A. Purpose

This DPIA assesses the data protection risks arising from pCloud's "Photos AI" feature, which allows users to enable artificial intelligence capabilities for photographs and videos that users already store in their pCloud accounts. This assessment is conducted to comply with Article 35 GDPR.

Although pCloud does not believe that Photos AI is likely to result in a high risk to the rights and freedoms of natural persons, it has nevertheless undertaken this DPIA to ensure that it has minimized any potential risks to the greatest extent possible.

B. Scope

This DPIA covers the following Photos AI capabilities: AI indexing of the photo library; semantic search (finding photos by content or objects); face detection and clustering ("face grouping"); pet identification; quality filtering; smart albums; natural-language search; and automatic grouping by event or activity ("Moments"). Photos AI is available with newly purchased pCloud Lifetime plans and subscriptions, and is off by default; it is not a feature a user is ever required to enable to use pCloud's storage services, and enabling it does not cost extra or unlock any other features.

This DPIA does not cover pCloud's general file storage and backup service, which is addressed under pCloud's existing data protection documentation, except insofar as Photos AI interacts with or depends upon that underlying storage infrastructure.

A. Nature of the Processing

Photos AI is a service offered by pCloud but entirely and voluntarily activated by a user on that user's content. Thus, a user may utilize this pCloud service to operate on photographs and videos already stored in a user's pCloud account. The system performs: (a) automated indexing and tagging of photo content (objects, scenes); (b) generation of numerical face vectors (embeddings) from detected faces within photographs; (c) clustering of similar face vectors into groups intended to represent the same individual; (d) equivalent processing for pet identification; (e) quality filtering of images; and (f) automated grouping of photos into "Memories" or "Collections" based on inferred events or activities.

B. Further Technical and Operational Details

• The Photos AI service is strictly opt-in - it is only enabled after the user has explicitly agreed to activate it.
• Crypto (zero-knowledge) folders are excluded from all AI processing.
• Users can remove AI-generated tags, exclude specific faces from clusters, and exclude specific photos from automated collections, without needing to disable the feature entirely.
• Customer data is not used to train or improve the AI models. All models operate exclusively in inference mode.
• The AI models used are in-house and self-hosted; there is no human review of user content as part of the processing.
• No third party provides the AI model or processing service in a manner that involves transmission of customer photo data. Third parties supply only pretrained, open-source model weights; customer photo bytes remain within pCloud's own processing stack at all times.
• There is no sharing of tags, cluster assignments, face/pet recognition results, or search context between different customers, subject to one limited exception: blob-level deduplication. Where two customers upload byte-identical files (i.e., the same underlying file, identified by a shared blob identifier), generic machine-learning outputs such as object/entity tags may be reused from a blob-level cache rather than being regenerated. This reuse is limited to generic tags and entity detection results; it does not extend to person names, face or pet cluster groupings, or search context, and cluster assignments remain specific to each individual user account even where the underlying image blob is shared.
• Customer photographs remain within the customer's pCloud account under the same access controls applicable to the rest of the customer's stored data. AI-derived metadata (tags, vectors, cluster assignments) is stored in pCloud-operated databases and index services on pCloud's private infrastructure, protected by network isolation and access controls consistent with the rest of the pCloud platform.
• AI-derived data (tags, vectors, cluster assignments) is keyed to each customer's account identifier in the relevant database and vector store, and processing is batched by file so that, at the application layer, one account's data is not intermingled with another's.
• When a customer disables Photos AI, or deletes photographs, the customer's user-scoped AI-derived data is removed in accordance with pCloud's data deletion policy. Disabling Photos AI results in deletion, within 30 days, of the AI-generated data associated with the account, including tags, face vectors, groupings, and smart albums; disabling the feature does not delete the user's original photos or other files. Removing a specific face from a group, or excluding a specific photo from an automated album or collection, can be done without disabling the feature entirely.
• The categories of data involved are: the stored photographs and videos themselves; derived metadata (object tags, face and pet templates/embeddings, cluster assignments, and event groupings); and EXIF metadata associated with the images.

