Do I need to disclose Cloudinary in my privacy policy?

Yes. Cloudinary processes personal data including uploaded images, video files, and AI-detected information (such as faces and objects). Under GDPR and CCPA, you must disclose all third-party data processors. Include Cloudinary's name, the types of data transferred, and a link to their privacy policy at https://cloudinary.com/privacy.

What specific data does Cloudinary collect and process?

Cloudinary collects uploaded images and videos, extracts metadata including EXIF data (which may contain GPS coordinates and camera settings), performs AI analysis to detect faces and objects, and tracks transformation and delivery analytics. If your users upload photos with location data embedded, that geolocation information is processed by Cloudinary.

Does Cloudinary use cookies that require a consent banner?

No cookies have been documented for Cloudinary's core functionality. However, you should verify your specific implementation, as analytics or third-party integrations may introduce cookies. Check Cloudinary's current privacy documentation for any updates.

Who is the data processor and where is data stored?

Cloudinary Ltd., based in Israel, is the data processor. When you use Cloudinary, uploaded media and associated data are transferred to and processed in Israel. Cloudinary maintains SOC 2 Type II certification. You may need to implement Standard Contractual Clauses (SCCs) or other GDPR transfer mechanisms if processing EU residents' data.

File Uploads & Media

Privacy policy clauses for Cloudinary

Cloudinary is a cloud-based image and video management platform that stores, optimizes, and delivers media files. Websites use Cloudinary to handle user-uploaded images and videos, automatically enhance media quality, and analyze content using AI features like object and face detection.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Cloudinary collects

Your privacy policy must disclose each of the following data types when you use Cloudinary.

Uploaded images and videos

Image metadata (EXIF, GPS coordinates)

AI-detected content (faces, objects)

Transformation and delivery analytics

When does Cloudinary trigger privacy obligations?

Installation triggers immediate obligations

The moment you integrate Cloudinary into your site or app, three data flows activate:

1. Image/video uploads to Cloudinary's servers (hosted in Israel by default, though region selection is available)

2. Automatic metadata extraction, including EXIF data that may embed GPS coordinates, camera make/model, and timestamps

3. AI-powered content detection if you enable face recognition, object detection, or moderation features—this processes biometric data

Privacy policy clauses for Cloudinary

What data Cloudinary collects

When does Cloudinary trigger privacy obligations?

Installation triggers immediate obligations

Where data goes

Common compliance pitfalls

1. Forgetting to disclose EXIF and GPS data extraction

2. Enabling face detection without explicit consent or legal basis

3. Missing or outdated Data Processing Agreement

Legal note

Sample privacy policy clause

What regulators look for

Primary audit focus areas

Frequently asked questions

Do I need to disclose Cloudinary in my privacy policy?

What specific data does Cloudinary collect and process?

Does Cloudinary use cookies that require a consent banner?

Who is the data processor and where is data stored?

Don't ship without Bandit.