Only one of five background removal vendors publishes when the uploaded media is finally gone

Take VideoBGRemover's privacy page at its word and the deletion clock adds up. Production erasure completes within 30 days of a verified request, and soft-delete systems and rolling backups may hold copies for seven days beyond that ^[5]. Worst case, 37 days pass between the request and the last copy going away ^[6]. It is the only page in the survey with a tail on its number ^[7].

Two other figures in the comparison look like retention numbers and are not about the frames. Remove.bg's three-month ceiling applies to server logs ^[3], and the 30-day payload default in fal's media expiration docs applies to JSON ^[8].

The fal detail is the one I would check first in a config review. A file on the fal CDN is readable by anyone holding the link unless you attach an access control list, and an uploaded input inherits the account default instead of the header set on the inference call ^[9]. The setting that decides whether a customer's frames are link-readable therefore sits one level above the code path that uploads them.

Photoroom and VideoBGRemover reach similar comfort on model training by different routes. Photoroom's training clause covers photos people send to its app and excludes API images in the same text ^[10]. VideoBGRemover rules out training on customer content across the whole service ^[11]. The clauses read alike, and the difference is scope: Photoroom's carve-out holds only if your traffic is API traffic.

Banuba is the outlier row. The Face AR SDK runs inside your app ^[15]. That settles the media path before a reviewer asks about it. The license path stays open: the SDK is licensed by a token in .txt format with a published expiry ladder, and the page does not say whether the SDK phones home to check it ^[14]. An offline or restricted-network deployment cannot be planned from that material alone.

For the other four, the media crosses the network before anything happens to it ^[16], and the honest questionnaire entry is yes for all of them ^[20]. Photoroom's API page is the only place in the five naming an outside auditor, with SOC 2 Type 2 ^[12]. On contract instruments, VideoBGRemover names an enterprise DPA incorporating the European Commission's 2021 Standard Contractual Clauses, and Remove.bg names EDPO as its EU and UK representative ^[13].

The writeup is direct about its limits. "I ran no tests for this one and there is not a millisecond anywhere below," the author wrote ^[2]. Every claim comes from a vendor's own live pages as they stood on 8 September 2026 ^[1]. A blank cell means the author found nothing published on the subject, not that the vendor does the opposite ^[18]. He also notes those pages get edited, often quietly, and that any figure deciding a build should come from the vendor in writing and addressed to you ^[19].

Which is the useful part of this exercise. Mask quality on hair and glasses you can test in an afternoon. A 37-day erasure tail is unenforceable unless the vendor restates it in a contract ^[6][19].