Compare Image tools
Verdicts and the data-handling fields already on each tool page, from the vendor's published pages. Unknown means that page did not answer.
Share this comparison: /categories/image/compare?tools=canva-magic-studio,grok,runway,stability-ai
| Field | Canva Magic StudioCanva | GrokSpaceXSI | RunwayRunway | Stability AIStability AI |
|---|---|---|---|---|
| Verdict | Careful | Careful | Careful | Careful |
| Trains on your data by default | Unknown | Unknown | Unknown | Yes |
| Training detail | The privacy policy says Canva uses machine learning to measure traffic and usage trends. It does not say customer designs are used to train generative models, and it does not say they are excluded. | The consumer FAQ, last shown as May 12, 2025, says SpaceXSI may use your content and interactions with Grok, including prompts, searches, and other materials you submit, along with Grok's responses, to train models, and that you control this in settings. The pages we read do not explicitly say whether Improve the Model is on or off when you first create a logged-in account. They do say that if you use Grok without logging in, where that is permitted outside the EU and UK, you will not have an option to opt out of model training. The same FAQ and the Enterprise FAQ say SpaceXSI does not use content from business and enterprise customers to train models, except that the Enterprise FAQ allows an optional trade of free credits for permission to train. Grok on the X platform is governed by X's privacy policy and terms, not this consumer policy. | The privacy policy we read does not say that customer inputs are used for training, and it does not say they are excluded. | The policy lists training, fine-tuning, and evaluation as a purpose for inputs and outputs, and it tells you to opt out in account settings when your information is used that way. |
| How to opt out | The policy describes opt-outs for marketing, third-party data used to personalize offers, and advertising matching. A generative-training opt-out for designs is not in the sections we read. | On grok.com, open Settings, then Data, and deselect Improve the Model. In the Grok mobile app, open Settings, then Data Controls, and deselect Improve the model. The consumer FAQ says this applies to new conversations. Private Chat, where available, is also excluded from training; turn it on with the ghost icon. Even after you opt out, voluntary feedback such as a thumbs-up or thumbs-down may still be used for training. Unauthenticated use outside the EU and UK has no opt-out. If you use Grok on X, the consumer FAQ points you to the X Help Center instead. | The documented opt-outs are for analytics such as Google Analytics, targeted advertising, and state sale or share rights. A model-training opt-out is not described. | Opt out from account settings. The policy points to a learn-more page for the control. Marketing email has a separate unsubscribe link. |
| Data retention | Unknown for designs and prompts. The policy describes how to ask for deletion of personal data. It does not give a day count for Magic Studio outputs. | Logged-in users can keep conversation history until they delete it. If you delete conversations or your account, or if you use Private Chat, the privacy policy and consumer FAQ say the data is deleted from SpaceXSI systems within 30 days, unless it must be kept longer for legal, compliance, or safety reasons, or has been de-identified or pseudonymized and disassociated from your account. The privacy policy, last updated October 27, 2026, does not state one retention period for ordinary saved chats you have not deleted. For the API, the security FAQ says inputs and outputs are stored encrypted for 30 days by default, or not persisted if the team enables Zero Data Retention. | Unknown. A retention period for prompts or outputs is not stated in the sections we read. | Data is kept for as long as reasonably necessary, including while the account is active and the data is needed to provide the service. The exact period depends on the agreement, disputes, and legal duties. |
| BAA / HIPAA | Unknown | No | Unknown | Unknown |
| BAA detail | The privacy policy sections we read do not offer a business associate agreement for Magic Studio. | The consumer privacy policy and terms do not offer a business associate agreement for personal Grok accounts. The Enterprise FAQ and the API security FAQ say SpaceXSI can support a customer's HIPAA obligations under some circumstances, and they point businesses to a BAA questionnaire. The API product page describes the enterprise API as HIPAA eligible, with a BAA available. That is not a consumer-plan offer. | The privacy policy does not mention a business associate agreement. | The privacy policy does not mention a business associate agreement. |
| Certifications | Unknown | Unknown | Unknown | Unknown |
| Enterprise and admin controls | The policy mentions Canva for Education as excluded from some advertising uses, and it refers to enterprise in passing. An admin control for model training is not documented on the page we read. | This draft is for the personal Grok app and grok.com, not for a Business or Enterprise workspace. Consumer terms say that if you sign up with a work email, your account may be linked to your organization's Grok Enterprise subscription, and an admin may access, monitor, and control it. Grok Business and Grok Enterprise, described on the business product page, the December 30, 2025 announcement, and the Grok.com user guide, are separate workspaces. Those pages and the consumer and enterprise FAQs say business and enterprise customer content is not used for training, with an Enterprise FAQ exception if the customer agrees to training in exchange for free credits. Business and Enterprise listings include no-training, team and seat management, and SOC 2. Enterprise adds custom SSO, SCIM, custom data retention, and, in Enterprise Vault, customer-managed keys and an isolated data plane. API customers can use a US regional endpoint and optional Zero Data Retention, which turns off features that need stored data. Authorized personnel may still review data when legally required, and automated classifiers may run for safety. A separate Grok Business or Grok Enterprise directory entry would be the cleaner way to rate those plans, similar to how ChatGPT is split. Certifications: Unknown for the consumer app. The API product page and API security FAQ say SpaceXSI is SOC 2 Type 2 compliant, and the Grok Business page also lists SOC 2 Type I and Type II. The pages we read do not say that certification covers the personal Grok app. | The policy mentions enterprise in passing. It does not document admin controls for training or retention. | The opt-out is an account setting. The policy mentions enterprise customers only in general terms and does not document an admin lock. |
| Last checked | 10 Nov 2026 | 11 Nov 2026 | 10 Nov 2026 | 10 Nov 2026 |