Canva is a privately held (VC- and institutionally-backed) online design and visual-content platform run by Canva Pty Ltd (Sydney, Australia). Its own privacy policy discloses partnerships with third-party ad networks (Facebook, Google, LiveRamp, Outbrain, Taboola, AppsFlyer) for personalized advertising and lists OpenAI as a subprocessor for its "Canva AI" products, while stating it does not sell or rent user information directly to those ad networks and offering an opt-out for AI-training use of content. Canva's App Store privacy label discloses that identifiers may be used to track users across other companies' apps and sites, alongside a broad Data-Linked-to-You category list (contact info, user content, search history, location, usage data, diagnostics, purchases, financial info). In May 2019 Canva suffered a breach, reported at roughly 139 million affected accounts, exposing emails, usernames and bcrypt-hashed passwords; Canva's own incident-notice page could not be fetched live (403/blocked, one Wayback attempt also failed), so the breach is sourced to third-party reporting rather than Canva's own notice.
TRACK RECORD
1 BREACH
[2019-05-24] · BREACH
Have I Been Pwned lists a breach record for Canva: "Canva".
Approximately 137,272,116 accounts affected, per HIBP.
Canva's App Store privacy label discloses that data 'linked to your identity' may include Purchases, Financial Info, Location, Contact Info, User Content, Search History, Identifiers, Usage Data and Diagnostics.
Canva's privacy policy states it analyzes users' activity, content and media uploads 'to train our algorithms, models and AI products and services using machine learning to develop, improve and provide our Service,' and that users can manage this AI-training use of their data in the privacy controls page under their privacy settings.
Forbes reporting states Canva, founded in Sydney, Australia by Melanie Perkins, Cliff Obrecht and Cameron Adams, was valued by private investors at $42 billion in August 2025, and that Perkins and Obrecht have pledged to transfer more than 80% of their combined stake to the Canva Foundation for charitable causes.
Canva's privacy policy identifies Canva Pty Ltd as the controller of personal data, with a registered address at 110 Kippax St, Surry Hills, NSW, Australia 2010, and names a EEA local representative (European Data Protection Office, Dublin).
Canva's privacy policy states it 'does not sell or rent' information collected directly from or about users to the third-party ad servers/networks it partners with for those parties' own marketing purposes, and offers users an opt-out of 'selling or sharing' personal information (including with third-party advertising partners) under California law; the same policy separately lists OpenAI as a subprocessor engaged for Canva AI products.
Have I Been Pwned's breach catalog lists the "Canva" incident (canva.com), breach date 2019-05-24, affecting approximately 137,272,116 accounts. Data classes exposed per HIBP: Email addresses, Geographic locations, Names, Passwords, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
A May 2019 breach of Canva's systems exposed data tied to approximately 139 million user accounts, including email addresses, usernames and bcrypt-hashed passwords, per third-party incident reporting; Canva's own incident-notice page (canva.com/help/incident-may24/) returned a blocked response under live fetch and a Wayback snapshot attempt also failed, so this is sourced to independent reporting rather than Canva's own notice.
Canva's privacy policy discloses it partners with named third-party ad servers, ad networks and social media platforms — Facebook, Google, LiveRamp, Outbrain, Taboola and AppsFlyer — to deliver personalized ads on the Service and other sites, and to measure ad effectiveness.