Privacy Policy
Last updated: October 14, 2026
This policy explains what personal information (“we”, “us”) collects when you use our website and order AI headshots, why, who we share it with, how long we keep it and the choices you have. is operated by , .
How we handle your photos and the face data derived from them is set out in full in our Biometric Data Notice, which is part of this policy.
What we collect
- Your answers to our questions: your first name, gender, age band, hair color, length and type, body type, and the outfits and backgrounds you pick. After you pay, also the poses and whether you want glasses or headwear. We use them to write the instructions for your headshots. For our photo tools, the hairstyles, hair colors, outfits or restoration options you pick.
- Your email address, and whether you ticked the box for tips and offers.
- Your photos and face data: the selfies you upload, the measurements our photo checks take from them, and the headshots and edits we generate. See the Biometric Data Notice.
- Your consent record: the version and wording of the consent you agreed to, the time, your IP address and the state of each box.
- Order and payment details. You enter your card into a form run by our payment processor, Stripe. We receive the plan or edit pack you bought, the amount, the payment and refund status and the email for your receipt. We never see or store your card number.
- Old photos for restoration: the photos you upload to restore. They may show other people; we run no face recognition on them and use them only to make your restored copies.
- A garment photo, if you add one to the outfit tool.
- Your account: your email address, whether you confirmed it, and the sign-in sessions on your devices (we store only a fingerprint of each session's key). If you sign in with Google, we receive your email address and Google's account ID, nothing else.
- Edit requests: the headshot you chose to edit and the instruction you typed.
- Device and usage data: IP address, browser and device type, the pages and steps you view, and the ad or link that brought you to us (UTM parameters and Meta click IDs).
- Cookies and browser storage: a random session ID that keeps your answers, photos and order together, an account cookie that keeps you signed in for up to 90 days, your cookie choice where we ask for one, and Meta’s advertising cookies (
_fbp,_fbc). - Messages you send us, for example support requests.
How we use it
- To make your headshots, deliver them to your private gallery and email you the link.
- To check your photos, ask for replacements when they won’t work, check that your headshots look like you, and apply the edits you order.
- To keep nude and sexual images out of the service: we screen your uploads and our results for them, and refuse edit requests that ask for them.
- To mark every headshot as AI-generated (see “Content Credentials” in our Terms).
- To take payments, send receipts, give refunds and answer support requests.
- To keep a record of your consent and of every deletion.
- To measure and improve our website and our advertising.
- To prevent fraud and abuse, and to meet legal obligations.
Meta Pixel and Conversions API
We use the Meta Pixel in your browser and Meta’s Conversions API from our server to measure which ads lead to sign-ups and purchases. They share with Meta the events you trigger (for example reaching a step, starting checkout, or a purchase and its amount), your IP address and browser details, Meta cookie IDs, and your email address in hashed (scrambled) form. If your device is set to a European time zone, nothing is sent to Meta until you accept cookies.
We never send Meta your photos, your face data, your headshots or your answers. Meta may use the data it receives as described in its own privacy policy. You can control ad personalization in your Facebook or Instagram ad settings, and you can ask us to stop sharing your data with Meta by emailing .
Who we share it with
- Stripe, to process payments.
- fal.ai, OpenAI and Google, which generate your headshots from your photos, with your separate consent. Details in the Biometric Data Notice.
- Our email provider, to send your gallery link, sign-in links and order updates. Stripe sends your payment receipt.
- Our hosting provider, which supplies the server we run the service on. Your data is stored there.
- Meta, for advertising measurement as described above.
- Cloudflare, which receives mail sent to our support address and passes it to us, and Google, whose mailbox keeps a copy of it. Our team is alerted to new support messages through Telegram.
- Authorities, when the law requires it, and a buyer of our business, who would be bound by this policy.
Each provider may use your data only to do its job for us. We never sell your photos, your face data or any other personal information.
How long we keep it
Deletion runs automatically every hour.
- Selfies: 24 hours after upload if you don’t order, and 7 days after delivery if you do. If an order fails or is refunded, 7 days after the refund (or after payment, if there was no refund). If a paid order is never delivered, 30 days after payment.
- Headshots and edits (and every photo our tools make, including the free headshot): 30 days after delivery, or 30 days after payment if they were never delivered.
- Free headshot tool: your selfies 24 hours after upload, like any visitor who doesn’t order.
- Sign-in sessions: when you sign out, or 90 days after they were made. Your account record goes with the rest of your answers and email, or at once when you delete all your data from your account settings (payment and consent records are kept as below).
- Face measurements from the photo checks: within an hour after the selfie they came from is deleted. Face embeddings are never stored.
- Answers, email address, device and usage data, and checkouts that were never paid: 24 months after your last visit or order.
- Support messages (emails and contact forms, and our replies): 24 months after the last message in the conversation, or at once when you delete all your data from your account settings.
- Consent record: 5 years after your selfies are deleted, so we can show that you agreed for as long as a claim could be brought. It contains no photos or face data. If you never uploaded a photo, it goes after 24 months with the rest.
- Order and payment records: 7 years after payment or the last refund, for tax and accounting.
- Deletion log (what was deleted and when, never the photos themselves): 7 years.
You can delete all your photos at once with the “Delete all my photos now” button in your gallery, with “Delete all my data” in your account settings, or by emailing us. The full schedule is in the Biometric Data Notice. Stripe, Meta and our email provider keep their own records under their own policies.
Your rights
Depending on where you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct it;
- delete it, apart from records the law requires us to keep, such as order records for tax;
- stop sharing it with Meta for advertising (“opt out of sale or sharing”);
- limit how we use sensitive information, which we already use only to make your headshots.
Email from the address you used with us. We may ask you to confirm the request from that address before we act. We answer within 30 days, or sooner where the law requires, and we will never charge you more or treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer.
California residents
In the past 12 months we collected the categories listed under “What we collect”: identifiers (email, IP address, cookie IDs), commercial information (orders), internet activity, characteristics you told us (such as gender and age band), and sensitive personal information (photos and face data, used only to provide your headshots). We collected them from you and your device, for the purposes listed under “How we use it”, kept them for the periods under “How long we keep it”, and disclosed them to the providers listed under “Who we share it with”. We do not sell personal information for money. Sharing event data with Meta for ad measurement can count as “sharing” for cross-context behavioral advertising under the CCPA; you can opt out by emailing us. You can use an authorized agent to make a request on your behalf.
Washington residents
Our Consumer Health Data Privacy Policy explains how we handle photos and face data under Washington’s My Health My Data Act.
Emails
We email you about your order, your gallery and sign-in links whether or not you ticked the box for tips and offers. We don’t send marketing emails today. If we start, they will go only to people who ticked that box, and each one will have an unsubscribe link.
Children
The service is only for people 18 and older, and every photo must show the person who uploads it, so photos of minors are never allowed. If we learn that photos of a minor were uploaded, we delete them at once and cancel the order.
Security and transfers
We use encrypted connections, restricted access, private galleries reached only by unguessable links, and processors we have vetted. No system is perfectly secure, so we keep only what we need, for as short a time as we can. Our providers may process data in the United States and in other countries, under the safeguards the law requires.
Changes
We will post any change to this policy on this page and update the date at the top. If a change materially affects how we use information we already hold, we will tell you by email first.