Privacy Policy

This draft explains how Headshotist handles personal data when you visit the site, sign in, buy credits, upload a photo, or generate a headshot. The intended data controller is [Insert legal business name], at [Insert registered business address].

When you sign in with Google, we may receive your name, email address, profile image, Google account identifier, and authentication information permitted by Google. We use this data to create and secure your account, display account details, associate credits and generated images with you, and provide support. We do not receive your Google password.

We process the selfies, photos, image URLs, style choices, aspect ratios, and generation instructions you submit. These inputs are sent to AI processing providers to create your requested headshots. Photos may reveal biometric characteristics, but Headshotist does not use them to identify you, authenticate you, or create a biometric identity database.

We receive and store generated images, generation status, selected style, aspect ratio, timestamps, and related request identifiers so you can view results in your gallery, download them, retry failed work, and receive support.

Stripe processes checkout and payment information. Headshotist receives transaction identifiers, payment status, purchased pack, amount, currency, and limited billing details needed for accounting, fraud prevention, support, and credit fulfilment. We do not receive or store your full payment-card number.

We may collect IP address, browser and device details, pages and features used, timestamps, referring URLs, error and security logs, and essential cookie or session identifiers. We use this information to operate sign-in, keep the service secure, diagnose failures, prevent abuse, and understand service performance. Any non-essential analytics or advertising cookies should be documented and consent-managed before launch.

Depending on where you live, our legal bases may include performing our contract with you, complying with legal obligations, your consent, and our legitimate interests in securing, supporting, and improving Headshotist. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.

We share data only as needed with providers supporting authentication, hosting, databases, AI image processing, payments, email or customer support, security, and analytics. Current key providers include Google for sign-in and Stripe for payments. Some providers may process data outside your country; where required, appropriate transfer safeguards should be documented before launch.

We retain account, credit, transaction, uploaded-photo, generated-image, and technical data only for as long as needed for the purposes described above, legal compliance, dispute handling, fraud prevention, and backups.

Launch placeholder: insert the final retention periods for source uploads, generated images, inactive accounts, logs, and backups. You may request account or image deletion by contacting support@headshotist.com; some billing or security records may need to be retained by law.

Depending on your location, including under the GDPR, you may have rights to access, correct, delete, restrict, or object to processing; receive a portable copy; withdraw consent; and complain to your local data-protection authority.

Headshotist does not use your photos to make decisions producing legal or similarly significant effects about you. We may ask for reasonable information to verify a privacy request before acting on it.

We use reasonable organisational and technical safeguards, but no online service is completely secure. Headshotist is not intended for children below the minimum digital-consent age applicable where they live. We may update this policy and will post the revised date and provide additional notice where required.

For privacy questions or requests, email support@headshotist.com or write to [Insert registered business address]. Before launch: confirm the controller identity, privacy contact, representative or data-protection officer details if required, and the competent supervisory authority.