Governing the use and licensing of user and Canva content
Overall Score
Risk by Category
The Canva Content License Agreement details the intellectual property rights and licenses associated with content uploaded by users and content provided by Canva. Users retain ownership of their User Content but grant Canva a broad, worldwide, royalty-free, non-exclusive, sublicensable license to host, store, display, reproduce, modify, create derivative works, and promote User Content as necessary to provide the Services. Canva Content (free and Pro) is licensed to users on a limited, non-exclusive, revocable basis with strict usage restrictions, prohibiting resale, redistribution outside Services, or use in sensitive contexts like pornography or illegal activities. Termination allows content removal, but licenses may persist for compliance.
Canva receives a broad license that survives termination for certain uses, including sublicensing to third parties.
Public designs may be featured in Canva's marketing materials worldwide.
Canva can remove or edit content at discretion without liability.
Users own their User Content and Canva does not claim ownership.
Clear rules on what users can and cannot do with Canva Content.
Basic content library accessible without subscription.
Spotify collects the following categories of personal data. High Risk categories are used for advertising profiling or involve sensitive personal information.
Images, text, videos, audio uploaded to create designs.
File names, creation dates, usage stats.
Shared links, comments, team interactions.
Your data serves the following purposes. Mandatory purposes cannot be disabled without canceling the service. Opt-out available purposes allow some user control.
User Content used for hosting, rendering, and sharing designs within Canva.
Aggregated usage data to improve platform (anonymized).
Public designs showcased in templates or promotions.
Spotify shares data with several categories of third parties. Sharing with advertising partners is extensive and represents the primary commercial use of your behavioral data.
Processors for hosting, CDN, etc., bound by agreements.
Canva group companies for services.
Canva may sublicense User Content to third parties.
The following rights may be available to you depending on your region. EU/EEA users have the broadest protections under GDPR. Non-EU users have more limited guarantees.
Users can delete designs; Canva removes within reasonable time.
Licenses terminate on account deletion, but copies may persist.
Users can download their designs in various formats.
Data is retained for different periods depending on category, and security disclosures vary in depth. The policy highlights the following retention and transparency points.
Retention Periods
Content retained as long as account exists.
Up to 30 days for backups; permanent after.
Retained indefinitely for analytics.
Security & Transparency
Reasonable technical measures to protect content.
Will notify if required by law.
No mention of ISO or SOC2, but complies with laws.
Source Text
Grants Canva broad rights to use User Content.
Interpretation
Allows Canva full operational use but user retains ownership.
Source Text
Limited license for Canva-provided content.
Interpretation
Restricts commercial exploitation outside platform.
Source Text
Canva can promote public designs.
Interpretation
Opt-in visibility leads to promotional use.
Source Text
Licenses end, content deletable.
Interpretation
Graceful exit but some persistence.
Source Text
No illegal, harmful, or competitive uses.
Interpretation
Strong guardrails on content application.
Yes, you own your User Content, but you grant Canva a license to use it for providing the services.