C. Purposes of Processing

pCloud provides the Photos AI processing as a service to its users. Users voluntarily activate the service to process their own data - so that those users may obtain the benefits provided by the service, namely, semantic search, automatic tagging, face detection and clustering, pet identification, quality filtering, smart albums, and natural-language search.

pCloud's basis for the processing is the user's consent. This consent is explicit and freely given through user controls that permit the user to turn Photos AI on and off as the user desires. Additionally, when a user disables Photos AI or deletes photographs, the customer's user-scoped AI-derived data is removed.

A. Necessity

The processing serves legitimate and clearly articulated purposes: enabling users to search, organize, and navigate large personal photo libraries by content, person, pet, and event. Manual tagging and organization at scale is impractical for most users given the size of typical modern photo libraries, supporting the argument that some form of automated organization serves a genuine user need.

Additionally, as explained, users control the Photos AI service, and choose when to enable it and disable it. Thus, users determine the necessity for themselves.

B. Proportionality

Several design choices support a finding of proportionality: the feature is opt-in rather than default-on; processing is confined to each individual account with no cross-account matching (other than the limited generic-tag deduplication described above); Crypto folders are excluded entirely; and users retain granular control to exclude specific faces, photos, or albums from the feature's output.

1. Risk of Unauthorized Access to AI-Derived Data

pCloud has taken steps to reduce any risks in this regard, including implementing firewalls, data encryption, physical access controls to our data centres, and information access authorisation controls. Additionally, although unauthorized access to face vector data carries risk, it does not contain more information (and contains less information) than the underlying photographs from which the vectors are generated. pCloud thus does not create new data that is qualitatively more risky to an individual than the photo from which it is derived.

2. Risk from AI Output Inaccuracy

AI outputs are probabilistic and there is the potential for errors, including that the system may generate outputs, tags, clusterings, and suggestions that are incorrect, inaccurate, misleading or offensive. Thus, there is a risk that a user may be exposed to inaccurate information or may be offended by suggested clusterings. pCloud warns users of this risk and will work to ensure that the Photos AI service is as accurate and error-free as possible.

A. Organizational and Design Measures

pCloud has implemented the following organizational and design measures to help reduce any residual risks:

• Strictly opt-in activation, with no default-on processing.
• Complete exclusion of Crypto (zero-knowledge) folders from all AI processing.
• No use of customer data for model training; all models operate in inference mode only.
• No third-party transmission of customer photo content; only pretrained open-source model weights are sourced externally.
• No cross-account matching or sharing of person-identifying tags, cluster groupings, or search context (subject to the limited generic-tag deduplication).
• User-facing controls allowing exclusion of specific faces from clusters and specific photos from albums.
• Deletion of user-scoped AI-derived data upon feature deactivation or deletion of underlying photographs.
• Account-scoped data architecture, with AI-derived data keyed to individual customer identifiers and processing batched by file to avoid intermingling at the application layer.

B. Transparency Measures

pCloud has implemented the following transparency measures to help reduce any residual risks:

pCloud has provided an opt-in consent flow that provides users with information as well as links to pCloud's help center documentation providing further details about Photos AI. pCloud's privacy policy further provides information about Photos AI data processing and access to the same help center articles with additional information.

C. Robust User Controls to Disable Photos AI and Delete Data

Finally, as described above, pCloud has implemented robust user controls to disable Photos AI and delete data which also help reduce any residual risks. In particular, users can easily disable Photos AI, which will delete any AI data and face vectors, and likewise, deleting a photograph removes any face/pet vector or tag derived from it.

For the above reasons, this DPIA assesses the residual risk associated with Photos AI as manageable because any privacy impacts are limited and controlled by the user who activates the Photos AI feature for use on photos in their possession.