The questions a procurement review actually asks

None of them is about photographs. By the time a company is choosing, the headshots have been judged good enough and the decision has moved elsewhere.

How long are source photographs kept, as a number

Not a paragraph about caring. A figure. A vendor that keeps them indefinitely rarely says so; it says so by omitting the number.

Who processes them, and where

No vendor this size runs its own datacentres, so a subprocessor list existing is normal. What informs you is how many names are on it and which jurisdictions they sit in.

Can an employee decline without it being awkward

The question that stalls rollouts, and the only workable answer comes from the employer rather than the vendor.

Are the images used for training

Not "are they shared", which is a different question with a more comforting answer.

What is not being asked any more

Whether the headshots look good. Every product in this category clears that bar for an easy face, and a portrait gallery answers a question procurement stopped asking.

The tell

Good answers take a vendor about a minute. Bad ones take considerably longer, and the delay is itself the information.