Photoroom procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Personal data may be transferred outside the European Economic Area, in particular because of the use of services providers located outside the EEA. In this case, these transfers are carried out with appropriate guarantees to ensure a sufficient level of protection of privacy and fundamental rights, in accordance with the provisions of the GDPR and the guidelines of the French Data Protection Authority (CNIL).” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “Management of your account (creation, logging and unsubscription) Email address via GoogleAuth, FacebookAuth or AppleAuth (optional) Full name User ID Contractual performance of the Terms between you and Photoroom Duration of use of the services (=Until the account is deleted by you or up to a period of 2 years from your last connection to your account), and then archived for 5 years” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Contractual performance of the Terms between you and Photoroom Duration of use of the services (=Until the account is deleted by you or up to a period of 2 years from your last connection to your account), and then archived for 5 years Management of your account (creation, logging and unsubscription) Optional profile data (profile photo) Consent Duration of use of the services ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Transaction data transmitted by the Store or by the Payment Services Provider (purchase history, transaction amount, user's first and last name) Contractual performance of the Terms between you and Photoroom Length of time required to complete the transaction plus legal retention period for accounting purposes (10 years) ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “(Please note that credit card or other payment methods data are not processed and kept by Photoroom but only by the Payment Services Provider) Contractual performance of the Terms between you and Photoroom Duration of use of the services and then archived for 5 years Proper operation of the Application and its Services - Enabling Users use the Services Data relating to your activity on Photoroom, Communications with Photoroom, Data relating to devices and equipment used Legitimate interest in providing a functional Application/ improving our Application Duration of use of the services, or 30 days after a request for deletion Proper operation of the Application and its Services - Enabling Users use the Services Data sent by your phone's camera and photos stored on your phone Contractual performance of the Terms between you and Photoroom, Access to the photos is only made with your permission. Duration of use of services or until withdrawal of your permission Administrative management of user complaints and reports and requests Communications with the Users, including chat Legitimate interest in responding to user requests and ensuring the security of the Application Delay to respond to the request + statutory limitation period (5 years) Moderation of content in compliance with applicable law (prevention of illegal activities) Data relating to your activity on Photoroom, content data Complying with our legal obligations 1 year from collection for metadata 5 years (legal statute of limitations) for data stored for dispute prevention purposes ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may disclose your Personal Data to service providers and third parties as described in Section 3 of this Privacy Policy. This includes disclosure of your Personal Data to service providers for a business purpose. “Business purposes” means the reasonably necessary and proportionate use of personal information for our operational purposes, other purposes described in this Privacy Policy, for the operational purposes of our service providers and contractors, as well as other purposes compatible with the context in which the Personal Data was collected. When we disclose Personal Data for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Data confidential and not to use it for any purpose except performing the contract. Photoroom does not “sell” or “share” Personal Data as those terms are defined by the CCPA. Please review our disclosures in our Cookies Policy for more information on our use of cookies. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 4.3 Cookies providers Your personal data are transmitted to third parties depositing cookies on the Services, according to the choices made via the cookies banner and subject to your consent, under the conditions provided in the Cookies Policy . 4.4 Communication for legal reasons Personal data may be disclosed to a third party if Photoroom is required to do so by law, regulation or court order, or if such disclosure is necessary for the purposes of an investigation, injunction or legal process, whether domestically or abroad.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 4.1. Photoroom employees Only authorized Photoroom employees may have access to your personal data to ensure the proper functioning of the Application, to provide you with the Services and to respond to your requests. 4.2 Sub processors Your Personal data may be transmitted to third-party processors involved in the provision of the Services (technical and hosting service providers, sending of notifications or newsletters, user tracking, management of security incidents, etc.). In particular, we transmit your browsing and interaction data on the Photoroom Application to Apple and RevenueCat in order to check that you are eligible to benefit from the refunds you request. Your Personal data may be transmitted to third-party processors involved in the provision of marketing content and referral programs. In particular, we use Dub as a service provider to operate and manage referral programs. When users consent to participate in the referral program, their email address is transmitted to Dub in order to enable their participation in the referral program.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ iii. Disclosure of Personal Data ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Through our service providers , which are third party companies who help us provide our Services to you consistent with the purposes detailed in this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may disclose your Personal Data to service providers and third parties as described in Section 3 of this Privacy Policy. This includes disclosure of your Personal Data to service providers for a business purpose. “Business purposes” means the reasonably necessary and proportionate use of personal information for our operational purposes, other purposes described in this Privacy Policy, for the operational purposes of our service providers and contractors, as well as other purposes compatible with the context in which the Personal Data was collected. When we disclose Personal Data for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Data confidential and not to use it for any purpose except performing the contract.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We use certain third-party payment processors, currently RevenueCat ( revenuecat.com/terms/ ) for our in-app payments and Stripe ( https://stripe.com/en-gb-fr/legal/ssa ) for other payments (each a “ Payment Processor ”), to process payments you make in connection with the Services. Please see Payment Processor’s privacy statement available on its website for information on how Payment Processor collects and uses personal information. Payment must be received by Payment Processor and must use one of the payment methods accepted by the Payment Processor. We do not view or store your full credit card or other payment method information. For all payments, Payment Processor will collect your payment method details and charge your chosen payment method. When you are on a trial-basis, i f you do not cancel this trial before the end of the 7-day period, you will be charged the annual subscription price every year, until you terminate your subscription with Photoroom. You represent and warrant that: (i) the account, order, and payment method information you supply to us or Payment Processor, as applicable, is true, correct, and complete; (ii) you are duly authorized to use such payment method; (iii) you will pay any charges that you incur in connection with the Services, including any applicable taxes; (iv) charges incurred by you will be honored by your payment method company; (v) you will pay all charges incurred by you at the posted prices, including all applicable taxes, if any; (vi) you will not allow anyone else to use your subscription; (vii) you will not transfer your subscription or password to anyone else; and (viii) you will report to us any unauthorized or prohibited access or use of your subscription or password. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Direct marketing by third parties. Photoroom does not disclose personal information to third parties for their own direct marketing purposes. However, California residents have the right to request information regarding such practices under California’s “Shine the Light” law. If you are a California resident and would like to inquire further, please email [email protected] .” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “In particular, we transmit your browsing and interaction data on the Photoroom Application to Apple and RevenueCat in order to check that you are eligible to benefit from the refunds you request.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.