remove.bg and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No by default: images are used to improve remove.bg only if the user chooses 'Yes, contribute image' in the feedback dialog. Customers may not use the service to produce AI training data.

Vendor's wording: “Choose if you want us to use this image for quality improvements.”

Source: remove.bgFeedback dialog on the Improvement Program Conditions pageChecked on 19 October 2026

Cloud hosting in the Netherlands (Google), the EU (Microsoft Azure, Hetzner Germany); some processing in the US (MongoDB, Zendesk, Datadog, Cloudflare). Privacy policy: 'Europe and any other country' where it has facilities.

Vendor's wording: “Google Australia Pty Ltd Cloud server hosting The Netherlands”

Source: remove.bgSubprocessors, Third-Party Subprocessors table (data hosting location)Checked on 19 October 2026

DPA in the terms.

Yes, built into the terms: companies that submit personal data are covered by the service's Data Processing Addendum, which they accept by using the service (remove.bg/dpa).

Vendor's wording: “If the Customer is a company and the Customer submits personal data, the Service’s Data Processing Addendum (available at www.remove.bg/dpa, www.unscreen.com/dpa, www.designify.com/dpa) shall apply.”

Source: remove.bg9 Confidentiality and data privacy, 9.1Checked on 19 October 2026

Published.

Yes, public list at remove.bg/subprocessors (updated 8 Jan 2024): 11 rows, 7 third parties (Google, Microsoft Azure, Hetzner, MongoDB, Zendesk, Datadog, Cloudflare) and 4 Canva group companies. No AI model providers named.

Vendor's wording: “Operator engages the following Subprocessors to process certain customer personal data as set out in each Service’s Data Processing Addendum”

Source: remove.bgSubprocessors page, Third-Party Subprocessors and Canva Group Sub-Processor tablesChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Canva Austria GmbH, Vienna, Austria)

Vendor's wording: “We are Canva Austria GmbH ("Operator", “We”, “Us”). This privacy policy applies to visitors and users of the Operator’s products”

Source: remove.bgIntroductionChecked on 19 October 2026

Files are deleted 'shortly after' the result is provided; no fixed period. Account data is kept while there is a business need. On ending the contract the DPA says personal data is destroyed or returned at the customer's choice.

Vendor's wording: “We upload them securely, process them as you would expect, provide you with the results for download, then delete them shortly after.”

Source: remove.bgBefore we get into the details; 6. How long we keep your personal dataChecked on 19 October 2026