Lensa AI

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• Despite processing biometric data (facial geometry), Lensa holds no public SOC 2, ISO 27001, ISO 27017, or ISO 27018 certifications. This is unusual for a company handling sensitive personal data.
• The Better Business Bureau rates Prisma Labs, Inc. as 'F' due to failure to respond to 2 filed complaints. The BBB file opened 12/5/2022; the business started 5/15/2016. This raises questions about responsiveness to compliance issues.
• There is an apparent contradiction around AI training: the official privacy policy states 'We do not use your Personal Data to train separate AI products,' but historical reports (ArtNews, ArtMajeur, 2022-2023) and earlier ToS language suggest Lensa previously used user data for AI model training. The current policy appears to narrowly exclude per-user custom model training (used only for that user's avatars and effects) from the definition of 'training separate products.' Buyers should ask the vendor to clarify this ambiguity.
• Lensa's data security posture is weak: the privacy policy explicitly states Lensa 'cannot guarantee the security' and 'there is no ideal technology or measure to maintain 100% security.' This low-assurance language is concerning for a vendor processing biometric and facial data.
• The public privacy policy and terms do not specify encryption standards, protocols, or key management practices for data in transit or at rest.
• Lensa does not publish a trust center, security documentation, or compliance audit reports on its vendor domain.
• Lensa collects facial geometry (via Apple TrueDepth) and other biometric data without formal security certifications or third-party audits. A lawsuit under the Illinois Biometric Information Privacy Act (BIPA) has been filed alleging collection of facial geometry without proper consent.
• Lensa's underlying Magic Avatars and Art Styles models use third-party models (Stable Diffusion) trained on internet images with unclear licensing. While this does not directly implicate Lensa's data handling, it raises questions about IP governance and vendor oversight of third-party dependencies.
• Data retention policies vary by feature: 24 hours for Art Styles, immediate for Magic Avatars, and 30 days for the AI-Assistant via OpenAI. There is no global data retention policy, and the multi-vendor data lifecycle is complex.
• Lensa claims GDPR compliance via Standard Contractual Clauses but provides no formal evaluation letter, no Data Protection Impact Assessment (DPIA), and no auditor confirmation of the adequacy of its safeguards.