privacy Settings control whether Canva and our Technology Partners, may use your data to improve our AI services for everyone.' Canva Education: setting disabled, student content is not used. | Trust Center: 'For users who have a Canva Business or Enterprise account, you'll see that this control in the Privacy Settings page is disabled' and 'we don't use your business, team or enterprise content to improve AI-powered features, and we don't allow third parties to do so either.' Note: an opt-in option for Business, Teams and Enterprise admins has been announced as 'coming soon'. | Trust Center: 'For users who have a Canva Business or Enterprise account, you'll see that this control in the Privacy Settings page is disabled' and 'we don't use your business, team or enterprise content to improve AI-powered features, and we don't allow third parties to do so either.' Note: an opt-in option for Business, Teams and Enterprise admins has been announced as 'coming soon'. |
| differs by plan | Privacy policy section 8: after account… | Privacy policy section 8: after account… | DPA Annex 1.B: 'Customer Personal Data… | DPA Annex 1.B: 'Customer Personal Data… |
| Details: Data retention | Privacy policy section 8: after account closure/deactivation, retention of profile data and User Content 'for a commercially reasonable time'; beyond that, for as long as a legitimate purpose exists (legal, audit, backup, archive). | Privacy policy section 8: after account closure/deactivation, retention of profile data and User Content 'for a commercially reasonable time'; beyond that, for as long as a legitimate purpose exists (legal, audit, backup, archive). | DPA Annex 1.B: 'Customer Personal Data will be retained for as long as is necessary for the Permitted Purpose or required by applicable law.' | DPA Annex 1.B: 'Customer Personal Data will be retained for as long as is necessary for the Permitted Purpose or required by applicable law.' |
| mixed | mixed | mixed | mixed | |
| Details: Hosting | Trust Center Privacy FAQ: 'Canva stores your data in the United States.' Processing by Canva group companies in Australia, New Zealand, the Philippines, the UK, Singapore, Europe and the USA (intra-group Data Transfer Agreement). Privacy policy (updated 2026-08-25) section 5: storage and processing in 'the United States, Australia, Singapore, European Union, United Kingdom, Philippines and New Zealand' and other countries. Sub-processor list (2026-04-17): AWS 'United States & EU', other hosting and AI service providers USA. Selectable EU data residency is not documented. | Trust Center Privacy FAQ: 'Canva stores your data in the United States.' Processing by Canva group companies in Australia, New Zealand, the Philippines, the UK, Singapore, Europe and the USA (intra-group Data Transfer Agreement). Privacy policy (updated 2026-08-25) section 5: storage and processing in 'the United States, Australia, Singapore, European Union, United Kingdom, Philippines and New Zealand' and other countries. Sub-processor list (2026-04-17): AWS 'United States & EU', other hosting and AI service providers USA. Selectable EU data residency is not documented. | Trust Center Privacy FAQ: 'Canva stores your data in the United States.' Processing by Canva group companies in Australia, New Zealand, the Philippines, the UK, Singapore, Europe and the USA (intra-group Data Transfer Agreement). Privacy policy (updated 2026-08-25) section 5: storage and processing in 'the United States, Australia, Singapore, European Union, United Kingdom, Philippines and New Zealand' and other countries. Sub-processor list (2026-04-17): AWS 'United States & EU', other hosting and AI service providers USA. Selectable EU data residency is not documented. According to the list, Nanonoble Pte. Ltd. does not process customer personal data for Canva Enterprise or customers with a signed Order Form. | Trust Center Privacy FAQ: 'Canva stores your data in the United States.' Processing by Canva group companies in Australia, New Zealand, the Philippines, the UK, Singapore, Europe and the USA (intra-group Data Transfer Agreement). Privacy policy (updated 2026-08-25) section 5: storage and processing in 'the United States, Australia, Singapore, European Union, United Kingdom, Philippines and New Zealand' and other countries. Sub-processor list (2026-04-17): AWS 'United States & EU', other hosting and AI service providers USA. Selectable EU data residency is not documented. According to the list, Nanonoble Pte. Ltd. does not process customer personal data for Canva Enterprise or customers with a signed Order Form. |
| list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
| differs by plan | 8 sources | 9 sources | 6 sources | 6 sources |
| Details: Sources with retrieval date |
|
|
|
|
Compare Canva AI Canva Free with another tool
Price and scope
- differs by plan
- 0
0 (free plan according to the pricing page; amounts for the other plans not readable on retrieval)
- yes
yes (pricing page 2026-10-18: "Up to 20 Standard or Premium AI uses"; comparison table Standard AI: "Limited AI access")
Contract and data use
- differs by plan
- no
no (DPA according to the Trust Center 'for Canva Business and Canva Enterprise only')
- differs by plan
- opt-out available
Trust Center: 'Canva won't use your user content to improve AI-powered features unless this is consistent with your Privacy Settings'; setting can be changed at any time; also applies to partners/service providers. Privacy policy (updated 2026-08-25): analysis of activity, content and uploads 'to train our algorithms, models and AI products and services using machine learning'; controlled via the Privacy Controls. The default value of the setting for individual accounts is not stated. AI Product Terms: 'Your Privacy Settings control whether Canva and our Technology Partners, may use your data to improve our AI services for everyone.' Canva Education: setting disabled, student content is not used.
