Privacy Policy

AIHeadshotInstant is an independent product built and operated by a solo developer based in mainland China. There is no company entity behind it — just one person who cares a lot about not mishandling your photos. This policy is written in plain English so you can actually tell what happens to your data.

The short version: your photos are yours, not mine. The selfies you upload are used solely to generate the headshots you requested, then deleted. I do not retain a long-term library of user photos, I do not train shared AI models on your face, and no human reviews your images.

1. What we collect

Selfies you upload. Used only as input to your generation. Held in encrypted object storage (Cloudflare R2, server-side encryption at rest) for the minimum time needed to run the job.

Generated portraits. Delivered to your account so you can download them. Stored encrypted at rest and served only over HTTPS via short-lived signed URLs.

Account data. Email address (for sign-in and receipts), billing metadata from our payment processor (we never see your card number), and basic usage logs (number of generations, timestamps, coarse error codes).

Product analytics. Page views, feature usage, and crash reports — aggregated, never tied to your uploaded images.

2. Retention — we delete by default

Uploaded selfies are deleted within 24 hours after your generation completes (or fails). They are never used for any purpose other than producing your headshots.

Generated portraits are deleted within 30 days after they appear in your account, giving you time to download them. You can delete any portrait on demand from your account dashboard at any time before then.

Per-account AI artifacts (the intermediate fine-tune used to render your portraits) are deleted on the same 24-hour cycle as the source selfies. They are private to your generation and never merged into a shared base model.

Account & billing records are retained for as long as your account is active, plus the period required by tax and accounting law (typically 7 years). Deleting your account purges everything else within 30 days.

3. How we use your data

Selfies are used only to generate the portraits you requested. We do not use your photos to train, fine-tune, or improve any shared AI model. We do not sell or rent your data. We do not share your images with advertisers.

4. Who can see your photos

No human at AIHeadshotInstant routinely reviews uploaded selfies or generated portraits. Access is restricted to automated systems executing your generation. The narrow exceptions are: (a) you explicitly send us a photo while reporting a bug, or (b) we are compelled to disclose specific data by a valid legal order.

5. Infrastructure providers

As a solo developer I rely on standard infrastructure providers to run the service: Cloudflare (hosting, storage, CDN, anti-bot challenge via Turnstile, and traffic analytics), the payment processor (Creem), Resend (transactional email and magic-link sign-in delivery), Google (optional OAuth sign-in), the Auth.js library (session management, cookies prefixed with__Secure-authjs.), and the upstream AI model provider that performs the actual image generation. Each receives only the data strictly required to do its job, governed by its own published privacy and security terms. I do not have private side agreements with them.

6. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Portrait delivery uses short-lived signed URLs that expire within minutes. Access to production systems is restricted, logged, and gated by multi-factor authentication.

7. Your rights

Depending on where you live — the EU/UK (GDPR), California (CCPA), mainland China (PIPL), and most other jurisdictions with modern data laws — you have the right to access, correct, export, or delete your personal data, and to object to processing. You can exercise most of these rights directly from your account dashboard (delete any portrait, delete your account). For anything the dashboard does not cover, email support@aiheadshotinstant.com. I respond within 30 days.

8. Children

AIHeadshotInstant is not directed to children under 16. I do not knowingly accept uploads of minors. If you believe a minor has uploaded a photo, email me and I will delete the data and the account immediately.

9. Changes

Any material change to this policy will be posted on this page and, for active accounts, sent by email at least 14 days before it takes effect.

10. Contact

Privacy or data questions: support@aiheadshotinstant.com. There is one person reading this inbox, so please be patient — I aim to reply within 1–2 business days.