Last updated October 15, 2026
Privacy Policy
What Headshot Generator AI collects, why we collect it, and how to delete it.
1. Overview
Last updated: October 15, 2026
Headshot Generator AI is operated by Superleuk LLC. This page explains what we collect at headshot-generator.ai, why we collect it, who we share it with, and the choices you have.
We do not sell your personal information.
2. What we collect
Account and contact info. Your name and email when you sign up. Login is handled through Google, Facebook, or email OTP. We do not store raw passwords.
Payment info. Stripe processes card payments. We see billing metadata (amount, status, last four digits) but not your full card number.
Photos you upload. Source images you add to generate headshots or other AI photos.
Facial data from those photos. We analyze facial features so generations look like you. That is biometric data under EU law. We process it only after you give explicit consent when you create a model, and only to deliver the Service.
Generated images. Outputs created from your uploads and settings.
Technical logs. IP address, browser type, pages visited, and similar diagnostics.
Optional analytics. If you accept them, PostHog and DataFast collect usage and conversion data. See the Cookie Policy.
3. Legal bases (GDPR)
- Contract. Create your account, store uploads, generate images, take payment, and send login codes, receipts, and “your photos are ready” email.
- Legal obligation. Keep payment records Stripe needs for tax and accounting.
- Legitimate interest. Keep the Service secure, prevent fraud and abuse, and count cookieless page views with Plausible (p.il.ly).
- Consent. Optional analytics, promotional checkout reminders, and processing your face to generate images. You can withdraw cookie consent at any time on the Cookie Policy page. You can withdraw facial-data consent by deleting the model or your account.
4. How we use it
- Run the Service: store uploads, create your private model, and deliver generations
- Take payment and catch fraud through Stripe
- Send transactional email: receipts, login codes, finished generations, and checkout reminders only if you opted in at Stripe Checkout
- Keep the platform safe: scan for illegal content and enforce our Terms
- Measure the product, only with cookie consent
Your uploads and generations are not used to train a shared public model. The model tied to your account is yours.
5. How long we keep data
Your uploads, models, and generated photos stay until you delete them. Delete a photo, a model, or your whole account anytime in settings. That is how data leaves the product. We do not run an automatic unused-account purge.
When you delete a model, an uploaded selfie, or your account, we remove it from our live storage right away, including files in object storage. A generated photo you delete moves to Deleted for 30 days so you can restore it. Delete it there to remove it right away, or it is removed for good after 30 days. A photo you added to one of your styles stays on that style until you remove it there. Encrypted backups can keep a copy for up to 30 days.
Vendors can still have a copy we cannot wipe from your dashboard:
- Stripe keeps payment records for tax and card-network rules.
- AI hosts (OpenAI, Google, and similar) may keep a short-lived copy of a photo we sent them to generate your image, under their own retention.
Email support@headshot-generator.ai if you need help with a request those vendors control.
6. Who we share data with
We share data only with vendors needed to run the product:
- AI inference: OpenAI, OpenRouter, Google Gemini, Replicate, Fal.ai
- Hosting: Hetzner (EU servers), Google Cloud (auth)
- Payments: Stripe
- Error monitoring: Sentry
- Analytics (optional): PostHog, DataFast
- Cookieless analytics: Plausible, proxied at p.il.ly
Some vendors are in the United States. Where required, we rely on Standard Contractual Clauses or an equivalent transfer tool.
We do not sell or rent your data to brokers.
7. Cookies
Necessary cookies keep you signed in and remember this privacy choice.
If you are in the EU, EEA, or UK, analytics cookies stay off until you accept them. Elsewhere they load by default. We do not use advertising cookies. A Global Privacy Control (GPC) signal is treated as reject optional. Change this anytime at Cookie settings.
8. Safety and moderation
Illegal content is not allowed. Automated checks flag suspected CSAM; confirmed cases are reported to NCMEC and relevant authorities. NSFW uploads or generations lead to an immediate ban.
9. Your rights
If you are in the EU/EEA or UK, you can access, correct, export, delete, restrict, or object to processing of your data, and withdraw consent. You can also complain to your local data protection authority.
Use Export Data and Delete Account in settings, or email support@headshot-generator.ai.
California users: we do not sell or share personal information as defined under CCPA/CPRA. GPC is treated as an opt-out of sale/sharing.
10. Children
The Service is for adults 18+. We do not knowingly collect data from anyone under 18. If you believe a minor submitted data to us, contact support@headshot-generator.ai and we will delete it.
11. Contact
Superleuk LLC 500 Westover Dr #32164 Sanford, NC 27330 support@headshot-generator.ai