- differs by plan
- Privacy policy section 8: after account…
- Privacy policy section 8: after account closure/deactivation, retention of profile data and User Content 'for a commercially reasonable time'; beyond that, for as long as a legitimate purpose exists (legal, audit, backup, archive).
Hosting and sharing
- mixed
Trust Center Privacy FAQ: 'Canva stores your data in the United States.' Processing by Canva group companies in Australia, New Zealand, the Philippines, the UK, Singapore, Europe and the USA (intra-group Data Transfer Agreement). Privacy policy (updated 2026-08-25) section 5: storage and processing in 'the United States, Australia, Singapore, European Union, United Kingdom, Philippines and New Zealand' and other countries. Sub-processor list (2026-04-17): AWS 'United States & EU', other hosting and AI service providers USA. Selectable EU data residency is not documented.
- list available
- Amazon Web Services (hosting, infrastructure, Canva AI; USA & EU)
- Anthropic (Canva AI; USA)
- ElevenLabs (Canva AI; USA)
- Features & Labels (Canva AI; USA)
- Google (hosting, infrastructure, security, Canva AI; USA)
- MongoDB (hosting; USA)
- Nanonoble Pte. Ltd. (Canva AI; USA; according to the list, not for Canva Education, Canva Enterprise or customers with a signed Order Form)
- OpenAI (Canva AI; USA)
- Snowflake (hosting; USA)
- Assembled (support; USA)
- Concentrix (support; Philippines)
- DeepL (translation; EU)
- Kaizo (support; EU)
- IBEX (support; USA)
- Zendesk (support; USA)
- Canva Austria GmbH (photo/video AI; EU & USA)
- Canva Pty Ltd (support; Australia)
- Canva Solutions Inc. (support; Philippines)
- Canva US, Inc. (support, printing; USA)
- Canva UK Operations Ltd (support, Flourish/Charts; EU)
- Leonardo.AI (AI; Australia & USA)
- Scene Group Ltd (Cavalry; EU)
- Serif (Europe) Ltd (Affinity; EU)
Evidence
- differs by plan
- 8 sources
- Privacy Policy (last updated 2026-08-25)Privacy notice, retrieved 18 Oct 2026
- AI Product Terms (effective 2026-06-26)Terms and conditions, retrieved 18 Oct 2026
- Terms of Use (effective 2026-08-19)Terms and conditions, retrieved 14 Oct 2026
- Canva's Sub-ProcessorsSub-processor list, retrieved 18 Oct 2026
- Trust Center – Privacy (incl. FAQ AI at Canva)Trust Center, retrieved 18 Oct 2026
- Canva List of Subprocessors (PDF, last updated 2026-04-17)Sub-processor list, retrieved 18 Oct 2026
- Canva Pricing: Compare Free, Pro, Business and Enterprise plansPricing page, retrieved 18 Oct 2026
- Canva Help Center: Manage your privacy preferencesHelp article, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Privacy policy: Canva's US subsidiary participates in the EU-US DPF, the Swiss-US DPF and the UK Extension. Trust Center: contracts with service providers contain the EU SCCs and the UK International Data Transfer Addendum; transfer impact assessments for providers. DPA (as of 2025-10-30): for Restricted Transfers, the SCCs are incorporated.
- Privacy Policy (last updated 2026-08-25) (Privacy notice), retrieved 18 Oct 2026
- Data Processing Addendum (last updated 2025-10-30) (DPA), retrieved 18 Oct 2026
- Trust Center – Privacy (incl. FAQ AI at Canva) (Trust Center), retrieved 18 Oct 2026
Certifications (as stated by the provider)
Security page: 'Canva is SOC2 Type II compliant and is ISO 27001 certified'. Under 'Certifications' also AICPA SOC 3, PCI DSS and Data Privacy Framework. Trust portal trust.canva.com: under Compliance SOC 2 Type 2, ISO/IEC 27001, PCI DSS, EU-US DPF, GDPR, CCPA, DSA, VPAT; neither the security page nor the trust portal states scope, period or date of issue; the reports are available only on request via the portal. ISO 27701 and ISO 42001 are not mentioned on the retrieved pages.
- Security at Canva (Trust Center), retrieved 18 Oct 2026
- Canva Trust Center (trust portal) (Trust Center), retrieved 18 Oct 2026
AI Act
Functions: Generation of images, video, text and audio (incl. music, voice, sound effects) by 'AI Products' (AI Product Terms). Product name: the navigation and product page use "Canva AI" as the umbrella term (including Magic Layers, Canva Code, Magic Resize, Magic Animate, Magic Write, Translate); canva.com/magic/ redirects to canva.com/canva-ai/ ("Canva AI 2.0"); on the pricing page "Magic Studio" now appears only in the line on Canva Shield ("Indemnification for AI output from Canva's Magic Studio"). The legal pages do not explain the names.
