Photiu.ai

GDPR overview

The GDPR is named exactly once, in the terms (7.2), and conditionally: if the user is a private individual and the processing is solely for personal or household purposes, submitted personal data is processed in accordance with applicable data protection laws, including the GDPR. The privacy policy borrows GDPR vocabulary — legal basis, legitimate interest, consent for cookies — without citing the regulation, and refers to "the rights and entitlements that you deserve under data protection guidelines" without listing a single one: no access, rectification, erasure, portability or objection. There is no DPO, no Article 27 EU representative, no supervisory authority named, no right to complain, no DPA, no sub-processor list and no standard contractual clauses. The only channel offered is a general willingness to discuss data protection questions, with no dedicated address. Governing law is that of the company's registered office, an address published nowhere.

Who owns the data?

The terms grant a temporary, non-exclusive and non-transferable right to use the platform (3.1); sub-licensing, reselling and sharing access are forbidden (3.2). Nothing in the published documents claims any ownership for the operator over the images you upload or the files the tools return. The Magic Eraser and Upscaler FAQs state explicitly that commercial use is allowed — e-commerce listings, marketing material, advertising, client work — provided you hold the legal rights to the original, and that processing does not alter the ownership or copyright of the source file. The operator disclaims responsibility for the content users upload or generate (5.1).

Reuse rights

Outputs can be reused without asking: no further permission is required to publish or sell an image processed by the tools, as long as you hold the rights to the original. On the platform's side, the privacy policy describes temporary processing of prompts and generated images, all scanned by automated systems for policy violations, with non-violating data deleted and violating content purged from the servers. Server logs — IP, date, time, request, file requested, volume transferred, browser, operating system, referrer — are kept for a maximum of three months on a legitimate-interest basis (security, technical management, quality of service), and transmission to third parties is forbidden except when an attack is reported to the authorities. Cookies are subject to consent, Google Analytics is used without combining your IP with other Google data, and Google sign-in collects only name, email address and profile picture to authenticate, create or link the account, with access revocable from your Google permissions page. The terms add that the operator may store and process IP addresses to detect abuse and overconsumption. Nowhere does the site state whether customer content is used to train models.

Data retention & training

Hosting summary

No hosting country or region is declared anywhere: neither the privacy policy nor the terms name a jurisdiction, a data centre or a cloud provider, and there is no trust or security page. No certification is claimed, neither SOC 2 nor ISO 27001. No sub-processor list is published either; only Google Analytics, Google sign-in, reCAPTCHA and the payment provider Creem can be identified from the documents, and none of them is presented as a sub-processor. The site is served behind Cloudflare (IP 104.26.10.81, AS13335), an anycast point of presence that says nothing about where images are actually processed or stored. The home page claims the service is secure and privacy-focused without a single technical detail behind the phrase. The only quantified retention figure in the whole documentation concerns server logs, kept for a maximum of three months. Governing law follows the company's registered office, whose address is published nowhere, which leaves both the applicable jurisdiction and the physical location of the data undetermined. Anyone with a data residency requirement should ask before uploading.