AI and privacy: what happens to the photo you upload?

Short answer: a photo you upload to an AI tool is generally sent to a remote system, processed there by a model, and the result is returned to you. Whether the photo is stored afterwards, for how long, whether it is used to improve models and who it is shared with depends on the tool's privacy policy. This article is brand-neutral and does not describe any particular tool. We explain what to read and the basics of the rights GDPR and KVKK give you. It is not legal advice.

What generally happens to a photo you upload?

In most AI tools the flow goes like this (the tool's own policy can change it):

1. Upload: the photo is sent over a connection to the tool's system or to a model provider the tool uses.
2. Processing: a model reads the photo and makes the change you asked for.
3. Result: the output is shown to you and often kept in your history.
4. Logging and review: the system may log requests; records may be reviewed for abuse control.
5. Later use: depending on the policy, the photo or results may be used to improve the service, or deleted after some time.

So it matters whether the tool is a single company or sends photos to third-party model providers. In policies these providers are called "sub-processors" or "service providers".

Is a photo personal data?

A recognizable photo of a person is generally personal data. The GDPR defines personal data as any information relating to an identified or identifiable natural person. A photo also carries other information: photos taken with a phone usually include embedded details (EXIF) such as the time of capture, the device model and sometimes location. Signs in the background, the view of a home or other people's faces also reveal information.

What should you look for in a privacy policy?

Question	Where in the policy?	Good sign
Who processes my photo?	Controller and sub-processors section	Company identity and contact are clear, providers are listed
What is it used for?	Purposes of processing	Purpose is clear; "providing the service" and "improving" are written separately
Is it used for model training?	Wording such as "improving the service" or "training"	Stated explicitly with an option to turn it off
How long is it kept?	Retention section	A period or the criteria that set it is stated
Who is it shared with?	Recipients and transfers	Recipient categories and transfers abroad are stated
How do I delete it?	Rights and account settings	Steps to delete account and history exist
Children?	Age limit	An age limit and parental information exist

If none of these is clear, or you cannot find a policy, do not upload sensitive photos to that tool.

What are your rights under the GDPR?

In the EU, organizations that process data must inform you: identity, purposes, recipients, retention period and what your rights are (GDPR Article 13). The EDPB's guidance page lists these individual rights:

• Access: find out whether data is processed and receive a copy free of charge.
• Rectification: correction of inaccurate data and completion of incomplete data.
• Erasure: in some cases, such as when the data is no longer necessary for the purpose it was collected for, you can ask for deletion.
• Restriction of processing: the organization may keep the data but must stop other processing.
• Portability: receive your data in a structured, commonly used, machine-readable format; only under certain conditions.
• Objection: object, on grounds relating to your particular situation, to processing based on legitimate interests or public interest; objection to marketing must stop it without reasons.

The organization must answer your request within one month; for complex requests the period can be extended by two further months but you must be told within the first month. If it refuses, it must explain why and tell you that you can complain to the data protection authority.

What are your rights under KVKK?

Under Turkey's Law No. 6698 (KVKK), when collecting your data the controller must inform you of its identity, the purpose of processing, to whom and for what purpose data may be transferred, the method and legal basis of collection and your rights under Article 11 (Article 10). By applying to the controller under Article 11 you can:

• Learn whether personal data is processed and request information.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties to whom data is transferred in Turkey or abroad.
• Request correction if incomplete or inaccurate.
• Request deletion or destruction within the conditions, and request that these be notified to third parties the data was transferred to.
• Object to a result against you arising from analysis exclusively by automated systems.
• Claim compensation for harm if data is processed unlawfully.

Under Article 13 the controller concludes the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request; it either accepts it or refuses with reasons. If your application is refused, the reply is found insufficient, or no reply is given in time, you can complain to the Personal Data Protection Board (Article 14).

AI models and the personal data debate

Whether personal data remains inside a model after it is trained is a topic regulators are addressing. The EDPB adopted Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models on 18 December 2024; it was prepared at the request of the Irish supervisory authority and covers topics such as legal basis and anonymisation. The UK ICO also gives separate chapters to lawfulness and transparency in its guidance on AI and data protection. The practical upshot: if a company uses your photo for training, it is expected to say so clearly; if it does not, do not hesitate to ask.

Practical steps to protect your photo

1. Do not upload what is not needed: avoid sensitive photos such as IDs, documents, children's photos and other people's private photos.
2. Clean location data: your phone has an option to turn off location when sharing.
3. Crop: take signs and documents in the background out of the frame.
4. Others' permission: if someone else is in the photo, ask first.
5. Check settings: look for options to turn off training use and to delete history.
6. Clear history: when you finish, delete results and uploads.
7. Use your rights: send an access and deletion request; track the response time.

Example request: "Hello, I would like to learn whether personal data linked to my account is processed, to be told the purposes of processing and the recipients the data is transferred to, and to request deletion of the photos I uploaded."

Transfers abroad and sub-processors

Many AI tools may send a photo to servers in different countries or to model providers. KVKK has a separate article (Article 9) on transferring personal data abroad and places obligations on the controller; Article 11 also gives you the right to know the third parties to whom data is transferred in Turkey or abroad. In the EU, the GDPR likewise has separate rules for transfers. So look for the "recipients", "transfers" and "sub-processors" sections in the policy.

If these sections are unclear, the question to ask is simple: which companies does my photo go to, and for what purpose? If a tool's answer is not clear on this, think twice before uploading sensitive photos to it. The answer may arrive in a short email; keep the written reply.

Common mistakes

• Uploading without reading the policy: Retention and training use are written there.
• Assuming a "free" tool costs nothing: Data can be a revenue source for some services; read the policy.
• Uploading someone else's photo without permission: This raises both consent and personal data problems.
• Forgetting location data: Embedded information can stay in a shared file.
• Assuming deletion removes it everywhere: Check the policy for backup and provider record periods.

Which photos should you never upload?

Some photos are too sensitive to risk a mistake: documents such as IDs and driving licences, bank cards, images showing an address or licence plate, children's photos, images containing health information and other people's private memories. If you must process such an image, cover or crop the sensitive parts first. Instead of uploading your most personal photo to a tool you are trying for fun, start with an ordinary test photo and see how the tool behaves.

Summary

• A photo is generally processed on a remote system; retention, training use and sharing depend on the policy.
• A recognizable photo can be personal data; it also carries information such as embedded location.
• In the policy, look at the controller, purpose, training, retention period, sharing and deletion steps.
• GDPR and KVKK give you rights to information, access, correction, deletion and objection; the response time is one month under GDPR and at most thirty days under KVKK.
• Do not upload sensitive photos, clean location data and get others' permission.