It should be your default assumption that any and all data you hand over to a company will be collected, used by that company in any manner that they feel will be beneficial to them, sold/leaked to others, and ultimately used against you.
At a glace, it appears that the privacy policies of walmart, CVS, and walgreens allow for it. I imagine that's where most people these days take their photos for development and/or printing
I worked in a Walgreens photo lab circa 2004. At the time the mini lab kept a scanned copy of all images for at least 90 days. I think it was set to use rolling storage, so the time frame wasn’t definite.
On another note, the photo techs will be looking at your photos - at least, the good ones will, so they can adjust for color balance and exposure. The really bad ones will too, so they can keep a copy of any “interesting” photos.
When I worked there, I called the police about once a month, for exactly the reason you might expect.
At a glace, it appears that the privacy policies of walmart, CVS, and walgreens allow for it. I imagine that's where most people these days take their photos for development and/or printing