Is Higgsfield safe for my photos? What happens to your uploads

What data does Higgsfield collect?

Higgsfield collects what you type and upload, plus the usual account, device and browsing data. Section 1.1 of its Privacy Policy lists "User-shared multimedia data, such as text, photos, images, and videos that you upload", with their metadata, and "Query and prompt data", meaning your prompts and messages.

The rest is standard for a paid web app:

• Account and contact data: name, email, billing address, username, and anything you add to your profile.
• Payment data: card details are "collected and stored by our payment processors and not by Higgsfield directly". Stripe is named in s.4.
• Device and activity data (s.1.3): operating system, browser, IP address, advertising identifiers, rough location such as city, pages viewed and email opens.
• Data from sign-in providers (s.1.2): if you log in with Google, your Google username and profile picture, for example.

Two rules in the Terms of Use matter here. Section 5.4 tells you not to put "full names, contact details, government-issued identifiers, financial account numbers, health information, precise geolocation, and account credentials" in prompts, about yourself or anyone else. The Privacy Policy (s.14.2) says the same. Higgsfield is telling you to keep personal details out of what you type.

Does Higgsfield use my uploads to train its AI?

Yes, unless you are on an Enterprise agreement. Section 4.4 of the Terms of Use says "Your Content, Inputs, and Outputs may be used by Company to train, develop, enhance, evolve, and improve its (and its affiliates') AI models". Inputs means prompts plus "reference images and videos". Outputs means your generations.

The Privacy Policy repeats it in s.2.3: Higgsfield may use "user-shared multimedia data, query and prompt data, and Inputs and Outputs" to "train and improve our (and our affiliates') AI models and algorithms, and for content moderation and safety purposes."

There is no opt-out switch for individual accounts. The only control is deletion. Higgsfield's privacy help article answers "Can I stop my content from being used for model training?" with: "Yes, going forward: delete the content, or your account". It adds: "Content already used in trained models can't be separated from them."

Which plans are excluded? Only Enterprise. Higgsfield's business plans table has a "No data training" row marked No for Team, No for Scale and Yes for Enterprise. Under an Enterprise agreement, the Terms say, Higgsfield "does not use the customer's content to train or improve its AI models, and that content is handled as confidential."

Training doesn't change ownership. Higgsfield "does not claim ownership of any of your Inputs or Outputs" (s.4.4), and you can sell what you make. Our can you sell Higgsfield AI images page covers the commercial side.

Where does my upload actually go?

Into Higgsfield's systems, through its content filters, to whichever model provider runs the model you picked, and back into your private Assets library. The diagram follows only what Higgsfield's documents describe, not the internal setup, which it doesn't publish.

The provider step is the one most people don't expect. The Privacy Policy's sharing section (s.4) names "Third parties that provide services on our behalf or help us operate the Service (including third-party AI model and compute providers)". Higgsfield's NSFW help article confirms that providers see the content. It says a flag can come from Higgsfield's filter or from "providers' own filters", naming Nano Banana, Seedream, Kling, Sora 2, MiniMax, Wan and Veo.

The Terms (s.8) add that when you use a third-party model, you also agree to "that provider's applicable acceptable-use or prohibited-use policies", and the stricter terms win.

Which outside companies are listed?

Higgsfield's trust center listed 13 subprocessors on 26 October 2026:

The list doesn't name every company whose models appear in the app. Veo and Nano Banana (Google), Kling and Seedance, for example, are offered on Higgsfield but their makers are not on the list. They may be reached through the inference providers listed; Higgsfield doesn't say, so we can't tell you. If your work is sensitive, ask privacy@higgsfield.ai before uploading.

If you connect Higgsfield to another app, that app gets data too. Section 4 covers "a third-party application, client, or integration you connect through MCP", whose use of your data falls under its own privacy policy.

Are my Higgsfield generations public?

Not unless you publish them, according to the help center. Its Community article says: "Everything you generate is private by default: a work appears in Community only after you publish it." Your Assets library "is your private library", and only works you publish appear on your profile at higgsfield.ai/@username.

Check one setting anyway. The privacy help article mentions an Auto-publish switch: "Open Manage Account → Personal Profile and check the Auto-publish new generations toggle: when it's off, new generations stay private by default". It doesn't say whether the toggle starts on or off, and the Terms leave room for a permissive default. Section 3.2 says: "If you do not choose a level of access, the Service may default to its most permissive setting." The two sources don't contradict each other outright, but together they're vague, so look at the toggle yourself.

Once you publish, the work is public to everyone. "Once published, anyone can view it, even without a Higgsfield account." The Privacy Policy (s.4) warns that public content "can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines)". Unpublishing removes it from Community, but copies made in the meantime are outside Higgsfield's control.

A few more details from the help center:

• Prompts on published projects are your choice: the Access step offers "With prompts" or "Prompts hidden".
• Contest entries go further. Entries appear on the contest page, and "their prompts and generation history become publicly viewable" at the point set in each contest's rules.
• Your profile shows your @username. Your real name "is hidden by default", and your email, subscription and credit balance stay private.
• Marketing use needs either publication or consent. Privacy Policy s.2.4: Higgsfield uses your content in its marketing "only where you have made that content publicly available on the Service ... or with your consent."
• Team workspaces aren't private from admins. The business help article says workspace admins "may access and manage members' content and settings".

Is Higgsfield safe for photos of my face (Soul ID)?

Higgsfield treats the faceprint and the photos differently. The faceprint, the face-geometry measurement used to run a feature, is covered by a biometric section (Privacy Policy s.1.6): "We do not store your biometric information. It is extracted and used only transiently". It also says: "We do not sell, lease, trade, or otherwise disclose your biometric information for profit."

