Privacy Policy

December 2024

The purpose of this document is to inform you about the way in which your personal data will be processed when you access to its website https://www.photoroom.com/, web-based application https://app.photoroom.com/, and the Photoroom mobile application (Playstore; App store) (all together the “Application”).

Photoroom’s services are AI-powered tools for creating and editing images. They include features such as customizable templates, editing tools, batch processing, and integration with e-commerce platforms (the “Services”). 

Photoroom, a French joint stock company having its head office in the 229 rue Saint-Honoré, 75001, Paris, France and being registered at the trade Register of Bobigny under n° 853 059 384, is the controller when you use the Services (“Photoroom”). 

If you want details about the cookies and similar tracking technologies we use, we invite you to read our Cookies Policy

1. Who is concerned?

Anyone who browses our Application, creates an account, uses our Services, is concerned by the collection and processing of their information. 

Our Services are not intended for and should not be used by children under the age of 13. We do not knowingly collect Personal Data from children under 13. Users under 18 must have permission from their parent or guardian to use our Services

2. What are the purposes of processing your personal data?

In order to provide the Services, Photoroom collects several categories of Personal Data concerning you, for different purposes, legal bases and retention periods, as described in the table below.

Processing purposesCollected dataLegal basisRetention Period
Management of your account (creation, logging and unsubscription)Email address via GoogleAuth, FacebookAuth or AppleAuth Full name User ID Reason for registering on the application Optional profile data (profile photo)Contractual performance of the Terms between you and PhotoroomUntil the account is deleted by you or up to a period of 3 years from your last contact with us
Purchase of subscription or paid features Transaction data transmitted by the Store or by the Payment Services Provider (purchase history, transaction amount, user's first and last name) Contractual performance of the Terms between you and PhotoroomLength of time required to complete the transaction plus legal retention period for accounting purposes
Payment of subscriptionCredit card or other payment methods data (not processed directly by Photoroom but only by the Payment Services Provider)Contractual performance of the Terms between you and PhotoroomFor the duration of your subscription
Proper operation of the Application and its Services - Enabling Users use the ServicesData relating to your activity on Photoroom, Communications with Photoroom, Data relating to devices and equipment usedLegitimate interest in providing a functional Application/ improving our Application2 years from collection date
Data sent by your phone's camera and photos stored on your phoneContractual performance of the Terms between you and Photoroom, Access to the photos is by permissionDuration of use of services
Administrative management of user complaints and reports and requestsCommunications with the Users, including chat. Legitimate interest in responding to user requests and ensuring the security of the ApplicationDelay to respond to the request + statutory limitation period (5 years)
Moderation of content in compliance with applicable law (prevention of illegal activities)Data relating to your activity on Photoroom, content dataComplying our legal obligations1 year from collection for metadata 5 years (legal statute of limitations) for data stored for dispute prevention purposes
Newsletter sendingEmail addressesConsent for individual clients Our legitimate interest for business clientsUntil you withdraw your consent or for a period of 3 years from your last contact with us.
Social network and audience measurement CookiesPersonal data collected (IP address, pages viewed, etc.) by the deposit of these CookiesConsent25 months
Ensure the proper functioning and security of the ServicesNavigation informationLegitimate interest in providing a functional ServicesFor the duration of the navigation
Training our AI modelPhotos/images that users uploaded to PhotoroomLegitimate interest to improve our product Data is only retained for the duration necessary to train the model
Limit the risk of fraud in connection with refunds granted by PhotoroomBrowsing and interaction data on the Photoroom ApplicationLegitimate interest in ensuring that users are eligible for a refundData is kept for a period of 6 months in the active database, after which it is deleted

We indicate to you at the time of their collection the data which are mandatory to be able to profit from our services. The others are optional.

In any event, we undertake to delete your Personal Data from our databases at the end of these various periods, subject to the retention of certain information for a period after the closure of your personal account to meet our legal, accounting and tax obligations.

Additional information about training our AI model :  By using Photoroom, you acknowledge that Photoroom uses the images you upload to improve, train and develop Photoroom’s products, services and models. You can opt-out of this at any time by changing the settings on your account. For clarity, our model improvement does not apply to the images processed through our Application Programming Interface (API). The images used for training and improving the models are selected and annotated without any more information about your identity (no name, no contact details, no ID, no localisation, and so on). 

3. Is your personal data transmitted to others?

3.1. Photoroom employees

Authorized Photoroom employees have access to your data to ensure the proper functioning of the Application, to provide you with the Services and to respond to your requests. 

3.2 Service providers

Your Personal Data is transmitted to third-party processors involved in the provision of the Services (technical and hosting service providers, sending of notifications, user tracking, management of security incidents, etc.).

In particular, we transmit your browsing and interaction data on the Photoroom Application to Apple and RevenueCat in order to check that you are eligible to benefit from the refunds you request.

