Photoroom

GDPR overview

GDPR applies in full: Photoroom is a French company established in the EU, with the CNIL as lead supervisory authority and no Article 27 representative required. An external Data Protection Officer, declared to the CNIL, is reachable at privacy@photoroom.com. The privacy policy maps each purpose to a legal basis and a retention period, and lists the rights available: access, rectification, erasure, restriction, portability, objection, instructions on data after death and withdrawal of consent. Requests are answered within one calendar month, extendable to three when complex, and complaints can go to the CNIL or a local authority. Transfers outside the EEA are covered by appropriate safeguards aligned with GDPR and CNIL guidance, and breach notification is documented. A DPA is available to Enterprise customers through the account team. A separate California CCPA notice applies; minimum age is 13; policy updated March 2026.

Who owns the data?

Photoroom's terms draw a clear line between the two sides. The customer owns all Customer Content, a category that covers both Personal Data and User Content, and the wording leaves no room for doubt: “Photoroom does not claim any ownership rights in Customer Content.” What Photoroom generates around that content is treated differently. Company Data, meaning usage data plus derivative aggregated or anonymized data, is “owned solely and exclusively” by Photoroom, which may exploit it during and after the subscription, free accounts included. For the services themselves, the privacy policy positions Photoroom as data controller rather than processor.

Reuse rights

Customers keep their content and can reuse their exports without asking permission, with one contractual limit: the free account license is personal and non-commercial. On Photoroom's side, the privacy policy lists the purposes it processes data for: account management, subscription purchase and payment, running the service, legal moderation, newsletters, audience-measurement cookies, refund-fraud prevention and the referral program. Uploaded images also feed model development, since Photoroom “processes and uses the images you upload to improve, train and develop Photoroom's products, services and models”, on a legitimate-interest basis. That part is controllable: an opt-out is available at any time in account settings, although it is not retroactive. Images sent through the API are excluded, as “our model improvement does not apply to the images processed through our Application Programming Interface (API)”, and Enterprise contracts do not train by default. Images kept for training are selected and annotated without names, contact details, identity or location, stored separately from production data, with logged access limited to the ML team. Named subprocessors include Apple and RevenueCat for refund eligibility and Dub for referrals, alongside GCP, AWS, Cloudflare, Datadog and Vercel on the infrastructure side.

Data retention & training

Hosting summary

Photoroom's infrastructure runs in the United States, and the company states it plainly: “Our infrastructure runs in the United States. EU-only data residency isn't available today.” Hosting and storage sit on Google Cloud Platform and AWS, with Cloudflare for CDN, security and DNS, Vercel for hosting and Datadog for logging. The legal notices name Cloudflare (101 Townsend St, San Francisco) as the website host and Google LLC (1600 Amphitheatre Pkwy, Mountain View) as the data host. Data in transit is encrypted with TLS 1.2 or above, managed through Cloudflare, while encryption at rest is handled by the cloud providers. Since the publisher is established in France, transfers outside the EEA are covered by appropriate safeguards consistent with the GDPR and CNIL guidance. Where regional residency is a contractual requirement on the customer's side, Photoroom asks that it be raised early with its sales team rather than late in an implementation.