Picsart Enterprise

GDPR overview

Concrete and documented. The Trust Center claims EU GDPR and CCPA/CPRA compliance alongside SOC 2 Type 2 (annual SSAE 18 audit) and ISO/IEC 27001:2022, with a SOC 3 report available publicly and the SOC 2 report and ISO certificate on request. A public DPA is incorporated by reference into the Enterprise Terms. Transfers outside the EEA and the UK rely on the European Commission's 2021/914 standard contractual clauses, a UK IDTA addendum and a Swiss regime. The sub-processor list is published, with 30 days' notice before any addition. EU and UK rights are set out in full, namely access, rectification, erasure, restriction and portability, with a one-month response time and the right to complain to a local authority; requests go through a privacy portal, privacy@picsart.com or DPO@picsart.com. The controller is PicsArt, Inc., a Delaware company. No Article 27 EU representative is named.

Who owns the data?

Under the Enterprise Terms, you or your end users keep ownership of the Content you send, excluding any Licensed Content embedded in it, and the Generative AI Additional Terms confirm that you own your Input and the corresponding Output, to the extent allowable by law. Ownership is not exclusivity, however. In exchange you grant Picsart a worldwide, perpetual, non-exclusive, irrevocable, royalty-free, fully sublicensable and fully assignable license to reproduce, modify, distribute, publicly display, translate and create derivative works from any and all Content. Picsart keeps every right in the Services, the software and its Licensed Content, and gives no warranty that generated Output is protectable by copyright.

Reuse rights

Because you own your Input and the corresponding Output, you can reuse them without asking Picsart: no permission step is required. No warranty comes with that freedom either, since nothing guarantees the Output is protectable by copyright or free of infringement, and the application exposing the Services must credit Picsart. On the vendor side, the license covers providing, maintaining and improving the Services, and the Generative AI terms extend it to improving the third-party AI providers used behind the platform. That matters operationally: your Input travels to providers listed as sub-processors, among them OpenAI, Google Gemini, Anthropic PBC, Black Forest Labs, Eleven Labs, Ideogram, Tencent and fal. Picsart may also monitor use and apply machine learning and artificial intelligence to the resulting Usage Data. Two things the documents never say: whether customer content trains Picsart's own models, and how to opt out, since no opt-out mechanism is documented anywhere. One default deserves a check before launch: under the Generative AI terms, Input and Output on the AI Image Generator may be publicly visible and remixable.

Data retention & training

Hosting summary

Hosting depends on the region a customer is attached to. US-hosted customers run on Amazon Web Services in us-east-1 (Virginia, United States), with some services on Google Cloud in East US. Europe-hosted customers run on AWS in eu-central-1 (Frankfurt area, Germany), with some S3 storage containers in eu-west-1 (Ireland). Delivered content may additionally be cached by third-party CDNs. Declared infrastructure sub-processors include Cloudflare, AWS, Google Cloud and Google Kubernetes Engine, Deft/ServerCentral, Datadog and Databricks. Customer data is logically isolated per client, encrypted with AES-256 at rest and carried over TLS 1.2 or above in transit, and encrypted backups are held on AWS to the same AES-256 standard. These arrangements come from the product security and privacy architecture datasheet, in force since October 2022. Two limits are worth noting: hosting is cloud-only in the United States or the European Union, with no on-premise option advertised, and PicsArt, Inc. remains a Delaware company, so US-hosted data sits under US jurisdiction while European transfers rely on the standard contractual clauses referenced in the DPA.