Reference table
Where client gallery platforms store your photos
A photo of a person is personal data, and where your gallery provider keeps it decides which law applies and what you can tell a client who asks. This page reads eight platforms' own terms and privacy policies and writes down three things for each: where the photos sit, what legal basis covers a transfer out of the EU, and whether a data processing agreement exists. Checked on 19 October 2026. Terms change, so the date is part of the answer.
Eight platforms, side by side
Checked 19 October 2026 against each platform's terms of service and privacy policy. Where the documents give no answer, the cell says so.
| Platform | Where photos are stored as stated in its documents | Basis for EU transfers SCCs, Data Privacy Framework, or none | Data processing agreement and how you get it |
|---|---|---|---|
| Photoglacier | Exoscale Object Storage in Germany. Austrian company; the data stays in the EU. | None needed: no transfer out of the EU. | Yes. You read and conclude it yourself in the app, on every plan including the free one. |
| picdrop | Its terms say it currently uses only servers in Germany, and reserve the right to use servers abroad. | Not needed while hosting stays in Germany; its US chatbot provider is covered by Standard Contractual Clauses. | Yes, concluded in the account, on any plan, at no cost. |
| Pixieset | Not named. The privacy policy says data may be transferred, stored or processed in a country other than yours, and cites Canadian law (PIPEDA). | Standard Contractual Clauses for EEA data. | A Data Processing Addendum is referenced in the terms. |
| Pic-Time | Servers in the EU, the US and Australia; its headquarters in Israel may access the data. | Standard Contractual Clauses for transfers out of the EEA. | Not found in the pages checked. |
| ShootProof | Stored in the United States, per its privacy policy. | Standard Contractual Clauses; it states it is not certified under the EU-US Data Privacy Framework. | Not found in the pages checked. |
| SmugMug | Servers in the United States, per its privacy policy. | Standard Contractual Clauses, and it states it is certified under the EU-US Data Privacy Framework. | Not found in the pages checked. |
| Zenfolio | Stored in the United States, per its privacy policy. | Not stated in the pages checked. | Not found in the pages checked. |
| CloudSpot | Processed in the United States. Its own policy notes the US has no EU adequacy decision. | None named: the policy mentions neither Standard Contractual Clauses nor the Data Privacy Framework. | Not found in the pages checked. |
How this was checked
Every cell comes from the platform's own published documents, read on the date above. Nothing is inferred from marketing pages.
Read, not asked
The source for each row is the terms of service and the privacy policy on the platform's own domain, plus its help centre where it states a policy. A claim on a landing page does not count; a sentence in the terms does.
What "not stated" means
When a cell says the documents do not state something, that is the finding, not a guess. A provider that names no storage region or no transfer basis has told you something by its silence, and it is a fair question to put to them directly.
Why the date matters
Several of these documents were revised in 2026. A table like this is only as good as its check date, which is why it carries one, and why it gets re-read rather than left to drift.
Where Photoglacier keeps your photos
The same three questions, answered for this platform: every photo and every client's data is on Exoscale Object Storage in Germany, run by an Austrian company, so nothing leaves the EU and no transfer mechanism is involved. The data processing agreement is the same document on every plan, and you read and conclude it yourself in the app.
- Storage in Germany, company in Austria, no transfer out of the EU
- DPA in German and English, concluded in the app on any plan, including the free one
- Sub-processors named in the DPA, all EU-hosted, with 30 days notice of changes
- Nothing is analysed or used to train AI
Questions this table answers
Why does it matter where a gallery platform stores photos?
Because a photo of a person is personal data under the GDPR, and the controller, which is you, has to know where it is processed and on what legal basis. A provider inside the EU needs no transfer mechanism. A provider outside it needs one, usually Standard Contractual Clauses or the EU-US Data Privacy Framework, and you should be able to name it if a client or a company's legal team asks.
What are Standard Contractual Clauses?
A contract template approved by the European Commission that a non-EU provider signs to make transfers of EU personal data lawful. They are common and workable. They also mean you, as the controller, are relying on a transfer mechanism rather than on the data never leaving, which is worth being able to say out loud.
What is the EU-US Data Privacy Framework?
A certification scheme under which a US company commits to EU-level protections, recognised by the European Commission in 2023. Of the US platforms checked, SmugMug states it is certified, ShootProof states it is not, and CloudSpot and Zenfolio do not mention it in the pages read.
A platform says nothing about where it stores photos. What does that mean?
It means the documents do not answer the question, which is itself an answer. Ask the provider in writing where the files sit and which transfer basis applies. A provider that cannot answer in a sentence is a provider you will struggle to explain to a client.
Do I need a data processing agreement with my gallery provider?
Yes. The provider processes personal data on your behalf, so Article 28 of the GDPR requires a written contract between you. Photoglacier and picdrop let you conclude one in the account on any plan; Pixieset references a Data Processing Addendum in its terms; for the others it was not found in the pages checked, so ask.
How often is this table re-checked?
The date in the heading is the last full read of every document. Several platforms revised their terms in 2026, so this is re-read rather than trusted, and corrections are welcome through the contact form with a link to the clause.
Where gallery platforms keep client photos, in one dated table
Photographers searching for where a client gallery platform stores photos usually need the answer for a specific reason: a client asked, a corporate job has a security questionnaire, or a wedding couple wants to know their guests' faces are not sitting on a server outside the EU. The marketing pages rarely say. The terms and privacy policies do, in a sentence, and that sentence is what this page quotes for eight platforms with the date it was read.
The pattern is clear enough: the German and Austrian providers keep photos in Germany and need no transfer mechanism, the Canadian and US providers rely on Standard Contractual Clauses or the Data Privacy Framework, and one US provider names no mechanism at all. None of that makes a platform unusable. It decides what you have to be able to explain, and whether a data processing agreement exists to back it up.
More guides
Photoglacier is not affiliated with any other platform named on this page. Statements about other platforms are quotations from or summaries of their publicly available terms and privacy policies as read on 19 October 2026; those documents may have changed since. Nothing here is legal advice.
Photos that stay in Germany, with the agreement to prove it
Exoscale Object Storage in Germany, an Austrian company, and a DPA you conclude yourself on every plan.