3.3 Cookies providers

Your personal data are transmitted to third parties depositing cookies or similar tracking technologies on the Services, according to the choices made via the cookies banner and subject to your consent, under the conditions provided in the Cookies Policy

3.4 Communication for legal reasons

Personal Data may be disclosed to a third party if Photoroom is required to do so by law, regulation or court order, or if such disclosure is necessary for the purposes of an investigation, injunction or legal process, whether domestically or abroad.

4. Is your personal data transferred outside the European Union?

Your information is transferred outside the European Economic Area, in particular because of the use of services providers.  

In this case, these transfers are carried out with appropriate guarantees to ensure a sufficient level of protection of privacy and fundamental rights, including the signing of standard contractual clauses adopted by the European Commission. A document listing the data transfers and guarantees implemented by Photoroom will be sent to you if you request it by e-mail to the following address privacy@photoroom.com

5. What are your rights regarding your personal data?

For any exercise of the below-mentioned rights, you can contact us at the following e-mail address: privacy@photoroom.com

You have the following rights: 

  1. Right of access at your personal data, including the right to obtain form the Photoroom some information such as the purposes of the processing, the categories of personal data concerned

  2. Right to rectification: You can ask us at any time to rectify your personal data that are inaccurate or incomplete 

  3. Right to erasure/right to be forgotten: You can request the deletion of your personal data, in particular when it’s no longer needed by Photoroom, when you have withdrawn your consent or when you have objected to the processing. 

  4. Right to restriction of processing: You can request the restriction of the processing of you personal data if (i) you have contested the accuracy of the personal data, (ii) the processing is unlawful, (iii)  Photoroom no longer needs your personal data, but the data are still necessary for your to defend legal claims; or (iv) you have objected to the processing during the verification as to whether the legitimate grounds pursued by Photoroom override yours. 

  5. Right to data portability: when your personal data is automatically processed and the processing is based on your consent or a contract, it’s possible to request the reception and the transmission of your personal data to a third party. 

  6. Right to object: You can object to the processing of your personal data if the processing is based on your legitimate interest, for reasons relating to your particular situation. 

  7. Right to determine what happens to your personal data after your death: or choose a trusted third-party to whom Photoroom can entrust your personal data.

  8. Right to withdraw your consent: at any time without affecting the lawfulness of processing based on consent before your withdrawal. 

Before we can respond to a request to exercise one or more of your rights, we may ask you to confirm some of your account information in order to verify your identity. 

Photoroom undertakes to respond to your requests concerning the Privacy Policy or the exercise of your rights, as soon as possible and within one calendar month of receipt of the request as provided by the GDPR. . 

If your request is complex, or if you made several requests, the response time can be up to three calendar months from the date of receipt. 

If you believe that the processing of your personal data is unlawful, you also have the right to file a complaint with :

  • Photoroom’s main data control authority: the Commission Nationale de l'Informatique et des Libertés, or the "CNIL", or

  • Your local supervisory authority.

6. What happens if the privacy policy is amended?

The Privacy Policy may be amended and updated to reflect changes in Photoroom's data protection practices, or to ensure compliance with regulations when they are amended. 

In this case, we will set up a way to inform you of this change.

7. California privacy notice

We provide this California Privacy Notice to comply with applicable privacy laws in the State of California, including the California Consumer Privacy Act of 2018, and its amendment, the California Privacy Rights Act of 2020 (together, the “CCPA”). Any capitalized term used and not otherwise defined below has the meaning assigned to it in our Privacy Policy.

This California Privacy Notice supplements information included in this Privacy Policy and applies to any California residents about whom we have collected Personal Data from any source, including offline, and through your use of our Services that we provide. 

The CCPA provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of Personal Data, as well as rights to access, delete, correct, limit, and opt-out of the sales of certain Personal Data we collect about them, as well as to opt-out of the sharing of certain Personal Data for purposes of cross-context behavioral advertising (called “sharing” under California law). California residents also have the right not to receive discriminatory treatment by us for the exercise of their privacy rights under the CCPA. If you are a California resident, you may submit a request to exercise these rights by emailing us using the information provided in the Your Privacy Rights section below.

For the purposes of this California Privacy Notice, except where a different definition is noted, “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal Data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified; or information that has been aggregated. For purposes of this section, “Publicly available Information” includes: information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public, either through widely distributed media, or by the consumer; and information that is made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

The Personal Data we may collect or have collected from California Residents within the last twelve months are listed in Section 2 of this Privacy Policy. 

Please note that because of the overlapping nature of certain of the categories of Personal Data identified above, which are required by state law, some of the Personal Data we collect may be reasonably classified under multiple categories.

i. Uses of Personal Data

Photoroom may collect, use, or disclose Personal Data about California residents for purposes in this Privacy Policy.

ii. Sources of Personal Data

We obtain the categories of Personal Data listed above from the following categories of sources:

  • From you, including from when you register for a Photoroom account, surveys that you take, or as automatically collected when using the Services.

