PhotoEditor.ai

GDPR overview

No page collected on this site mentions the GDPR: neither "GDPR" nor "General Data Protection" appears anywhere in the pages reviewed. The privacy policy, updated 26 March 2026, does list user rights, being informed, knowing what is collected, correcting, updating, requesting deletion, restricting or objecting, and refusing a decision based solely on automated processing, but it attaches them to no legal text. No lawful basis is cited, no Article 27 representative and no data protection officer are designated, and no transfer mechanism is described beyond the statement that data is only transferred "within jurisdictions subject to data protection laws that reflect our commitment", without naming those jurisdictions. The only age rule cited is COPPA, a United States statute covering children under 13. The terms are governed by Estonian law, with courts in Tallinn. Data requests go to hi@photoeditor.ai.

Who owns the data?

The terms contain no clause transferring ownership of uploaded images: End Products are described as created by the user, and the home page states that the AI outputs are yours to use commercially, the user remaining responsible for the rights on the source image. That permission is not uniform, since the Starter plan is nonetheless marked "For Personal Use Only". For personal data (name, email, date of birth, photo, social profiles, plus IP, device and location logs), the publisher claims custody rather than ownership: it says it does not sell or rent personal information to marketers or third parties, and it grants rights of correction, update and deletion. No company is named as controller, only the domain itself.

Reuse rights

Results can be reused without asking permission: the home page states that AI outputs are yours to use commercially, with responsibility for the source-image rights left to the user. The permission is not consistent across the site, as the Starter plan is labelled "For Personal Use Only" and a Commercial Use License is listed on Pro only. On the publisher's side, collected data is used to run and improve the service, understand visitors and send updates or promotional content, with an unsubscribe option; aggregated and anonymised versions may be shared, for example in trend reports. Unnamed categories of third parties are involved (analytics, authentication, advertising and promotion, content marketing, email marketing), and external consultants or agencies may be granted access for the duration of a task. Payments are processed by Stripe. On training, the site is categorical: uploads are "never used for AI model training", so no opt-out is offered because no training is claimed.

Data retention & training

Hosting summary

The site declares no hosting country and no hosting region. The privacy policy says only that personal information is "stored and processed in, or where we or our partners, affiliates and third-party providers maintain facilities", and that transfers are limited to jurisdictions subject to data protection laws reflecting the publisher's commitment, without naming a single one. The security claims concern transport and processing rather than location: uploads are described as encrypted in transit and processed in isolated workers, and the API page adds encryption at rest with automatic deletion after processing. The only jurisdictional anchor in the documentation is the governing-law clause of the terms, which designates Estonia and the courts of Tallinn; that is a choice of law, not a statement about where servers sit. Externally, the domain resolves to Cloudflare (AS13335, anycast IP 104.26.0.13) and the registrar is NameCheap in the United States, which describes the CDN in front of the site and says nothing about where images are actually processed or accounts stored. In practice, the hosting jurisdiction cannot be determined from what the publisher publishes.