Your photos are a different matter. The privacy help article says: "Your uploaded photos and videos, and any character you create, are stored as your normal content under the standard retention and deletion terms". Normal content falls under the training clause in s.4.4, so Soul ID training photos are, on the documents' wording, Inputs like any other upload. Higgsfield doesn't carve them out.

What Soul ID needs, per its help article: 20 or more photos of one person, up to 80. The trained character can't be exported as a file. Deleting your account removes "Trained Soul characters" along with your generations.

Consent is your job. The help article says: "Only upload photos of yourself, or of someone who has given you permission to use their likeness". Terms s.5.3 makes you promise you have "obtained all consents, releases, and permissions required under applicable law" from everyone whose face or voice is in an upload. Higgsfield says it "does not use such media, or data derived from it, to identify, verify, or authenticate individuals". Our AI images of yourself guide covers how to set up Soul ID with your own photos.

Where the law requires consent for biometric data (Illinois, Texas, Washington, and the EU and UK are named), Higgsfield says it will "present any required consent separately". You can withdraw it by writing to privacy@higgsfield.ai, "after which we stop processing your biometric information."

What you give Higgsfield, and how to limit it

This is our summary of the clauses above: one row per thing you hand over.

PP is the Privacy Policy, ToS the Terms of Use. The wording is condensed; the section numbers are Higgsfield's.

The ad row surprises people. Section 11.3 says: "We do not 'sell' personal information in exchange for money. We do 'share'" identifiers and browsing data "for cross-context behavioral (interest-based) advertising." Higgsfield honours Global Privacy Control signals (s.5.6), which some browsers send automatically, but not "Do Not Track".

Can I delete my Higgsfield data?

Yes. Account deletion is self-service and covers your generations, Soul characters and personal data, with a 30-day window to change your mind. The path, from Higgsfield's deletion article: Manage Account → Personal Profile → Manage Account Deletion, confirm the checklist, then Delete Account.

Deleting single files is vaguer. The Privacy Policy (s.5.9) says: "Anything you remove from your account may remain on our active servers for 30 days, and copies of the content may be held in backups of our application databases after that." It doesn't say how long backups last. It also says Higgsfield may "anonymize or aggregate" data it no longer needs, and EU s.13.3 adds that anonymized data may be used "indefinitely".

Download what you want to keep first. Higgsfield's checklist warns that all content "is permanently removed and can't be recovered". If you can't log in, email support@higgsfield.ai and the team can delete the account manually after checking your identity.

Cancelling a plan is not deleting. Section 5.9 says a cancelled or lapsed subscription "does not delete your account or your content". After 30 days with no login, no generation and no subscription, the Terms (s.3.4) let Higgsfield move your content to "cold storage" after emailing you, but it isn't deleted. Our cancel and refund guide covers the billing side.

What privacy rights do I have (GDPR and CCPA)?

It depends on where you live, and Higgsfield spells out two groups: people in the EU or UK, and residents of US states with privacy laws. Requests go to privacy@higgsfield.ai.

• EU and UK (GDPR): access, correction, deletion, portability, restriction, objection, and withdrawing consent (s.15.1). Higgsfield aims to answer "within a month of receipt". It has appointed DataRep as its EU and UK representative (higgsfield@datarep.com), and you can complain to your national data protection authority or, in the UK, the ICO.
• California and other US states with privacy laws: know, delete, correct, opt out of sharing and targeted ads, limit sensitive data, and get a portable copy (s.11.5). Replies come within 45 days, extendable by 45 more. You can appeal by replying to Higgsfield's answer.
• Everyone else: the help center says users outside GDPR and CCPA regions "don't have access to automated data export at this time". Self-service deletion works for all users.

Your data goes to the US either way. Higgsfield says it is "a U.S.-based company", that your information "will necessarily be accessed and processed in the U.S.", and that it also has "a location in Kazakhstan". For EU transfers it relies on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (s.16.2).

Security is promised in general terms only. Section 7: "security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information." The trust center lists controls such as encrypted data transmission and "Customer data deleted upon leaving". The SOC 2 report and a Data Processing Agreement are "part of the Enterprise offering and are not issued for individual or Team/Scale subscriptions", per the legal help article.

What we couldn't verify

• The Auto-publish default. The help center says generations are private by default and also points to a toggle without saying where it starts. We didn't open a new account to check.
• How long backups keep deleted content. Section 5.9 mentions backups after the 30 days but gives no period.
• Which provider handles which model. The subprocessor list doesn't name Google, Kling's maker or Seedance's maker, though their models are in the app. Higgsfield doesn't publish the routing.
• Whether providers keep or train on what they receive. Higgsfield's documents don't say what model providers may do with your prompts and uploads under their contracts with Higgsfield.
• Whether Soul ID photos are used for training. The documents treat them as normal content, which the training clause covers, but no page addresses Soul ID training photos directly.
• The SOC 2 report itself. It is Enterprise-only, so we haven't seen its scope or date.
• What changed on 23 October. The Terms were updated that day; we didn't compare them with the previous version.

Our verdict

Higgsfield's privacy documents are detailed and fairly plain-spoken, and nothing in them is unusual for a consumer AI app. Your private work stays private unless you publish it, the faceprint isn't stored, and deletion is self-service. The real cost is training: on every self-serve plan, what you upload and make can train Higgsfield's models, and deletion only stops that going forward.

It suits creators making ads, characters, product shots and social content they'd post publicly anyway. Think twice before uploading client material under an NDA, unreleased products, photos of children, or anyone's face without written permission. Enterprise is the only tier with no training, confidential handling and a DPA. To check whether the company itself is trustworthy, see our is Higgsfield legit review.

To sign up safely, use higgsfield.ai directly. Higgsfield has no mobile app, so any app-store "Higgsfield" is not theirs. After you sign up, check the Auto-publish toggle, then upload only what each job needs.