AI image processing in the EU

Where are my photos processed, and why it matters

When you upload a photo to an online editor, it does not stay on your phone or laptop. The file travels across the internet to a server, the server loads it into memory, a model runs on a graphics card (GPU), and the result is written somewhere so you can download it. Every one of those steps happens on physical hardware in a physical building, and that building sits in a country with its own laws.

That is the whole reason the question where are my photos processed is worth asking. The jurisdiction of the server decides which rules protect the file while it is there: who can be compelled to hand it over, which regulator you can complain to, and what the operator is obliged to do if something goes wrong. A photo of your holiday is one thing. A photo that shows a client, a patient, a child, a staff member or the inside of someone's home is personal data, and moving it to a server outside Europe is a decision with legal weight.

For individuals, this is mostly about peace of mind. For businesses and professionals in Europe, it is a compliance question. If you are a photographer retouching a wedding, an estate agent cleaning up property shots, a school preparing a yearbook or an online shop editing pictures of staff modelling products, you are the one responsible for that data under the GDPR. When you send it to an online tool, that tool becomes your processor, and you are expected to know where it puts the file and for how long.

The trouble is that most AI tools do not say. A sign-up page may mention "secure cloud servers" without naming a country. A general-purpose AI assistant may keep your image in a chat history indefinitely. Before you upload anything that is not yours alone, it pays to know the answer.

How Airpic is set up: image processing in the EU

Airpic splits the work into two layers, and only one of them ever handles your pixels in a meaningful way.

• The website and the API run on a global edge network. That is what serves the pages quickly wherever you are, checks that a request is valid and hands out short-lived upload and download links. It routes your file; it does not run the models on it.
• Image and video processing runs on GPUs rented by the second in data centres in Czechia, Romania and Norway. Czechia and Romania are EU member states. Norway is not in the EU, but it is part of the European Economic Area, where the GDPR applies in full. A worker starts when there is a job, processes it and shuts down again when the queue is empty.
• Nothing is stored permanently. The original is removed once the job is done. The result is kept only so you can download it: it is deleted one hour after you download it, or after one day at most if you never do.

So when you upscale an image, remove the background from a photo or restore an old photo, the model that touches the image runs on a European GPU. The same applies to the video tools that transcribe speech, turn a recording into a document or cut shorts: the audio is transcribed in the same European data centres. Compressing images runs on a CPU worker there too and takes a few seconds.

There is one honest exception worth stating plainly. The two generative video tools, animate a photo with AI and text to video, rely on external video models whose servers are outside the EU. Their pages say so in the FAQ before you upload anything. If your file must stay in Europe, use the other tools and leave those two aside.

This design is the reason the claim "GPU in the EU" on why Airpic is something you can check rather than a slogan. Renting compute by the second also means there is no permanent archive of customer files sitting on a disk waiting to be looked after.

GDPR and AI tools: what a processor must do

Under the GDPR, the person or company that decides why a photo is being edited is the controller. The online tool that does the editing on their behalf is a processor. The regulation asks a processor to follow a handful of principles, and they translate quite directly into how a service is built. This is how Airpic lines up against the main ones.

Data minimisation. A processor should collect only what the task needs. Editing a photo needs the photo and the settings you chose. It does not need your name, your email address, your date of birth or a password. Airpic has no accounts: you do not register, and paid credits are bearer codes kept in your own browser. There is no profile to build, leak or forget to delete.

Storage limitation. Personal data should not be kept longer than necessary. For a photo editor, "necessary" ends when you have your file. Airpic deletes the original when processing finishes and the result one hour after you download it, with a hard limit of one day. There is no gallery of your past uploads and no backup copy of your images.

Purpose limitation. Data collected for one purpose should not be quietly reused for another. The most common reuse in AI is training: your uploaded faces and rooms become material for the next version of a model. Airpic does not train models on your images and does not pass them to third parties for that purpose.

Location and transfers. The GDPR does not ban processing outside Europe, but it makes it conditional: the destination needs an adequacy decision or additional safeguards, and you as controller are expected to have assessed the risk. Keeping the processing inside the EU and EEA removes that layer of paperwork for the tools that run there.

Security. Files move over encrypted connections, the links to fetch them are signed and expire, and the GPU workers have no reason to keep anything once a job ends.

None of this replaces your own obligations as a controller. If you edit client photos professionally, you still need a lawful basis, a privacy notice for your clients and a record of the processors you use. What a well-designed tool does is make the processor part of that record short and easy to justify.

Five questions to ask any AI service with servers in Europe (or not)

Whether you use Airpic or anything else, these are the questions to answer before you upload a photo that belongs to a client. If the service cannot answer them in writing, treat that as the answer.

1. Where is the file processed? Not where the company is registered, and not where the website is served from, but where the model actually runs. Look for named countries or regions. "The cloud" is not a location. Watch for tools that process in Europe by default but send some features, often the generative ones, somewhere else.
2. How long is it kept? Ask separately about the original, the result, previews and thumbnails, and backups. A clear answer has numbers in it, such as one hour or one day. "As long as necessary" or "until you delete your account" means the file may sit there for years.
3. Is it used for training? Read the terms, not the marketing page. Some services train on uploads unless you opt out, some only on free plans, some ask for a licence to your content. You want a plain statement that your images are not used to train or improve models.
4. Who can see it? Can staff open uploaded files for support or moderation? Is the file passed to a subcontractor, for example an external model provider? Does it appear in a shared workspace or a chat history that other people can access? Each of those is a person or company you are trusting with your client's image.
5. How is it deleted, and can you check? Is deletion automatic or do you have to request it? Is there a button, a published retention rule or a status page? A service that deletes on a schedule leaves less to go wrong than one that relies on you remembering to clean up.

A quick way to use this list: keep it in a note, and for every new tool you consider, write one line per question with a link to where the service says it. If you cannot fill in all five lines, look for an alternative before uploading anything sensitive. The same logic applies to general-purpose AI assistants, which often keep conversations and images by default; our article on enhancing a photo with an AI chatbot explains why they also change the picture itself.

Where Airpic puts this in writing, and how to start

Everything above is documented on the site, so you can point a client, a manager or a data protection officer to it rather than to a blog post.

• What happens to your file: a step-by-step timeline from upload to GPU to deletion, what we do not do, and who touches the data. It is linked from every tool page next to the deletion note.
• Privacy policy: the legal version, including the processors involved, the retention periods and the fact that analytics only load after you accept them. It is linked in the footer of every page.
• Status page: a live check of the website, the storage and the GPU workers, also linked in the footer.
• Why Airpic: the comparison with general AI assistants and subscription editors, including where files go and how long they stay.

On cost: processing and previewing are free, you get 1 free download a month, and after that you pay per image with credits that never expire, from €0.099 per image in the 100-image pack. Compressing is completely free. Full details are on why Airpic and on each tool page.

To try it with a photo that has to stay in Europe:

1. Open the tool you need, for example remove the background from a photo, upscale an image or remove noise from a photo. No sign-up page appears.
2. Drop in your file: JPG, PNG, WebP, TIFF, HEIC or AVIF. EXIF orientation is applied and the ICC profile is kept.
3. Choose your settings and press Process. The job runs on a GPU in Czechia, Romania or Norway.
4. Compare the preview with your original, then download the full file.
5. Close the tab. The result is deleted one hour after your download, or after one day at most.

If you work with client images every week, start with one job, read the file page, and add Airpic to your list of processors with those five answers next to it. Then the next time someone asks where their photos went, you can tell them in one sentence.

FAQ

Keep reading