Who operates this service
StudioHeadshot operates studioheadshot.app and is responsible for the personal information processed by this service. Use our privacy contact form to ask about your information or this policy.
Information we process
- Images: your uploaded original and requested headshots, style and collection choices, image dimensions, generation status, creation time and deletion deadline. We do not publish your photos in a public customer gallery.
- Accounts: verified email, optional name you provide, optional sign-in provider identifier, account level and essential session data. We do not create passwords or infer your name from your email or face.
- Purchases: order reference, quantity, payment status, amount, currency, verified payment-event audit records and the credit ledger. When checkout is available, purchases use Dodo Payments as merchant of record. We send your account email, opaque account/order references, credit quantity, quoted amount and currency to Dodo to create and verify checkout. Dodo collects billing and payment details on its hosted checkout. We do not collect full card details in the studio or send your private portraits to Dodo. See Dodo’s Privacy Policy. Dodo may retain payment records under its own policy and legal obligations, separately from our 30-day photo retention.
- Security and moderation: server/proxy-reported IP address and browser user-agent on selected sign-in, upload and administrator-access events; timestamps; affected account/photo identifiers; review reasons and outcomes; hashed network and signup-reward identifiers; rate limits; and redacted error reports. IP addresses may identify a shared network or proxy, not a particular person. We do not use them as proof of identity. We do not collect precise GPS location or build face-recognition or device-fingerprint profiles.
- Upload confirmations: the accepted policy version, account, photo identifier and confirmation time. The upload agreement records your acceptance of the photo requirements in our Terms; it is not an automated check that your photo is clear or appropriate.
Why we use it
We process account details and portraits to provide the headshots you request, verify sign-in, preserve your balance and make recent images available across devices. We use limited activity information to investigate faults, prevent abuse and protect customers. We do not sell personal data or use private customer portraits as marketing examples without separate permission.
Where data-protection law requires a lawful basis, providing your requested service is based on performance of our contract with you; proportionate fraud prevention, security and Terms enforcement are based on legitimate interests; legally required accounting or disclosures are based on legal obligations. Optional uses requiring consent will be requested separately. Accepting the Terms or acknowledging this policy is not blanket permission for unrelated uses.
Restricted administrator review
Authorized administrators may access account email/name, credit and generation records, uploaded originals and generated headshots when reasonably needed to investigate prohibited content, enforce our Terms, resolve a support request or investigate security abuse. A separate per-photo approval is not requested for those limited purposes.
Customer records require verified, allowlisted administrator access and a recent sign-in. Opening a private photo requires a stated review purpose and creates an activity entry; administrators can record a review outcome, restrict photo access or suspend new uploads, generation, purchases and code redemption. Suspension preserves access to saved data and deletion controls. Administrator access also requires a second-factor code. The configured owner verifies a fixed mobile through an external phone-authentication service and a security challenge. Those services process the phone number and related verification information for authentication and abuse prevention. This does not require customer phone numbers. Photos are not included in public account responses, and merely knowing an image identifier does not grant access. Review status is not proof that an image was automatically screened or is safe. We do not promise that every upload is checked.
Questions and feedback
The public contact form sends your reply email, optional name, topic and message to StudioHeadshot support through our email-delivery provider. These messages are handled in our support mailbox, not published as reviews or saved in your photo gallery. We also send a receipt confirmation to the reply email you provide. The application does not keep a separate copy of your public contact-message text. Your reply email and request reference may be queued privately for up to 24 hours to deliver the confirmation; the queued address is removed after the email service accepts it or the retry window ends. Minimal delivery references, status, timestamps and hashed recipient rate-limit records may remain for up to 30 days. Confirmations do not include your message text or private photos. Security checks and rate limits protect the form and prevent repeated confirmation emails. Do not submit private photos, passwords, verification codes or card details. Contact us to request deletion of support correspondence; email-provider retention may also apply.
Photo reports and follow-up messages
When you report a generated photo or send feedback from My photos, we save your chosen topic, message text, account identifier, photo reference, submission time and report status privately in our application database. Only authorized administrators can access these reports to provide support or investigate possible violations of the Terms. The report references your existing photo; it does not create a second image copy or make your photo public. Reports are not published as customer reviews. We send a receipt confirmation to your verified account email using the limited delivery queue described above, without attaching your portrait or repeating your report text.
Each report is automatically removed 30 days after it is submitted, or when you delete your account. A new follow-up is saved separately, so an earlier resolved report does not prevent you from asking for more help. Each message keeps its own 30-day retention period. Administrators may group messages about the same account and headshot into a support conversation and send replies to your verified account email through Resend. We keep each reply, its administrator identifier, request reference, submission time and delivery status for 30 days. Queued replies use a temporary copy of your email address for up to 23 hours; it is cleared when the delivery provider accepts the email or the retry window ends. These emails do not attach your photos or private administrative notes. Replies you send by email arrive in our support inbox and are not automatically imported into the website conversation. Account deletion also removes its stored replies and queued receipt records. Please do not include passwords, verification codes, card details or other unnecessary sensitive information.
Storage and retention
Sign-in is required to upload. Selecting a file first creates a local preview; no photo is sent to our server until you accept the upload agreement and choose Upload. Cancelling closes the local preview without uploading that file. After upload, your original is saved even if you do not generate a headshot.
