Privacy Policy

1. Scope & Applicability

This Privacy Policy applies to all users of proheadshotphotos.com and any associated services (collectively, the “Service”). It governs the collection, use, storage, and disclosure of personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian laws.

By accessing the Service or uploading photographs, you confirm that you have read, understood, and freely consent to the practices described in this Policy.

2. Data We Collect

2.1 Account Information

• Full name and email address (provided during registration or sign-in).
• Authentication tokens issued by our identity provider.

2.2 Photographs & Biometric Data

When you upload selfies for headshot generation, you provide facial photographs. Under the DPDP Act 2023, facial imagery that can be used to identify an individual may constitute sensitive personal data. We treat all uploaded photographs as sensitive personal data and apply the safeguards described below.

2.3 Generated Headshots

The AI-generated professional headshots produced by our Service are stored on your behalf for download.

2.4 Payment Data

Payments are processed by Razorpay. We receive only a transaction confirmation and order reference. We do not store card numbers, bank account details, or UPI credentials on our systems.

2.5 Usage & Technical Data

• IP address, browser type and version, operating system.
• Pages visited, time spent, referring URL.
• Error logs and performance metrics (anonymised where possible).

3. Legal Basis for Processing

We process your personal data on the basis of explicit, informed consent, which you provide by:

• Creating an account and accepting these terms.
• Uploading photographs for AI headshot generation.

You may withdraw consent at any time by requesting account deletion (see Section 7). Withdrawal does not affect the lawfulness of processing before withdrawal.

4. How We Use Your Data

• To generate AI professional headshots from your uploaded photographs.
• To deliver, maintain, and improve the Service.
• To send transactional emails (order confirmation, delivery notification).
• To prevent fraud and ensure platform security.
• To comply with legal obligations.

We do not sell your personal data. We do not use your photographs to train our AI models after your generation is complete. We do not use your data for targeted advertising.

5. Biometric Data Safeguards

Your uploaded selfies are processed exclusively to generate your headshots and for no other purpose. Specific safeguards include:

• Photographs are transmitted over encrypted connections (TLS 1.2+).
• Access to raw photographs is restricted to the generation pipeline; no human reviews them in the ordinary course of business.
• Photographs are not shared with third parties except as strictly necessary for generation (our AI inference provider) under data processing agreements.
• Original selfies are permanently and irreversibly deleted within 7 days of headshot generation, regardless of whether you download your results.

6. Data Retention

• Uploaded selfies: Deleted within 7 days of generation completion.
• Generated headshots: Stored for 30 days from generation date, then automatically and permanently deleted. We recommend downloading your headshots promptly.
• Account data: Retained while your account is active. Deleted within 30 days of account closure upon request.
• Transaction records: Retained for 7 years as required by Indian accounting and tax law.

7. Your Rights under the DPDP Act 2023

As a data principal under the DPDP Act 2023, you have the right to:

• Access: Obtain a summary of the personal data we hold about you and how it has been processed.
• Correction & Completeness: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data. We will comply within 30 days except where retention is required by law.
• Grievance Redressal: File a complaint with our Grievance Officer (see Section 10). If unresolved, you may approach the Data Protection Board of India.
• Nomination: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email us at privacy@proheadshotphotos.com.

8. International Data Transfers

Our Service infrastructure is hosted in the United States (Vercel, Supabase) and may involve AI inference providers outside India. By using the Service, you consent to the transfer of your data to these jurisdictions. We require all processors to maintain data security standards at least equivalent to those required under Indian law.

9. Children’s Privacy

The Service is intended for individuals aged 18 years and above. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately at privacy@proheadshotphotos.com and we will delete it promptly.

10. Grievance Officer & Contact

In accordance with the DPDP Act 2023, we have designated a Grievance Officer to address your data-related concerns:

• Email: privacy@proheadshotphotos.com
• Response time: We acknowledge grievances within 48 hours and resolve them within 30 days.

11. Cookies

We use essential cookies required for authentication and session management. We use anonymised analytics cookies to understand aggregate usage patterns. You may disable cookies in your browser settings; doing so may limit certain Service functionality.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service at least 15 days before taking effect. Continued use of the Service after such notice constitutes acceptance of the revised Policy.