Employee headshots are biometric-adjacent data, and that makes them different from the rest of your vendor risk: people cannot rotate their face when you get breached.
That is the whole argument for doing this properly, and it takes about an hour.
What to ask for, in order
1. What exactly is retained, and for how long?
There are usually three artefacts, and vendors often answer about one of them. The uploaded source images. Any derived representation, embeddings or a fine-tuned adapter. And the outputs. Ask about all three separately, because "we delete your photos after 30 days" says nothing about the model weights trained on them.
2. Is the derived representation deletable?
This is the question that separates serious answers from marketing. Deleting a row is easy. Removing a person's influence from a set of trained weights is genuinely hard, and the honest answer from most vendors is that they delete the adapter rather than unlearning anything. That is fine, and you want it stated.
3. Who else touches it?
The subprocessor list is the real vendor list. Compute providers, storage, any model API in the chain. If the page does not exist, that is your answer.
4. Is it used for training?
Ask specifically whether your images train anything that serves other customers, and whether the default is opt-in or opt-out. Then check whether the answer in the sales call matches the answer in the terms.
5. What happens to the portrait when someone leaves?
Employees who consented while employed sometimes want removal afterwards. Find out whether there is a path, and whether it reaches backups.
6. What is the refund and retry position?
Less dramatic, more likely to come up. Photos come back that people dislike, sometimes reasonably, and a headshot someone hates is a headshot they will not use.
Where to actually look
Sales decks are not evidence. The documents are.
Ours are public and this is what each is for: the privacy policy covers retention and what is kept; the subprocessor list names who else is in the chain, which is the page most people skip and the one that tells you most; the terms and their annex carry the data-processing specifics; and the refund policy covers the boring case that actually happens.
Read the equivalents from any vendor you are considering, ours included, and compare them rather than the landing pages. The landing pages all say the same things.
The consent layer that never gets scoped
Separate from the vendor question: your own employees need to have agreed, and "agreed" needs a scope. Internal directory and public marketing site are different permissions, and a single boolean will get one of them wrong. Someone finding their face on a campaign they never approved is a bad day that a schema change would have prevented.
Build the withdrawal path at the same time as the collection path. It is 20 minutes at the start and a legal conversation later.
The short version
Ask what is kept, what is derived, who else sees it, and how it gets removed. Get it in writing. Then check the subprocessor page, because that is where the answer stops being a claim and starts being a list.
More from this series
- How to read a vendor case study when you are the engineer who has to make it work
- Test any generation tool on the hardest face you can find, not the easiest
- Crop ratios and framing conventions across 5 professional photo genres, as a reference table
- Quatre métiers où la photo obéit à des règles, et où les règles se contredisent
On BetterPic
Top comments (0)