Photoroom Pro and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless the account opt-out is used: Photoroom uses uploaded content to improve, train and develop its products. API images are treated differently (privacy policy excludes them; the security page says self-serve API plans train by default).

Vendor's wording: “By using the Services, you acknowledge and expressly authorize Photoroom to use User Content to improve, train and develop Photoroom’s products and services.”

Source: photoroom.com2.2.c License to User ContentChecked on 19 October 2026

You can switch the training off.

In the app, go to account settings and use Data Control to opt out. It is not retroactive.

Vendor's wording: “You can opt-out of this at any time by changing the settings on your account in the app under Data Control.”

Source: photoroom.com2.2.c License to User ContentChecked on 19 October 2026

United States: Photoroom says its infrastructure runs in the US (hosted on Google Cloud and AWS).

Vendor's wording: “Our infrastructure runs in the United States.”

Source: photoroom.com04 Hosting regionChecked on 19 October 2026

No EU hosting.

No: Photoroom states EU-only data residency is not available today.

Vendor's wording: “EU-only data residency isn't available today.”

Source: photoroom.com04 Hosting regionChecked on 19 October 2026

No DPA.

Not described for Pro. The security page says a DPA is available for Enterprise customers through the account team.

Vendor's wording: “A Data Processing Agreement is available for Enterprise customers through your account team.”

Source: photoroom.comFAQ: Is Photoroom GDPR-compliant? And is a DPA available?Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Photoroom SAS, Paris, France)

Vendor's wording: “Photoroom, a French joint stock company having its head office located 229 rue Saint-Honoré”

Source: photoroom.comIntroduction (publisher)Checked on 19 October 2026

Account data is kept until you delete the account or up to 2 years after your last login, then archived for 5 years. How long uploaded images are kept in the app is not stated.

Vendor's wording: “Until the account is deleted by you or up to a period of 2 years from your last connection to your account”

Source: photoroom.com3. Purposes, retention table (account management)Checked on 19 October 2026

1: SOC 2 Type 2, but scoped to the API service only (report April 2026); nothing stated for the app plan. The Trust Center needs a browser.

Vendor's wording: “Photoroom holds a SOC 2 Type 2 attestation scoped to our API service.”

Source: photoroom.comFAQ: Is Photoroom SOC 2 certified?Checked on 19 October 2026