I’d be interested in how your privacy policy allows this. I can’t find where it mentions photos are stored or used for training purposes…
That's all they need to do to cover themselves.
With this broad of a privacy policy, they can start MyFitnessPal.com/UncroppedCandidPhotos where they let people search for users by name, email, or phone and sell your photos to the highest bidder, and that still would count as a Service that uses photos to customize. You consented to it!
> This feels like the kind of flimsy reasoning that only holds so long as no one is challenging it.
No, it is written by professional lawyers to be as permissive as possible.
But you repeat myself.
OK, say they do all that, that isn't customisation (I would argue) it is a new service that was built from unconsented data scraped from users of the pre-existing services. Call that splitting hairs if you like, but this looks like a risk to me.
If this is real and not a joke, I bet some DPA will disagree if this is brought to their attention. Effective consent under GDPR requires informed consent.
I'm not shocked but I'm shocked you are shocked.