Provider’s statement: AI Product Terms (effective 2026-06-26): users are prohibited from 'Mislead anyone that the content generated by AI Products is human-generated' and 'Remove, alter, or disable any provenance or metadata tags from any AI-generated content, including but not limited to C2PA metadata'. Whether and to what extent Canva itself labels output with C2PA/metadata is not documented on the retrieved pages. A statement on the AI Act itself: not publicly documented.
Classification (for review, not legal advice): For review: the customer is typically a deployer (Art. 3 No. 4). Art. 50(2) (marking of synthetic content by the provider) and Art. 50(4) (disclosure of deepfakes/AI text by the deployer) are to be checked for generated images, videos, audio. Not legal advice.
- AI Product Terms (effective 2026-06-26) (Terms and conditions), retrieved 18 Oct 2026
- Canva Pricing: Compare Free, Pro, Business and Enterprise plans (Pricing page), retrieved 18 Oct 2026
- Canva AI 2.0 (target of the redirect from canva.com/magic/) (Provider product page), retrieved 18 Oct 2026
Current notes 2026
AI Product Terms effective 2026-06-26, Terms of Use effective 2026-08-19, privacy policy updated 2026-08-25, DPA updated 2025-10-30, sub-processor list 2026-04-17. Trust Center: data is stored in the USA; Business/Enterprise content is not used for AI improvement, an admin opt-in has been announced. The pricing page lists Free, Pro, Business, Enterprise; according to the pricing page, existing Canva Teams customers remain on their plan. Controller is Canva Pty Ltd (Australia); EU representative EDPO (Dublin).
Open points of the review
- Prices for Pro and Business: canva.com/pricing delivers the amounts only via JavaScript; the page source code contains only unlabelled numeric values without a clear assignment to plan and billing interval; check in a browser not possible (no browser tab available).
- Default value of the AI training setting for Free/Pro: visible only in the Privacy Settings after login; the Trust Center, privacy policy and help article "Manage your privacy preferences" do not state it.
Frequently asked questions
Where does Canva AI store data?
mixed (plans: Canva Free, Canva Pro, Canva Business (Trust Center also lists 'Teams'), Canva Enterprise). According to the provider, as of 18 Oct 2026.
Is there a DPA for Canva AI?
no in: Canva Free, Canva Pro; yes in: Canva Business (Trust Center also lists 'Teams'), Canva Enterprise. According to the provider, as of 18 Oct 2026.
Does Canva AI use inputs for AI training?
opt-out available in: Canva Free, Canva Pro; no in: Canva Business (Trust Center also lists 'Teams'), Canva Enterprise. According to the provider, as of 18 Oct 2026.
Where is the provider based?
110 Kippax St, Surry Hills, NSW 2010, Australia (privacy policy: Canva Pty Ltd as controller under the GDPR/UK GDPR). According to the provider, as of 18 Oct 2026.
All sources
- 01Privacy Policy (last updated 2026-08-25)Privacy notice · retrieved 18 Oct 2026
- 02AI Product Terms (effective 2026-06-26)Terms and conditions · retrieved 18 Oct 2026
- 03Terms of Use (effective 2026-08-19)Terms and conditions · retrieved 14 Oct 2026
- 04Data Processing Addendum (last updated 2025-10-30)DPA · retrieved 18 Oct 2026
- 05Canva's Sub-ProcessorsSub-processor list · retrieved 18 Oct 2026
- 06Security at CanvaTrust Center · retrieved 18 Oct 2026
- 07Trust Center – Privacy (incl. FAQ AI at Canva)Trust Center · retrieved 18 Oct 2026
- 08Canva List of Subprocessors (PDF, last updated 2026-04-17)Sub-processor list · retrieved 18 Oct 2026
- 09Canva Pricing: Compare Free, Pro, Business and Enterprise plansPricing page · retrieved 18 Oct 2026
- 10Canva ProProvider product page · retrieved 14 Oct 2026
- 11Canva AI 2.0 (target of the redirect from canva.com/magic/)Provider product page · retrieved 18 Oct 2026
- 12Canva Trust Center (trust portal)Trust Center · retrieved 18 Oct 2026
- 13Canva Help Center: Manage your privacy preferencesHelp article · retrieved 18 Oct 2026
More tools in Image & design with an EU hosting option (in at least one plan)
- ElevenLabs · Based in: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA
- Figma AI · Based in: Figma, Inc., 760 Market St, Floor 10, San Francisco, CA, USA
All tools in Image & design · Tools with an EU hosting option
Further reading
All tools in the category: Image & design. Figures across all tools: Data report.