Privacy Policy

This Privacy Policy explains how canva-craft.com ("we") handles personal data when you use the CanvaCraft AI independent guide and creative workspace. Last updated October 23, 2026.

Information we collect

Account data: name, email address, and, if you sign in with Google, the Google account identifiers needed to authenticate you.
Payment data: plan, amount, and Stripe customer or checkout references. Card numbers are processed by Stripe, not stored on our servers.
Generation data: mode, duration, aspect ratio, resolution, status, credit reservation, and private input/output files needed to run and deliver a job. Analytics does not record prompts, uploaded media, generated URLs, or raw provider responses.
Technical data: IP address, browser, device, and security logs used to operate and protect the site.

We use this information to create and secure your account, process payments and credits, run CanvaCraft AI generations, store and deliver private outputs, provide support, prevent abuse, and measure aggregate site usage.

Storage and processors

Application data is stored on Cloudflare (Workers, D1, R2, and KV). When enabled, Stripe handles payments and Google provides optional sign-in. Generation is submitted to our selected AI provider under a private workflow; successful outputs are copied into private R2 before playback or download. Optional analytics is consent-gated; third-party Plausible is currently unconfigured. We do not use advertising pixels on the public marketing pages.

Cookies

Essential cookies or similar storage keep you signed in and protect the session. Usage analytics is optional. Before collecting first-party visits or actions, we ask you to choose Allow analytics or Essential only. Your preference is stored on your device. We respect browser Do Not Track and Global Privacy Control signals. You can change your choice using Privacy choices; withdrawing clears the analytics visitor cookie and reloads the page to stop already loaded analytics scripts.

With permission, a signed, HttpOnly visitor cookie links visits and selected actions to first and recent campaign-source snapshots. We store only approved public/tool paths, referring domains, campaign labels, timestamps and limited action attributes. We remove URL query strings and fragments. After you sign in, the server can link these observations to your account; switching accounts rotates the visitor identity. Trusted Cloudflare metadata can provide country and IP address for first-party records. We do not send IP addresses or account identifiers to third-party analytics through these events. Prompts, files, private asset URLs, email addresses and access credentials are excluded.

Configured third-party usage analytics loads only after permission. Necessary account, payment and generation records continue to operate regardless of this choice. Browser observations do not prove payment or successful generation.

We do not sell personal data. We share data with processors listed above only to operate the service, or if required by law.

Retention

Account and billing records are kept while the account is active and as needed for accounting, disputes, and security. Generation files remain available while they are stored for your account. You should download copies you need to keep. First-party usage events default to 90 days of retention, configurable up to 365 days. Expired observations and inactive visitor records are removed in bounded batches as new analytics requests are handled; deletion may be delayed while collection is inactive. Withdrawing stops future collection and does not automatically erase past records. We may delete unused or abandoned data.

Information we collect

How we use it

Storage and processors

Cookies

Retention

Your choices

Children

Changes

Contact

Independence and current availability