MiriCanvas

GDPR overview

The privacy policy, effective 26 May 2026, carries a dedicated section titled For Users Having Usual Residence in European Union. It lists legal bases for processing (consent, performance of the contract, legal obligation, vital interest and legitimate interest) and recognises the right to have personal data transferred to another manager, the right to refuse processing, and the right to bring a grievance before a data protection authority. Marketing consent may be withdrawn at any time, and requests can be made by phone, email or post, to be handled without delay. A Chief Privacy Officer is designated, reachable at miricanvas@miricanvas.com or 1800-7848, and equivalent sections exist for California (CPRA), Virginia (VCDPA) and Japan. One gap is worth naming: no EU representative under Article 27 is appointed anywhere in the pages collected.

Who owns the data?

Under the AI Tools Terms, the user keeps copyright and ownership of User Input Data and AI Outputs, to the extent permitted by law, and the company claims no moral right over either. In return, the user authorises MIRI D.I.H to use those inputs and outputs for marketing purposes and to improve the service. Everything the platform supplies stays with the vendor: Design Elements and templates remain the property of MIRI D.I.H and of the original authors, and the License Agreement states that all rights not explicitly granted to the user, copyright and other intellectual property rights included, are held by the company and those original authors.

Reuse rights

MiriCanvas states plainly that it does not use User Input Data for AI training. The reservation sits downstream: by using the AI tools, the user consents to inputs being shared with technology partners such as OpenAI, LLC in the United States, both so those partners can deliver their service and so they can use the data to improve their own services. Stable Diffusion technology is also used, under the Creative ML OpenRAIL-M licence. Users may reuse their own designs and AI outputs as their own work without asking permission, subject to two contractual limits: no User Design may serve as a logo, BI/CI or a trademark to be registered, and User Designs containing Design Elements may not be resold on stock libraries and marketplaces such as Shutterstock, Getty Images or Naver OGQ. Users also undertake not to enter sensitive personal data, such as ethnic origin, political opinions, religion, trade union membership, health, sex life or sexual orientation, into the AI tools. Personal data is processed under the Korean PIPA, with GDPR legal bases listed for EU residents, and processors are named: KG INICIS, SK Planet, DAOU TECHNOLOGY, Korea Mobile Certification, GmateSystems, Innoi and NICE Information Service.

Data retention & training

Hosting summary

MiriCanvas is operated from South Korea by MIRI D.I.H, under the Korean Personal Information Protection Act (PIPA). Data centre operation is subcontracted to GmateSystems Co., Ltd., a Korean processor, and the site's IP address resolves to Incheon, South Korea, on AWS infrastructure (AS16509). Cross-border transfers are declared by name in the privacy policy: Zendesk in Japan for support requests, Braze in the United States, Intuition Machines (hCaptcha) in EU member states and the United States, and OpenAI, LLC in the United States for AI tool inputs. Refusing these transfers means the service cannot be used, so there is no practical opt-out. On safeguards, the footer displays ISO/IEC 27001 and ISO/IEC 27701 badges, and the declared measures include an internal management plan, staff training, encryption, access control, access logs and physical control of the server rooms. No certificate number or certifying body is published on the site.