ProPhotos

GDPR overview

There is no GDPR implementation to report, because there is no mention of the GDPR at all. A search across the archived pages of the site returns zero occurrences of GDPR, CCPA or data protection officer: ProPhotos neither claims compliance nor denies it. No Article 27 EU representative is designated, no DPO is named, no DPA is offered and no legal basis is stated in the regulation's terms, although the privacy policy does set out a detailed list of processing purposes. The posture is US-style: the terms are governed by Californian law, and transfers outside your jurisdiction are accepted without naming standard contractual clauses or any other mechanism. Two points do work in a European user's favour: the terms acknowledge that EU consumers keep the mandatory provisions of their country of residence, and deletion is available from the account settings or by writing to hello@prophotos.ai.

Who owns the data?

ProPhotos grants you a full commercial licence on every image it generates: the homepage FAQ states plainly that you can use your photos anywhere you want, with no further permission to ask. You also keep control of the source material - the account profile carries a delete option you can use at any time, and generated AI models are erased automatically after 30 days. The publisher keeps two rights worth knowing about: it may share your face data with the third-party service providers involved in generating your models, and its privacy policy reserves the right for generated information to be shared and used in marketing materials.

Reuse rights

On your side, reuse is unrestricted: the full commercial licence covers all your AI-generated photos, so you can publish them on LinkedIn, a CV, a company website or a professional directory without asking permission. On the publisher's side, the privacy policy is broader than the product. ProPhotos collects your email, first and last name, usage data, device data, session and persistent cookies and web beacons, and uses your face data - uploaded photos and AI models - to generate your headshot models. That data may be shared with third-party service providers, with affiliates and business partners, in a merger or sale, or with your consent. Payments run through Stripe, with no card data stored on the publisher's servers. Your details may also be used for commercial messaging - news, special offers, similar services - which you can object to. The policy in force is dated 10 December 2024.

Data retention & training

Hosting summary

ProPhotos publishes no hosting country and no hosting region. The privacy policy says only that information, personal data included, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located - a formulation that names nothing. It then accepts transfers outside your state, province or country, to jurisdictions whose data-protection law may differ, and states that no transfer will take place unless there are adequate controls in place, without naming a mechanism: no standard contractual clauses, no adequacy decision, no certification. Nothing on the site mentions a cloud provider, an encryption standard, SOC 2 or ISO 27001. What can be seen from outside is thin: the domain resolves to 192.124.249.120, in the United States, on AS30148 (Sucuri) - an anycast WAF and CDN node, which tells you where traffic is filtered, not where images are stored. The company is established in California and the terms are governed by Californian law, so US jurisdiction is the reasonable default assumption; it remains an inference, not a published commitment.