Privacy policy
Your face is personal. We collect as little as possible, use it only to make your headshots, and delete it automatically.
The short version
01Who we are
HeadshotFirst is operated by the operator of HeadshotFirst ("we", "us"). We are the data controller for the personal data described here. Contact: support@headshotfirst.com.
02What we collect
The selfies you upload, your email address, the style choices you make, your feedback on previews, and basic order details such as date, amount paid and payment status.
When you upload, we record that you confirmed you are 18 or older and that the photos are of you, together with the time, a one-way hashed version of your IP address and your browser user agent. This is our evidence of your consent.
Technical data: hashed IP addresses for abuse prevention and rate limiting, and cookies described below. We remove location data (EXIF) from your photos when you upload them.
03How we use it and why (legal bases)
To generate your previews and headshots and deliver them to you, and to send you your preview and download links (performance of our contract with you).
To prevent fraud and abuse, keep the service secure and enforce free-preview limits (our legitimate interests).
To measure our advertising with the Meta Pixel and Conversions API — only if you accept marketing cookies (your consent, which you can withdraw at any time).
To keep accounting and tax records of purchases (legal obligation).
We do not use your photos to identify you, we do not create face-recognition templates, and we do not use your photos or headshots to train AI models. We do not sell your personal data.
04Storage and deletion
Files are stored in private, encrypted storage while your order is active. Selfies, previews and final headshots are permanently deleted 7 days after your headshots are delivered. If you do not purchase, they are deleted 24 hours after upload. After a refund, they are deleted immediately.
You can delete your photos sooner at any time with the "Delete my photos now" link on your download page, or by emailing us.
We keep a minimal order record (order number, email, amount, dates and consent record) for as long as tax and consumer-protection law requires. For orders that were never paid, we remove the email address when the photos are deleted.
05Who processes your data
Google (Gemini API) generates and checks images on our behalf under the paid API terms, which do not allow Google to use the content to train its models.
Supabase hosts our database and private file storage. Vercel hosts the website and runs our servers. Resend delivers our emails. Lemon Squeezy processes payments as merchant of record and handles taxes and invoices; we pass it your email address to pre-fill the checkout, and it collects your payment details directly.
Meta Platforms receives advertising measurement events (such as page views and purchases, with your email address hashed) only if you accept marketing cookies.
Some of these providers process data in the United States. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards.
07Your rights
UK and EU residents (UK GDPR / GDPR): you can request access to, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent at any time. You can also complain to your data protection authority (in the UK, the ICO).
California residents (CCPA/CPRA): you can request to know, delete or correct your personal information and opt out of "sharing" for cross-context behavioral advertising by rejecting marketing cookies or sending a Global Privacy Control signal. We do not sell personal information and we do not use sensitive personal information to infer characteristics about you.
Residents of other places (including Canada and Australia) have similar rights. Email support@headshotfirst.com — we respond within 30 days and never charge for a request.
08Age requirement
HeadshotFirst is only for people 18 and older. We do not knowingly process photos of minors and we reject photos that appear to show a minor.
09Changes
If we change this policy, we will update the date at the top of this page. Material changes apply to new orders only.