Do we need a data processing agreement with SwapCat?
Yes, and it is already written. Where SwapCat processes personal data for your company — above all the people in your photographs — your company is the controller and SwapCat is the processor, and article 28 of the GDPR requires an agreement between the two.
An approver in your company accepts it once, in Settings, on behalf of the company. Nobody can generate an image until it has been accepted. It is versioned: if we change it materially, we ask again.
It lists which providers process your images, where, and on what basis anything leaves the EU, together with the retention periods and the security measures.