I remove the photos only if requested by the user. The photos are removed immediately, as well as the account if that is requested too. I definitely do not use the pics for retraining or any other purpose, but just to serve them on the individual overview page of the user.
https://headsnap.io/privacy
Alternately that their presence doesn't grant any rights for other use would be a good clause which I didn't spot.