The dullest document is the most informative

When deciding whether to upload fifteen photographs of your face somewhere, most people read the privacy policy. That is the second-best move.

Start with the list

The subprocessor list names the third-party companies that actually process your images. Shorter than the privacy policy, more concrete, and far harder to write vaguely — it is company names and countries rather than prose.

What it does and does not tell you

That such a list exists is normal. Nobody at this scale runs their own datacentres, so its existence is not a warning sign.

What informs you is how many names are on it and which jurisdictions they sit in.

Why this is a portrait question at all

Because generating a headshot means sending those fifteen images somewhere. The crop and the lighting are fixable later; what gets retained is not.

Then two words in the privacy policy

A retention period with a number in it. And the word training — not whether data is shared, which is a different question with a more comforting answer.

When it stops being your decision

The moment an employer uploads photographs of staff. Those are third parties' personal data, and consent sits with the employer.