Adobe Firefly safety profile

What it does with your data

Adobe says it has never trained Firefly on customer or user content. Firefly models are trained on licensed material, such as Adobe Stock, and on public domain content. Adobe also says content in its apps is not used to train AI models, whether its own or its partners’, and that its partner agreements say the same. The one exception is anything you submit to the Adobe Stock marketplace.

Training is not the whole story. On personal accounts, Adobe may analyze content processed or stored on its servers to improve its products, using techniques such as machine learning. This “content analysis for product improvement” is on by default for personal accounts, and you can turn it off. Adobe says content is aggregated first and local files are not analyzed. Business accounts and team, company or school profiles are opted out automatically.

The vendor pages checked do not mention human review. They also give no retention period for Firefly prompts or images. Adobe keeps most personal information while you are an active user, and contract and transaction records for ten years after your last interaction.

Settings to change first

If any staff use personal Adobe accounts, turn off content analysis before they start:

1. Sign in to the privacy page of the Adobe account.
2. Find the “Content analysis for product improvement” section.
3. Click the “Off” toggle.

You can change this at any time, and it does not remove access to features. Business accounts and profiles show no toggle because they are already opted out.

The opt-out has limits. It does not apply when someone uses Adobe without logging in, or to content sent through these programs:

• Adobe Photoshop Improvement Program
• Feedback
• Beta, prerelease and user studies
• Adobe Stock contributions

Tell staff to stay logged in and to keep work content out of these programs.

Free and paid tiers

Adobe’s pages split data handling by account type more than by price. Personal accounts get content analysis unless the user turns it off. Business accounts or profiles are opted out automatically.

Enterprise customers get more. Adobe acts as data processor, not controller, when enterprise customers use its products to serve individuals, and its privacy policy does not cover the data those customers collect. Adobe offers enterprise customers intellectual property indemnification for content made with Firefly, and its certifications are stated for Creative Cloud for enterprise.

One point to know: if someone signs up with your organization’s email domain or was invited by your organization, Adobe may give their personal information to your organization.

No page checked describes differences between free and paid individual plans.

Admin controls

The vendor pages checked do not cover admin controls. They do not say what an organization’s admin can manage (such as single sign-on, user management or data settings) or on which plans. Ask Adobe directly before you count on any of these.

On certifications, Creative Cloud for enterprise, which includes Adobe Express and Adobe Firefly, lists SOC 2 Type 2 and SOC 3 (Security, Availability, & Confidentiality), ISO 9001:2015, ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 22301:2019, FedRAMP Tailored, GLBA ready, FERPA ready and CSA Star Level 2. Adobe notes that “ready” means the service can be used in a way that helps you meet your obligations. You stay responsible for compliance. Adobe also says it complies with the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Framework.

Using it with donor and client data

Use a business account or profile rather than personal accounts, so content analysis is off from the start. If someone has to use a personal account, turn the setting off first.

Firefly is an image tool, so most of your work with it should not need sensitive data. Even so, never paste in or upload:

• donor names with gift amounts
• client case notes or photos of clients
• health or payment details
• exports from your donor database

Before staff use Firefly with anything tied to donors or clients, get these in writing from Adobe:

• which admin controls your plan includes
• how long Firefly keeps prompts and images
• where business customer data is stored, since the policy’s region details cover consumers and point business customers to a separate page

For consumers, personal information is processed mainly in the US and India, and no page checked says you can choose a region.

Questions people ask

Does Adobe train Firefly on our images?

Adobe says no. It states it has never trained Firefly on customer content and uses licensed and public domain material instead. Content you submit to Adobe Stock is the exception.

Is content analysis the same as training?

Not quite. Content analysis for product improvement means Adobe looks at content on its servers to improve its products, and it is on for personal accounts unless turned off. Business accounts and profiles are opted out automatically.

Can we keep our data in one country?

No page checked says customers can choose a region. Consumer data is processed mainly in the US and India and transferred to other countries where Adobe and its partners operate.