Some AI image tools train their models on the images you upload by default. Others process your images and leave them out of any shared model. This is the core of AI data privacy for enterprises, and that difference decides whether your product catalog becomes training data for a model that your competitors also draw on. Before you buy, confirm the vendor's default training setting, get retention and deletion terms in writing, and check for SOC 2 Type 2 and GDPR support.
AI image tools now sit in the production path for millions of product listings, yet few buyers ask what happens to those images once the tool is done. In this guide, we'll review what training on your data means, what to check before buying an AI image tool, and how Photoroom handles your data.
Table of contents
What enterprises should check before buying an AI image tool
Is your product catalog data private when you use an AI image API?
Do AI image tools train on your uploaded data?
Yes, many AI image generators use uploaded and public images to train their models. But training on uploads isn't a fixed rule across the board. It varies by provider and tool. Even within the same tool, it can come down to which plan or tier you're on.
Because tools differ this much, it's risky to assume anything without checking. If preventing an AI from training on your images is important to you, always verify a specific tool's default setting and confirm whether you can opt out before committing to it or uploading data. The first thing to look for is transparency. Training on your images isn't necessarily bad, so what matters is whether a vendor is upfront that it's happening. When one hides it, that raises a fair question: does it treat you as a beneficiary, or as part of the product?
What "training on your data" actually means
General-purpose AI image tools build their training set from two sources: public images, and the files people upload while using the product.
So the images you upload can do double duty: used once for your task, and again as training material the model draws on to shape outputs for other users.
Vendors usually disclose whether they train on your images somewhere in their terms of service or privacy policy. Training on data is common enough across AI image tools that it's smart to treat it as the default when it comes to AI data privacy.
For a consumer sharing a photo, the stakes are low. But for a business uploading its catalog, those visuals could end up training a model that competitors also rely on. This is the crux of the issue for many businesses.
Why do AI vendors want to train on your images?
Because it makes the models better. That is not a bad thing on its own, but it is worth understanding, so you can decide when you want it and when you don't.
A general-purpose AI image model is only as good as the data behind it. The models most tools run on were trained on huge public datasets. Stable Diffusion's image generator, for example, learned from a set of more than 2 billion images scraped from the open web. Scale like that sets a model's general ability, but public data has a ceiling: it's messy, inconsistently labeled, and full of the wrong kind of pictures for selling products.
Your product catalog is the opposite. Every image is clean, lit, labeled, and tied to a real product, a real category, and a real buyer. That is exactly the high-value, domain-specific data a model learns most from. So when a tool trains on your uploads, it isn't a trick. It's using good data to get better.
The question for a business isn't whether training happens. It's who the improvement is for, and there are two cases:
A shared model. Your catalog improves one model that every customer draws on, including your competitors. The gains from your data spread to everyone, and you can't pull them back.
A model that's yours. Your catalog trains a model built for your products, your formats, and your brand rules. The same mechanism now works for you alone.
So the answer isn't "never train on my data." It's "know who the training is for." When the improvement flows back to you, training is an advantage. When it flows to everyone else, it's a cost you handed over for free.
Should you care if a tool trains on your images?
It depends on two things: what's in the images, and whose model they train. For a consumer editing one photo, the honest answer is usually "not much." For a business putting its catalog through a tool at scale, it's "enough to make it a procurement question."
Care more when:
The images show unreleased products, new packaging, or pricing that isn't public yet.
Bulk uploads reveal how big your catalog is or how it's structured.
Your data trains a shared model your competitors also use.
Visual style is part of how you compete, and you don't want it learned into a common model.
Care less when:
The images are already public, live on your storefront, your ads, or your marketplace listings.
Nothing in them is time-sensitive or strategic.
Training is opt-in to a model only you use, or you can switch it off.
You're a small seller and the downside is low.
The point isn't that training is dangerous. It's that only you know which side of that line your images sit on, so the choice should be yours to make. A good tool lets you opt out of a shared model in one setting, and opt in when training works for you.
It also helps to keep the scale in perspective. Any single catalog is a small part of a training set that runs to billions of images, so ordinary product shots won't visibly shift a shared model, and images already public on your store or a marketplace may be in public datasets already. What doesn't get diluted by scale is a specific sensitive image, like an unreleased product or an unannounced price, or a distinctive style a model can pick up and echo. So scale is a reason not to worry about your everyday uploads, not a reason to stop caring about the few images that actually matter.
