Skylum

GDPR overview

GDPR compliance is stated explicitly rather than implied. The privacy policy, effective 6 May 2026, names Shinyfields Limited as the data controller, the user as a data subject and Skylum's suppliers as processors, and commits the company to take commercially reasonable steps to maintain compliance with GDPR requirements. Access, rectification, erasure, restriction, portability, objection and withdrawal of consent are all listed, with privacy@skylum.com as the contact address. Because the publisher is established in Cyprus, no Article 27 representative is required and none is named; no data protection officer is designated either. Complaints are directed to the Office of the Commissioner for Personal Data Protection of Cyprus. Transfers outside the EEA are possible and rely on the European Commission's standard contractual clauses or another lawful mechanism, the policy acknowledging that no adequacy decision covers the United States.

Who owns the data?

Skylum processes uploaded photographs solely to deliver the requested feature, whether editing, enhancement or storage, and states that facial images are never analysed, retained or reused for facial recognition, identity matching, profiling or behavioural analytics, any facial analysis being performed in memory. Images are kept only as long as needed to return a result. The terms of use are far broader for anything posted through the site or the products: submitting "Materials" grants Skylum a perpetual, irrevocable, unlimited, transferable, sub-licensable, worldwide, royalty-free licence to reproduce, use, modify and distribute them. Under the GDPR, Shinyfields Limited acts as controller and its suppliers as processors.

Reuse rights

Users keep the practical freedom to do what they like with the photographs they edit. The AI guidelines confirm that commercial use of generative output is not prohibited, provided the guidelines and the licence agreement are respected, but Skylum warns that the legal framework around AI is still evolving and places full responsibility for any consequence on the user. Two limits are explicit. Output from the generative features may not be used to create, train, test or improve any machine-learning model or AI system, directly or indirectly. And a consumer licence may not be used for automated or bulk generation, for reselling access to third parties as a paid service or API, or shared between several people; those needs fall under a business licence. Skylum may also mark output as AI-generated through file metadata and encourages users to disclose it.

Data retention & training

Hosting summary

No hosting country or region is named anywhere on the site. The privacy policy states only that data may be stored and processed on systems located outside the European Economic Area, including where the organisation using the products is not based there. Transfers out of the EEA are said to rely on the European Commission's standard contractual clauses or another lawful mechanism, and the policy explicitly notes that no adequacy decision covers the United States. On security, Skylum says information is stored on secure servers and protected by technical and organisational measures, but no certification is cited, neither SOC 2 nor ISO. Photographs are held only for as long as needed to generate and return a result, with temporary caching possible to deliver the service, investigate a support request or check compliance with the terms. No named list of subprocessors is published; only categories are given, such as analytics, payment, order fulfilment, software development and IT support. The website itself is served through Cloudflare, which points to a content delivery network rather than to where user data actually lives.