Legal

Privacy Policy

Last updated: 11 November 2026

PortraitLab generates AI headshots from photographs you upload. Because those photographs contain faces, this policy is written to be specific about what happens to them rather than to hide behind generic language. If anything here is unclear, email us and we will answer in plain language.

1. Who we are

PortraitLab operates the AI headshot generator at https://headshotsnap.com. We are the data controller for the personal data described in this policy. Contact: support@headshotsnap.com.

2. What we collect

Photos you upload. Three to eight selfies per order, plus any files you re-upload after a quality-gate rejection.
Order details. Package purchased, style preset, order identifier, timestamps and status.
Email address. Used to send the delivery link, order receipts and, if you opt in, product updates. Unsubscribe is one click.
Payment data. Handled entirely by our merchant of record. We receive a confirmation and the last four digits; we never see or store full card numbers.
Technical data. IP address, browser and device information, and server logs used for fraud prevention and debugging.
Cookies. A small number of essential cookies for session and fraud prevention. Analytics, if enabled, is aggregate and does not include your photos.

3. How we use your data

To render your order: the photos are passed to the generation pipeline and the results returned to you.
To deliver files: storing the outputs so you can download them and re-download them for 30 days.
To process payment and issue receipts, via the merchant of record.
To handle redo and refund requests.
To prevent abuse, including attempts to generate images of other people or public figures.

We do not use your photos to train models. We do not sell them, publish them, or use them in marketing material. We do not create a face template that persists after your order is deleted.

4. Legal bases (EEA/UK visitors)

We rely on contract necessity to process your photos and order data in order to deliver what you purchased; on legitimate interests for fraud prevention and service security; on consent for optional marketing emails; and on legal obligation for tax and accounting records.

5. Photo and face data — the short version

Photos are used only for the order they were uploaded for.
They are not used for model training, fine-tuning or benchmark datasets.
Originals and generated outputs are deleted from storage 30 days after delivery.
Earlier deletion is available on request at any time from your order email.
We refuse orders for photos of public figures, photos of minors, and photos uploaded by someone who is not the person in them (or does not have that person's permission).

6. Processors we share data with

We use a small number of vendors, each for a specific job:

Inference providers (fal and Replicate) receive the uploaded photos and prompts in order to generate and merge the images. Both are contracted for commercial use of the models we call.
Object storage (Cloudflare R2) holds uploaded photos and generated files for the 30-day window.
Merchant of record (Waffo) processes payment and stores billing data under its own privacy policy.
Email delivery (Resend) sends order and delivery emails.
Anti-abuse (Cloudflare Turnstile) distinguishes humans from bots at upload time.

We do not share photos with advertising networks or data brokers, and we do not permit any processor to use your photos for its own model training.

7. International transfers

Our providers operate in the United States and the European Union. Where data leaves your region we rely on standard contractual clauses or an equivalent transfer mechanism offered by the processor.

8. Retention

Photos and generated files: deleted 30 days after delivery, or earlier on request.
Order records (order ID, email, amount, package): retained for accounting and tax purposes.
Server logs: retained for a short operational window for security and debugging.
Marketing email subscription: until you unsubscribe.

9. Your rights

Depending on where you live you may have the right to access, correct, export or delete your data, to object to certain processing, and to withdraw consent for marketing. To exercise any of them, email support@headshotsnap.com with the order identifier. We respond within 30 days and do not charge for the first request. If you are in the EEA or UK you also have the right to complain to your local data protection authority.

10. Security

Uploads travel over TLS, files are stored in private buckets with time-limited access links, and access to production systems is restricted to the small number of people who operate the service. No online service can promise perfect security; we can promise that photo data is not used for anything other than delivering your order.

11. Children

The service is for adults. We do not knowingly process photos of anyone under 18 and will refuse and delete any order that appears to involve a minor.

12. Changes

If this policy changes materially — for example a new processor or a different retention period — we will update this page and the date at the top. Continued use after a change means you accept the updated policy.