What an uploaded product image can expose
It's easy to assume a product photo is just a product photo. But a single shot often carries more than the product, and when a tool keeps your uploads, those details sit with a third party:
Pricing: Price tags, discount stickers, or shelf labels caught in a shot can show pricing strategy, upcoming markdowns, or tiered pricing before they're public.
SKUs and barcodes: Barcodes and internal SKU codes carry your internal naming and tracking systems, readable by anyone who can access the stored image.
Catalog scope: Bulk uploads show a vendor how many products you carry and how your catalog is organized, including lines that haven't launched yet.
Unreleased products: Pre-launch photos uploaded for editing or background removal put an unannounced product, packaging design, or seasonal drop in a vendor's hands before you've revealed it.
None of this requires a data breach, or bad intent from a vendor. The moment a tool retains your uploads, these details live in someone else's systems, reachable by staff, a labeling step, or an incident. Training adds one more path, but a narrow one: a shared model can pick up a distinctive design or style and echo it in outputs for another customer, though it won't reproduce your exact prices or SKUs.
Either way, the point is control. The real risk isn't that training happens, it's that your images are held and used without your say, with no audit trail to trace where they went.
Encrypted product images
Tools that train on your uploads vs. tools that don't
AI image tools fall into two camps based on how they handle your data.
Tools that train by default treat your uploads as training data unless you stop it. And tools that process only use your images to deliver the output you asked for and keep them out of any shared model.
One thing to keep straight: a tool that keeps your uploads out of its shared model is not a tool that doesn't train. Every capable model is trained on a lot of data. The strong ones get there with public, licensed, synthetic, and consented data, giving you the option to opt out, and can still keep your specific catalog out of the shared pool, or train a model that's yours alone. So the real choice isn't between a sophisticated tool and a safe one. It's whether your own images end up in a shared training set.
The two AI data privacy approaches, side by side
An AI image tool's product page doesn't always tell you whether it trains on your uploads or only processes them.
Often, you only find out once you read the terms and conditions, data processing agreement, or retention policy. It's worth confirming up front rather than assuming: if your uploads will train a shared model, you want to know before you commit at scale, since that decision is the hard one to reverse.
What you're buying | Who the improvement goes to | Who it's good for |
|---|---|---|
Training on your uploads into a shared model | Every customer of that model, competitors included | Consumers and small sellers whose images are already public on a storefront or marketplace |
Processing only, no shared-model training (either by default, or via an option in settings) | No one. Your images produce your output and nothing else | An especially cautious business handling pre-launch products, visible pricing, or a look it competes on |
A custom model trained on your catalog | You alone | Teams running catalog-scale production against fixed brand rules |
What enterprises should check before buying an AI image tool
Vetting an AI image tool isn't so different from vetting any data processor. Getting AI data privacy right here means confirming what happens to your content after the model has already delivered your output. Before you invest in an AI image tool, follow this checklist.
The 6-point pre-purchase due-diligence checklist
SOC 2 Type 2. Ask for a current SOC 2 Type 2 attestation, which reports on how data security controls operated over a period of time rather than at a single moment. SOC 2 Type 2 is among the top recognized enterprise security standards, so a vendor without it or a sufficient alternative (such as ISO 27001) has a gap.
GDPR compliance. Check that the vendor can satisfy GDPR requirements. That means having data protection by design and by default, a signed data processing agreement, a documented lawful basis for processing, and clearly defined rights for the people whose data is involved. Even if you're based in the US, this applies the moment EU customer or employee data enters the picture.
Documented data retention and deletion. Get the retention windows in writing for images, jobs, and logs, plus a deletion process you can verify. If a vendor can't give you an end date for your catalog data, treat that as a red flag.
A training opt-out, or no training on your data. Confirm whether your uploads train a shared model, and whether you can turn that off. If you represent an enterprise, it's best to have a contract that excludes your data from model training entirely.
A published sub-processor list. A vendor that names its sub-processors shows you the full chain of who touches your data. Without that list, you can't assess downstream risk.
No vendor lock-in. Check that you can move your workflow and data without rebuilding from scratch. A model-agnostic API and clean data export keep the switching cost low.
Is your product catalog data private when you use an AI image API?
Your product catalog data stays private on an AI image API if the vendor:
Isolates your data.
Keeps your data out of shared model training.
