Picsart

GDPR overview

The enterprise page states in plain words that Picsart is SOC 2 certified and GDPR compliant, with all data encrypted at rest and in transit. The privacy policy of November 16, 2023 gives EU and UK residents a dedicated section covering access, rectification, erasure, restriction and portability. Rights are exercised free of charge through privacy.picsart.com or privacy@picsart.com, with identity verification first, a stated one-month response time and a reminder of the right to complain to a local supervisory authority. A Data Protection Officer is designated at DPO@picsart.com, transfers outside the EU and the UK rely on standard contractual clauses, and a subprocessor list of 30 entries with countries and purposes is published. Two gaps remain: no Article 27 EU representative is designated, and no data processing agreement is published.

Who owns the data?

The data controller is PicsArt, Inc., a Delaware company with its registered office in Hallandale Beach, Florida. A Data Protection Officer is reachable at DPO@picsart.com and the privacy team at privacy@picsart.com. Picsart states that it claims no ownership of user content, except where that content includes Picsart Content. Users still grant the company a worldwide, non-exclusive, royalty-free, sublicensable, transferable and perpetual license. Deleting a file or an account revokes it, but content already shared can stay online indefinitely. Seven affiliated Picsart entities, in the United States, Armenia, Canada, the United Kingdom, Romania, China and Germany, receive data. The privacy policy in force is dated November 16, 2023, the subprocessor list April 25, 2023.

Reuse rights

Picsart processes personal data to perform the contract, on legitimate interests (running the service, support, fraud prevention, diagnostics, research and development), on consent for marketing and interest-based advertising, and to meet legal obligations. The data covered includes identity and email, approximate location from IP, optional demographics, uploaded images, log and device data, cookies and content metadata such as geotags. When facial effects or face generation are used, Picsart scans face geometry in the uploaded images, which the privacy policy itself calls biometric data; data captured through the TrueDepth API on iOS is handled in real time on the device and is neither stored persistently nor shared. Data is shared with service providers, advertising networks, authorities, subsidiaries and affiliates, with Google Analytics, Crashlytics, Firebase and Facebook named for analytics. Neither the privacy policy nor the terms of use mention AI model training on customer content. As for reuse by other end users, nothing is granted by default: only content the author tags #freetoedit or #freeforbusiness becomes reusable by the rest of the community, commercially in the second case.

Data retention & training

Hosting summary

No hosting country and no hosting region are published, so both dedicated fields are left empty. The security policy states that Picsart uses ISO 27001 and SOC 2 compliant data centers by geographic location whenever its data center providers make them available, without naming a single country. The published subprocessor list names Amazon Web Services as cloud provider and Cloudflare as CDN, both declared in the United States, and the site's IP address resolves to a Cloudflare anycast node. As a worldwide service, Picsart transfers personal data outside the EU and the UK under standard contractual clauses. On the technical side, the company claims logical data isolation between customers, AES-256 encryption at rest, TLS 1.2 or above in transit and alignment with NIST standards. A targeted search for hosting locations returned nothing: buyers with data residency requirements will have to ask Picsart directly.