---

name: canva-data-handling description: 'Analyze and govern Canva credentials, user metadata, designs, assets, comments, and temporary result URLs across their lifecycle. Use when defining collection, storage, access, retention, deletion, or privacy controls. Trigger with: "classify Canva data", "Canva retention", "delete Canva integration data".' allowed-tools: Read, Grep, Write, Edit version: 2.0.0 argument-hint: '[data-classification-and-retention-policy]' model: inherit effort: high license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags:

• saas
• canva
• data
• operations compatibility: 'Requires an approved organizational privacy/security policy and resource-owner authorization; this skill is not legal advice.'

---

Canva Data Lifecycle Control

Overview

Create an application-specific lifecycle map for every Canva data class. Minimize stored content, keep credentials segregated, and make deletion/revocation evidence reproducible without logging protected values.

Prerequisites

• Current data-flow and storage inventory
• Approved classification, retention, deletion, and legal-hold policy
• Tenant and resource ownership model plus incident contacts

Instructions

Step 1: Inventory data classes

Use Read and Grep to locate client secrets, access and refresh tokens, OAuth state/verifier, user/profile metadata, design references/content, assets, comments, job results, and logs.

Step 2: Define collection purpose

For each class, record purpose, explicit scope, source endpoint, owner, destination, processors, and whether collection can be avoided.

Step 3: Protect credentials

Store client secrets and user tokens in protected backend systems, separate access from refresh tokens, restrict operators, and exclude them from logs and backups where policy requires.

Step 4: Control content and URLs

Encrypt approved stored content, authorize every read, avoid durable storage of signed URLs, and derive expiry from current response evidence rather than a fixed assumption.

Step 5: Implement lifecycle

Use Write or Edit to apply policy-controlled expiration, consent revocation, account deletion, resource deletion, legal hold, and processor cleanup.

Step 6: Prove completion

Record counts, policy version, timestamps, opaque references, failed deletions, and follow-up owner without retaining deleted content in the receipt.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A user disconnects the integration. The service revokes or discards tokens, expires cached metadata and result references, schedules approved content deletion, and records a content-free receipt.

Error Handling

Failure	Response
Owner cannot be resolved	Quarantine access and stop processing
Deletion conflicts with legal hold	Preserve only the authorized hold and record its authority
Token appears in telemetry	Contain, revoke, and remediate the logging path
Processor deletion fails	Record the exception and escalate to the policy owner

Resources

• First-party source notes
• Connect security
• Canva privacy policy