  • Through our service providers, which are third party companies who help us provide our Services to you consistent with the purposes detailed in this Privacy Policy.

  • From our business partners and others, including those that may promote and/or offer products and services that may be of interest to you.

We may supplement the Personal Data collected from the categories of sources described above with Personal Data we obtain from other sources. 

iii. Disclosure of Personal Data

We may disclose your Personal Data to service providers and third parties as described in Section 3 of this Privacy Policy. 

This includes disclosure of your Personal Data to service providers for a business purpose. “Business purposes” means the reasonably necessary and proportionate use of personal information for our operational purposes, other purposes described in this Privacy Policy, for the operational purposes of our service providers and contractors, as well as other purposes compatible with the context in which the Personal Data was collected.

When we disclose Personal Data for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Data confidential and not to use it for any purpose except performing the contract. 

Photoroom does not “sell” or “share” Personal Data as those terms are defined by the CCPA. Please review our disclosures in our Cookies Policy for more information on our use of cookies and similar tracking technologies.  

iv. Your Privacy Rights

The CCPA provides California residents with specific privacy rights regarding their Personal Data. This section describes your CCPA rights and explains how to exercise those rights. 

If you are a California resident, you have the right to make the following requests under applicable California law in relation to your Personal Data, subject to certain exceptions: 

  • Right to Know (or Access).  You have the right to, up to twice in a 12-month period, request what Personal Data we collect, use, disclose, and/or sell, and to whom, as applicable. You may request either a report disclosing the general categories of the Personal Data we collect, or a report disclosing the specific pieces of personal information we collect.

  • Right to Delete. You have the right to request, under certain circumstances and subject to exceptions, the deletion of your Personal Data that we collect.

  • Right to Opt-Out of Sale and/or Sharing. You have the right to opt-out of the “sale” or “sharing” of your Personal Data, as those terms are defined under the CCPA. As noted in Section 10(a)(iv) above, however, Photoroom is not currently engaged in such activity. 

  • Right to Limit Use and Disclosure. You have the right to limit the use or disclosure of your sensitive personal information to only the uses that are necessary for us to provide the Services reasonably expected by the average user, including as may be consistent with your consent and expressed preferences, or for certain other authorized purposes. We will not use or disclose your sensitive personal information after you have exercised your right unless you subsequently provide consent for the use of your sensitive personal information.

  • Right to Correct. You have the right to request the correction of any inaccurate Personal Data that we may maintain about you, subject to our ability to reasonably verify the accuracy and/or inaccuracy of the Personal Data that is the subject of your request.

  • Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of the above privacy rights. 

How to submit a request: To submit a request to exercise any of the rights described above, please submit a verifiable consumer request to us in any of the following ways:

  • By mail to the following address: 

Artizans Of Photo Video Background Editor App (Photoroom)
229 rue Saint-Honoré, 75001, Paris, France

Photoroom undertakes to respond to your requests concerning this Privacy Policy or the exercise of your rights as soon as possible and no later than the time limit set forth by applicable legislation.

Any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”) as permitted by the CCPA.  We will not fulfill your request unless you have provided sufficient information that enables us to reasonably verify that you are the consumer about whom we collected the Personal Data. In order to verify you, you must provide us with your first and last name, e-mail address associated with your Photoroom account, in addition to any additional information that we reasonably request for purposes of verification.  

Requests by authorized agents: You may designate an authorized agent, in writing or through a power of attorney, to request to exercise the above rights on your behalf. If you should designate an authorized agent to exercise your rights under the CCPA, we may require that you provide your authorized agent with written permission to exercise your rights and to verify your own identity with us. If your authorized agent does not submit proof that they have been authorized by you to submit verified requests for disclosure and deletion, we reserve the right to deny such a request that we have received and will explain to your authorized agent why we have denied such request. The authorized agent may submit a request to exercise these rights by emailing the letter of authorization or power of attorney to: privacy@photoroom.com.

Responses: We will respond to your request within forty-five (45) days after receipt of a Verifiable Consumer Request for a period covering twelve (12) months and for no more than twice in a twelve-month period. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.

These rights are subject to various exclusions and exceptions under California law and other applicable laws. In addition, if we are unable to verify your identity to a degree of certainty as required by the CCPA through any reasonable method, we will state that we are unable to verify in a written response to you along with a reason as to why there is no reasonable method by which we can verify your identity.

Household data: Accounts on our Application are maintained on an individual-by-individual basis.  As such, we currently do not collect Personal Data at the household level. If we receive a request submitted by all members of a household, we will individually respond to each request. We will not be able to comply with any request by a member of a household under the age of 13, as we do not collect Personal Data from any person under the age of 13. 

Direct marketing by third parties: Photoroom does not disclose personal information to third parties for their own direct marketing purposes. However, California residents have the right to request information regarding such practices under California’s “Shine the Light” law. If you are a California resident and would like to inquire further, please email privacy@photoroom.com.

We will continue to update our business practices as direct regulatory guidance becomes available.