Originals are retained for 30 days from upload; successfully generated headshots are retained for 30 days from completion. Files become inaccessible at their deadline and are deleted by the retention worker. Authorized, logged review does not extend a photo’s lifetime. You can delete individual images or originals earlier. Downloaded copies on your device are outside our control.
Application activity logs containing IP addresses/browser details, upload-confirmation records and private administrative support notes are deleted after 30 days. Account deletion removes the associated private support notes. Authenticator seeds are encrypted at rest; recovery codes are stored as hashes. Credit adjustments and promotional redemptions create ledger records; hashed email/code-use evidence prevents repeated redemption after account recreation. Minimal operation references and payload hashes prevent duplicate changes without retaining support-note text in the retry record. Review records keep a photo identifier, outcome, reason, administrator and time; they do not keep a second image copy. Account details remain while you maintain your account. New sign-ins expire after at most seven days when remembered, or use a browser-session cookie with a 12-hour server limit otherwise; see Cookies and browser storage below. Credits do not expire and are separate from image retention.
Account deletion removes your email/name, sign-in access and stored images. Minimal pseudonymous purchase/credit records and hashed reward identifiers may remain for accounting, disputes and preventing repeated free-credit claims. Please contact us about support-mail and other privacy requests. Hosting, email and AI providers may maintain their own limited operational or legally required records under their terms. Daily encrypted recovery backups are stored in private Cloudflare R2 storage, including the database and retained customer and review images. Backup objects expire after 7 days; the storage provider normally completes physical removal within a further 24 hours. Deleted information may remain in these restricted recovery copies until that removal completes. Backups are not served as a photo gallery, and any recovery must reapply the original deletion deadlines and account-deletion records.
Service providers and international processing
Our service uses Railway for application/database/photo hosting, Cloudflare for website delivery and Turnstile security checks, Resend for transactional/support email, and an external AI image-processing service for requested portrait generation. When you submit a portrait after accepting the upload agreement, a review copy is sent to an external AI service for safety and portrait-quality assessment. Accepted portraits and selected style instructions are sent for headshot generation when requested. We do not send your private photos to Resend as feedback attachments.
Provider processing may occur outside your country, including in countries where the providers maintain facilities. Their contracts and applicable data-protection transfer requirements govern that processing. We do not promise that all processing occurs in one region or that deleting a photo from our gallery instantly removes every provider-side safety log. See Railway privacy information, Cloudflare’s privacy policy and Resend’s privacy policy. Contact us for further information about applicable safeguards.
Upload screening and review history
Before accepting a submitted portrait, we assess safety and suitability for a professional headshot. We store the check result, its reason, the exact message shown to you, submission time, chosen wardrobe preference and account reference. Submitted photos, including rejected or replaced portraits, may be kept privately for administrator review for up to 30 days; at most 20 recent review image copies per account are retained. Expired or older completed review copies may be removed sooner to stay within our storage budget; when space is unavailable, we retain the assessment record without a review copy. This cleanup does not remove your saved originals or generated headshots. Review copies may have lower resolution than your generation reference. Some prohibited-content refusals or unrenderable files retain metadata only. Review images do not appear in the customer gallery or public routes.
Three counted safety rejections can restrict uploads and new generations until administrator review. Quality failures, uncertain assessments and service errors do not count as safety warnings. Administrators can correct warnings, lift or maintain restrictions, or delete an account with confirmation. Restrictions do not consume credits. Warning/restriction state may remain until reviewed or the account is deleted. Automated checks can be mistaken; contact support to challenge a result. A wardrobe preference is chosen by you, not inferred gender or identity.
AI processing
We use a paid external AI-processing service. Under the applicable paid-service terms, prompts and responses are not used to improve the service provider’s products. The provider may keep limited safety/abuse logs and process data internationally. Contact us for the identity of the image-processing provider and information about its processing terms. StudioHeadshot does not train its own face-recognition or general AI model on your portraits. Image generation is not identity verification and may produce inaccurate results. Generation requests may wait in a private processing queue. We retain job status, technical retry information and related account/photo references for up to 30 days to complete requests, prevent duplicate charges and investigate failures. Queue records do not contain image bytes, API keys or full prompt text.
Cookies and browser storage
We use an essential HttpOnly session cookie for sign-in and verification. If you choose “Remember me for 7 days”, a new sign-in remains valid for up to seven days unless you sign out or access is revoked. Otherwise, a new sign-in uses a browser-session cookie with a server-side limit of 12 hours. Browser session restoration may preserve session cookies. Administrator access still requires recent verification. Legacy guest photos can be attached only to the same browser’s verified account. Browser storage holds theme preferences and a pending quantity or style choice—not your authoritative credit balance or account level. The signup credit is granted once by the server after identity verification. Hashed reward identifiers remain as anti-abuse evidence after account deletion to prevent repeated reward claims.
Your choices and rights
Delete images in My photos, update your optional name or delete your account in Account, or use our contact form for privacy requests. Clearing cookies does not delete records or reset free eligibility. We may need to verify account ownership before disclosing or changing personal information.
Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction of processing or object to processing based on legitimate interests. You may withdraw any separately given consent for future processing; this does not affect earlier lawful processing. You may complain to your relevant data-protection authority, including the UK ICO where applicable. No checkbox waives rights the law gives you.
Adults only
StudioHeadshot is for adults aged 18 or over. Upload only your own adult portrait. Do not upload children’s images.
Changes
We may update this policy as the service changes. The date at the top identifies the latest published version.