// Trust & Security Report
Init ML SAS (operating as "Clipdrop"; product owned by Jasper AI, Inc. since Feb 2024)
Cleanup.pictures is a free/low-cost web tool for AI object, text, and watermark removal from photos, operated as part of the Clipdrop suite (background removal, uncrop, generative fill, API). Originally built by French startup Init ML, briefly owned by Stability AI (Feb 2023-Feb 2024), then acquired by Jasper AI in Feb 2024. The site footer still reads 'Init ML' as of this review.
Certifications held
0
Maturity
Startup
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 7 unconfirmed / not-held certifications
source: cleanup.picturesno public evidence: cleanup.pictures and clipdrop.co have no trust/security page (clipdrop.co/security returns HTTP 404; probes to cleanup.pictures/security, /trust, /trust-center, and /compliance all fall back to the homepage, i.e. the pages do not exist). Current parent company Jasper AI states on its own trust center 'Jasper is compliant with SOC 2, PCI, DPA, CCPA, and GDPR' (https://www.jasper.ai/trust), but that page does not name Clipdrop or Cleanup.pictures as in-scope products, so Jasper's SOC 2 cannot be extended to this tool without vendor confirmation.
source: cleanup.picturesno public evidence on cleanup.pictures, clipdrop.co, or Jasper AI's trust center (https://www.jasper.ai/trust) mentions ISO 27001
source: cleanup.picturesno public evidence found on any vendor-controlled domain
source: cleanup.picturesno public evidence found on any vendor-controlled domain
source: cleanup.picturesno public evidence; not applicable, this is a general consumer photo-editing tool with no BAA offering or healthcare-data marketing found
source: cleanup.picturesno public evidence on vendor's own domain; payment processing for the Pro subscription is not documented on cleanup.pictures itself (likely handled by a third-party processor, unconfirmed)
source: clipdrop.counable to independently verify with a direct quote: cleanup.pictures/legal/privacy and clipdrop.co/privacy are client-side rendered pages that could not be retrieved as text (only the navigation shell loads without JavaScript); secondary sources describe Init ML as France-based and the Clipdrop privacy policy as stating no personal data (name/email/IP) is collected, no cookies/tracking are used, and uploaded images are auto-deleted after 30 days, but this could not be confirmed with a verbatim vendor-domain snippet in this review
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
Not disclosed on cleanup.pictures or clipdrop.co. Vendor entity (Init ML) is based in Montreuil, France (per secondary sources); current owner Jasper AI states its own platform stores data in U.S.-based data centers, but this has not been confirmed to apply to Cleanup.pictures/Clipdrop infrastructure specifically.
Could not directly confirm from vendor-rendered text (privacy/ToS pages are JS-rendered and returned only nav/footer content to non-JS fetches). Secondary-source summaries describe Clipdrop's own policy as: personal data is not collected and uploaded images are anonymous and auto-deleted after roughly 30 days; separately, some third-party write-ups describe free-tier images as usable for 'model reinforcement' while Enterprise/API customers are told their data is not used for training. These two claims (no-retention-beyond-30-days vs. free-tier model reinforcement) were not verifiable side-by-side on a single vendor page, so treat as unconfirmed and flag for the vendor to clarify before recommending Cleanup.pictures for sensitive images.
// Security controls
Encryption in transit
No explicit public statement found on cleanup.pictures or clipdrop.co (site is served over HTTPS, but no dedicated security page documents TLS version or config).
cleanup.picturesDedicated security/trust page
None. clipdrop.co/security returns HTTP 404. Probed paths on cleanup.pictures (/security, /trust, /trust-center, /compliance) all resolve to the homepage rather than a distinct page.
clipdrop.coSSO / access control
Not applicable in the reviewed evidence; Cleanup.pictures is a single-user, no-login web tool for the free/Pro tiers ("Each cleanup subscription is individual and limited to 1 user").
cleanup.picturesData retention
Not confirmed directly on vendor domain in this review; secondary sources describe uploaded images as auto-deleted after about 30 days under Clipdrop's stated policy. Treat as unverified until the vendor's own privacy page text can be captured.
clipdrop.co// Products & data scope
data: User-uploaded images, export capped at 720p
No account required to try; unlimited images at reduced resolution.
data: User-uploaded images, unlimited resolution
$3-5/month equivalent pricing; adds unlimited resolution and a 'high quality refiner'; single-user license per subscription.
data: User-uploaded images across multiple tools
Starting around $11/month; bundles Cleanup, Remove/Replace Background, Uncrop, Generative Fill, and other Clipdrop tools under one subscription.
data: Images submitted programmatically by integrating developers/businesses
Usage-based pricing; documented for Node.js, SwiftUI, and Kotlin integration. Some secondary sources describe Enterprise/API usage as excluded from model training, distinct from the free consumer tier; not independently confirmed on the vendor's own API terms page in this review.
// What to watch
- Corporate ownership chain is complex and unresolved in public vendor copy: built by Init ML, sold to Stability AI (Feb 2023), then resold to Jasper AI (Feb 2024). The cleanup.pictures/clipdrop.co footer still reads 'Init ML' rather than Jasper, so it is unclear which entity's policies and infrastructure actually govern this product today.
- Identity-conflation risk: Jasper AI's own trust center (jasper.ai/trust, security.jasper.ai) advertises SOC 2, GDPR, CCPA, and PCI compliance for the Jasper platform, but neither page names Clipdrop or Cleanup.pictures as in-scope. Do not credit Cleanup.pictures with Jasper's certifications without vendor confirmation of scope.
- A third-party aggregator (Nudge Security) lists clipdrop.co as 'PCI / HIPAA / SOC 2 / GDPR / ISO 27001 / FedRAMP / CSA STAR Compliant' all simultaneously. This is not a vendor-domain source, is inconsistent with the complete absence of any trust/security page on the vendor's own site, and reads as an implausible blanket claim for a $3/month consumer photo tool. Treated as unreliable and excluded from all held=true determinations per the no-fabrication rule.
- AI-training posture is unclear and possibly self-contradictory across secondary sources: some describe Clipdrop's policy as 'no personal data collected, images deleted after ~30 days,' while others describe free-tier images being used for 'model reinforcement.' Could not be resolved with a direct, dated vendor-page quote in this review; recommend the vendor clarify before AIFOXX asserts either position.
- Vendor's substantive legal pages (privacy policy, ToS, legal notice) are client-side rendered and could not be captured as text by automated tooling in this review beyond the site's nav/footer shell - a genuine capture limitation, not evidence that the pages don't exist. A manual browser check of clipdrop.co/privacy and cleanup.pictures/legal/privacy is recommended before this assessment is finalized.
// At a glance
Pricing model
Freemium consumer tool (free tier + $3-5/mo Cleanup Pro or $11+/mo Clipdrop Pro bundle) plus usage-based developer API pricing
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Init ML SAS (operating as "Clipdrop"; product owned by Jasper AI, Inc. since Feb 2024)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
cleanup.pictures