Last updated: 08 January 2024
If you are wondering what happens to your files when you upload them, the answer is simple: We upload them securely, process them as you would expect, provide you with the results for download, then delete them shortly after. That’s all.
We don’t publish your files, we don’t share them with anyone unexpected and we don’t use them to improve our products, unless you explicitly send them to our team as feedback.
We keep usage statistics (without your files) and if you contact us e.g. by email, we use the personal data you provide for our reply. If you buy from us, we also keep data for purposes like bookkeeping and financial reports.
Certain parts of our Services may ask you to provide personal data voluntarily: for example, we may ask you to provide your name, email address, marketing preferences, subscription type, and brand in order to register an account with us, to subscribe to marketing communications from us, and/or to submit enquiries to or complete a survey for us. The data that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your data.
We also collect any messages you send to us. We use this information to operate, maintain, and provide the features and functionality of our services to you, to correspond with you, and to address any issues you raise about our Services.
If you don’t provide your personal data to us, you may not be able to access or use certain features of our Services or your experience of using our Services may not be as enjoyable.
We may receive information about you from third parties. For example, if you access our Services through a third-party connection or log-in (e.g. through Facebook or Google), that third party may pass certain information about your use of its service to us. This information could include, for example, your name and email address, and any other information that you have permitted the third party to share with us. You should always review, and if necessary, adjust your privacy settings on third-party services before linking or connecting them to our Services. You may also unlink your third party account from our Services by adjusting your settings on the third-party service. If you unlink your third-party account, we will no longer receive information collected about you in connection with that service.
Our web server collects data that your Internet browser communicates to us, including the IP address of the requesting computer, location data, device or app data, together with the date, time, the request, which file is requested (name and URL), the amount of data transferred to you, a message as to whether the request was successful, identification data of the browser and operating system used, and the website from which the access was made (should the access take place via a link). The server logs are stored for a maximum of 3 months. We also collect information about how you have interacted with our Services, such as the pages you view, the links you click, the features you use, session duration, if you login to your account and purchasing behaviour, and we may infer your industry from the class of image or video utilised. Collecting this information enables us to better understand how people are using our Services and we use this information for our internal analytics purposes to improve the quality and relevance of our Services. We may also use this information to create aggregate, anonymized statistics which we use to provide certain features within the Services and for promoting and improving our Services.
When you use our Services, we send cookies — small text files containing a string of alphanumeric characters — to your device that uniquely identifies your browser and lets us help you log in faster and enhance your navigation through our services. A cookie may also convey information to us about how you use our Services (e.g. the pages you view, the links you click and other actions you take on the Services), and allow us or our business partners to track your usage.
We need a legal basis to collect, use and disclose your personal data. Our legal basis for collecting, using and disclosing your data will depend on the data concerned and the context in which it is processed. However, we will normally process your data only where we need the data to perform a contract with you, it is in our legitimate interests to do so, or we have your consent to do so. In some cases, we may also have a legal obligation to process your data.
If you contact us (e.g. by e-mail or telephone), your data is processed to carry out pre-contractual measures, fulfill our contract with you or because it is in our legitimate interests to do so.
If your data is processed to deal with business transactions and to process the sale of our Services, your data is processed to carry out pre-contractual measures, fulfill our contract with you or because it is in our legitimate interests to do so.
If we contact you to inform you about news from our company, offers and events and to promote our own range of Services, your data is processed either on the basis of your consent or because it is in our legitimate interests to do.
We process your data to ensure system security, manage the website technically, optimize service quality and analyze use of and improve our Services where it is in our legitimate interests to do. We do not rely on this lawful basis where our legitimate interests are overridden by your interest in protecting your data
We may process your data because it is necessary to comply with our legal obligations, such as for tax, accounting and audit purposes.
We may disclose your personal data to the following categories of recipients:
Your data will be stored and processed in Europe and any other country in which Operator, its affiliates or service providers maintain facilities.
This means that your data may be transferred to and processed in countries other than the country in which you are located. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).
You have the right to access the data we process about you, obtain rectification of inaccurate data, request deletion of your data, restrict our processing of your data, request portability of your data, and/or object to unreasonable processing. If we process your data on the basis of your consent, you have the option to withdraw your consent at any time. Doing so will not affect the lawfulness of the processing we carried out based on your consent up to the time of withdrawal.
You can exercise any of these rights by contacting us using the contact details provided at the bottom of this page under the “How to contact us” heading. We respond to all requests we receive in accordance with applicable data protection laws.
You also have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you or by contacting us using the contact details provided at the bottom of this page under the “How to contact us” heading.
Finally, you have the right to lodge a complaint with a supervisory authority. In Austria, the address of the supervisory authority is:
Austrian Data Protection Authority
Telephone: +43 1 52 152-0a
E-mail: [email protected]
We do not engage in automated decision-making. If we process your personal data for a purpose other than the one for which we collected your data, we will inform you of this fact and of that other purpose.
We retain personal data we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).
When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. We may retain certain account information to comply with our legal obligations (such as for accounting and audit purposes).
We may update this policy from time to time to reflect our current practice and ensure compliance with applicable laws. When we post changes to this policy, we will revise the “Last Updated” date at the top of this policy. If we make any material changes to the way we collect, use, store and/or share your personal data, we will take appropriate measures to notify you. We recommend that you check this page from time to time to inform yourself of any changes.
The data controller responsible for your personal data is Canva Austria GmbH, through its brands Kaleido, remove.bg, Unscreen or Designify .