PlayCanvas

GDPR overview

GDPR is named explicitly. The privacy policy says it is designed to comply with applicable law including the EU GDPR, identifies PlayCanvas Ltd as the controller for users in the EEA and the UK, and designates Snap B.V. in the Netherlands as its Article 27 EEA representative. Data subject rights are listed in full: information, access, rectification, erasure, restriction, portability, and objection to automated decisions and to profiling for direct marketing. They are exercised by post or by writing to info@playcanvas.com, with a right to complain to a local supervisory authority or the UK ICO. Transfers outside the EEA rely on the European Commission's standard contractual clauses, adapted for the UK and Switzerland. What is missing is equally clear: no published DPA, no named data protection officer, no subprocessor list and no security certification.

Who owns the data?

PlayCanvas claims no ownership of what you create. Section 5 of the Terms states that the company claims no intellectual property rights in the material and content you provide, and that your profile and uploads remain yours; it does not pre-screen content, but may remove it at its sole discretion. Publishing changes that balance. Section 3 provides that making content public grants PlayCanvas a perpetual, irrevocable, worldwide, sublicensable, royalty-free and non-exclusive license to host, store, copy, modify, cache, reproduce, distribute, promote, display, syndicate, create derivative works from and otherwise exploit it, with a waiver of moral rights where the law allows. Private projects, available on Personal and Organization, avoid that grant. Account termination deletes all content irrecoverably.

Reuse rights

The privacy policy, effective 15 May 2024, lists what is collected: full name, username and email address, data submitted through forms, survey responses, and visit data such as traffic, location and weblogs. A table sets out each purpose and its legal basis: operating the service (performance of the contract), product improvement and aggregate statistics (legitimate interest), marketing emails (legitimate interest or consent, with an unsubscribe route), anonymous statistics and corporate transactions (legitimate interest), plus fraud prevention and the defence of legal claims. PlayCanvas states plainly that it does not collect information from web applications built with its tools or embedding its engine, and that it processes only what is technically necessary, including IP addresses, to serve applications hosted on its servers. Data may be shared with affiliates, group companies and authorized service providers, which are not permitted to reuse it for their own purposes, and may be disclosed where the law requires or in a business transfer. Cookies fall into four categories, third-party cookies are used, and no subprocessor is named. Nothing in the documents addresses the training of AI models on customer data, in either direction.

Data retention & training

Hosting summary

PlayCanvas offers no choice of hosting region and makes no contractual commitment about where customer data lives. Section 6 of the Terms states that your information may be collected and processed by PlayCanvas in the United Kingdom and in the United States, as well as by its affiliates, and transferred outside the country in which you reside. The privacy policy confirms that information may be transferred to or stored outside your country and outside the EEA, in particular in the United States, and relies on the European Commission's standard contractual clauses, adapted for non-EEA countries including the United Kingdom and Switzerland, as its transfer mechanism. Applications you publish are served from a global CDN, so the delivery layer is distributed by design. The site's own DNS resolves to an Amazon edge node (AS16509) in Italy, which indicates a content delivery point of presence, not a storage location. No trust page, no named hosting provider, no subprocessor list and no security certification are published. Read the UK and US wording as a statement about where processing may happen, not as a localization guarantee.