Gives you retention and deletion control.
Confirm all three terms in the data processing agreement before you integrate, because an API sends your catalog straight into a vendor's infrastructure.
Where API data goes, and how to keep it isolated
Every API request follows a defined path, and the retention rules along that path are what determine your exposure.
Here's what to expect with the Photoroom Image API, as documented on the security page:
Images sent to sync endpoints are processed instantly and discarded as soon as the response is delivered. Async API images are retained briefly while the job runs, then discarded.
Operational logs are deleted after 15 days.
API access logs are retained for a year for security investigations and audit requests.
Training and production data are stored separately.
If you participate in model improvement, your personal data is anonymized before any model training.
Isolation is what keeps catalog data under your control. A model-agnostic API applies your rules at the endpoint, so your data feeds the output you requested and stays out of a shared training set. That design also means swapping in a new underlying model later doesn't hand your catalog to a different training pipeline, since the rules travel with the endpoint rather than the model.
How Photoroom handles your data
Photoroom is the full visual commerce solution for e‑commerce, and the biggest brands in the world run their product visuals through it. Protecting their data, and yours, is the highest bar we hold ourselves to. What that means in practice depends on whether you're on a self-serve plan or an Enterprise contract.
Photoroom settings showing how to opt out of training the AI on your images
Self-serve default vs. Enterprise
By default, Photoroom uses images you upload on self-serve plans to help improve its services, including training the AI. You can opt out in account settings by disabling the "Improve the model for everyone" setting.
Enterprise contracts default to no model training, and Photoroom trains on your data only if you explicitly agree in writing. Photoroom can create AI models trained on your product types, channel formats, and brand standards.
On all plans, training and production data are stored separately, and access to training data is restricted to the ML team and logged, as detailed on the Photoroom security page.
SOC 2 Type 2, GDPR, and the responsible AI
Photoroom holds a SOC 2 Type 2 attestation scoped to its API, with the most recent report published in April 2026, available in the Trust Center. The API scope matters for a buyer because it means the audited controls cover the surface you integrate against at volume.
For GDPR, Photoroom maintains a documented sub-processor list, a defined breach notification process, and a data processing agreement available for Enterprise. It also anonymizes personal data before training.
Each of these answers a specific question your legal team will ask: the sub-processor list shows who touches your data, the breach process sets your notification timeline, the DPA sets the contractual terms, and anonymization limits what personal data can reach a model. That breach process is a documented incident response: immediate containment, GDPR breach notification, and post-incident analysis, so you know how Photoroom acts if something goes wrong.
At Photoroom, we believe in responsible AI, which means we:
Use data responsibly.
Primarily use publicly available information to train models.
Rely on carefully selected proprietary data from partners, computer-generated synthetic data, and user-generated content when users have provided consent.
Comply with the robots.txt mechanism when collecting data from the public web.
Don't train on customer content unless permission is given.
Don't store content from API users.
Avoid harmful content in training and outputs.
No vendor lock-in
Photoroom's REST API is model agnostic and can adopt new models as they evolve. It will automatically apply your Brand Kit rules at the endpoint, so the same workflow keeps running, even as the underlying model changes.
The cost of vendor lock-in can be high for enterprise buyers, but this design avoids it by keeping the negotiating power on your side. When a tool ties your workflow to one model and one data pipeline, switching later means rebuilding integrations and renegotiating data terms under pressure. Because Photoroom's rules travel with the endpoint, you adopt better models without handing your data to a new training set each time.
The takeaway for your next vendor review
Whether an AI image tool trains on your data is a procurement question, and any vendor worth buying from should have a documented answer. For an enterprise, the right posture keeps your catalog out of a shared model while you still get output tuned to your products and brand rules.
Photoroom gives you that on Enterprise contracts: no model training by default, custom models built on your catalog, an API scoped SOC 2 Type 2 attestation, and a model-agnostic API that keeps your data yours. Bring the checklist above to your security and legal teams, then take the conversation further.
Contact sales to see how Photoroom fits your data terms, or try the Image API for free today!
Keep reading
Photoroom for Enterprise: how custom AI models and dedicated terms work for teams running visual production at catalog scale.
Security at Photoroom: the SOC 2 Type 2 attestation, data retention windows, and infrastructure controls in detail.
Try the Image API for free: automate image production at scale with a model-agnostic REST API.
