Is any AI headshot generator automatically GDPR compliant just by being based in the EU?

No. Being EU-based helps with data residency and generally means EU law applies directly, but GDPR compliance depends on how data is actually processed — retention periods, legal basis, sub-processor agreements, deletion mechanics — not just where the servers sit. Ask any vendor, EU-based or not, to walk you through their specific practices.

Does SyntheticPic have SOC 2 or ISO 27001 certification?

No — we don't hold either certification today, and we won't claim otherwise. We are an EU company based in Paris, our data storage is hosted on EU infrastructure, and GDPR applies to us directly as a data controller. If a specific audited certification is a hard requirement for your organization, ask any vendor you're evaluating (including us) for their current status directly rather than trusting a marketing page.

What happens to my selfies after I upload them?

At SyntheticPic, your photos train a private model tied only to your account. They are not used to train any shared or general-purpose model, and no other account can generate images using your face. You can delete your model at any time from My Models — deletion is immediate and permanent, and removes the model, your training photos, and the face data derived from them.

Privacy

AI headshots in Europe

Uploading photos of your face to train an AI model is a reasonable thing to be careful about. Here is what actually happens to your photos with SyntheticPic, why EU hosting matters, and a checklist to run past any vendor you're considering — including us.

Get started

What happens to your photos, specifically

When you upload selfies to SyntheticPic, they are used to train one model, tied to your account, and not shared with or used to improve any other model — general-purpose or otherwise. No other account can generate a portrait using your face; the model is identity-locked to the person it was trained on.

Your training photos and trained model stay in place for as long as your account needs them. You can delete any model — immediately and permanently — at any time from My Models; that removes the model, its training photos, and the face data derived from them (generated portraits stay until you delete them). This is a policy, not a certification: we haven't undergone a third-party audit like SOC 2 or ISO 27001, so we're describing our own practices rather than pointing to an external attestation.

Why EU hosting matters

SyntheticPic is a Paris-based company. GDPR applies to us directly as a data controller established in the EU, and your account data, training photos, and face data are stored on servers in the European Union. To be precise about what is not EU-based: the AI training and image-generation compute itself is handled by our specialist AI processing provider in the USA, and generated portraits are delivered from that provider's content delivery network — our Privacy Policy names the provider and exactly what it handles. We'd rather state that plainly than let "EU company" imply something it doesn't.

EU hosting on its own is not a compliance certification — it's an architectural fact that makes certain compliance questions easier to answer clearly. It doesn't substitute for reading a vendor's actual data practices, EU-based or not.

Questions to ask any headshot vendor

This applies whether you're evaluating SyntheticPic or a competitor. Save this list — it works for any AI tool that processes photos of your face.

01Where is my data physically hosted, and does the vendor state a specific region (not just "cloud infrastructure")?
02Are my photos used to train a model that only I can use, or could they be used to fine-tune a shared/general model?
03Can I request permanent deletion of my photos and trained model, and how long does that actually take?
04Does the vendor have a Data Processing Agreement (DPA) available, and have they named their sub-processors?
05What is the legal basis for processing biometric-adjacent data (a face) under GDPR — consent, contract, or something else?
06If the vendor claims a certification (SOC 2, ISO 27001), can they produce a current report or attestation, not just a badge on the pricing page?

A note on compliance claims

Any specific compliance claim — GDPR, SOC 2, ISO 27001, or otherwise — is only as reliable as the documentation behind it. A badge on a marketing page is not a substitute for reading the vendor's actual Data Processing Agreement (DPA) or requesting their current audit report. This is true of SyntheticPic and every competitor you might compare it against. If EU data protection matters to your decision, ask for the paperwork, not just the pitch.

Questions people ask

Is any AI headshot generator automatically GDPR compliant just by being based in the EU?: No. Being EU-based helps with data residency and generally means EU law applies directly, but GDPR compliance depends on how data is actually processed — retention periods, legal basis, sub-processor agreements, deletion mechanics — not just where the servers sit. Ask any vendor, EU-based or not, to walk you through their specific practices.
Does SyntheticPic have SOC 2 or ISO 27001 certification?: No — we don't hold either certification today, and we won't claim otherwise. We are an EU company based in Paris, our data storage is hosted on EU infrastructure, and GDPR applies to us directly as a data controller. If a specific audited certification is a hard requirement for your organization, ask any vendor you're evaluating (including us) for their current status directly rather than trusting a marketing page.
What happens to my selfies after I upload them?: At SyntheticPic, your photos train a private model tied only to your account. They are not used to train any shared or general-purpose model, and no other account can generate images using your face. You can delete your model at any time from My Models — deletion is immediate and permanent, and removes the model, your training photos, and the face data derived from them.

A private model, hosted in the EU

Train your model in under 30 minutes — your photos stay yours.

See pricing How it works