Privacy Policy

We collect the following categories of information:

Account information

Your email address when you create an account. We use this to authenticate you, deliver your headshots, and send order-related communications.

Photos you upload

The images you provide as reference photos for AI headshot generation. These photos contain your likeness and may include biometric data (facial geometry). We use these photos solely to generate your headshots and for no other purpose.

Payment information

We process payments through Stripe, our payment processor. Your credit card number, billing address, and other payment details are collected and processed directly by Stripe. We do not store your full credit card number on our servers. We receive only a transaction confirmation and the last four digits of your card for your order history.

Usage data

Basic information about how you interact with our service, including device type, browser type, pages visited, and referring URL. We use this to improve our service and troubleshoot issues.

We use the information we collect to:

• Generate AI-powered professional headshots based on your uploaded reference photos.
• Process your payments and deliver your completed headshots.
• Send you order confirmations and notifications when your headshots are ready.
• Provide customer support and respond to your inquiries.
• Maintain and improve the reliability and performance of our service.
• Comply with legal obligations and protect against fraud.

We do not use your photos to train any general-purpose AI model.

Your photos are used exclusively to generate your specific headshots in the current session. They are not added to any training dataset, not used to improve AI models for other users, and not used for any purpose beyond fulfilling your order.

We use the following third-party services to operate Aha! Headshots:

Supabase (data storage)

Your account data, uploaded photos, and generated headshots are stored on Supabase's infrastructure in the United States. Supabase acts as our data processor and handles your data according to their data processing agreement. Supabase does not access or use your data for their own purposes.

Google Gemini API (image generation)

To generate your headshots, we send your uploaded reference photos to Google's Gemini API along with a text prompt describing the desired output. Google processes these images solely to generate the requested headshot and returns the result to us. Images are processed through the Google Gemini API and handled according to Google's API data retention policies.

Stripe (payment processing)

Payment transactions are processed by Stripe. Your payment information is handled directly by Stripe in accordance with PCI-DSS standards. We do not have access to your full card details.

Resend (email delivery)

We use Resend to send transactional emails such as order confirmations and "headshots ready" notifications. Resend receives only your email address and the content of the email.

Uploaded reference photos

Photos you upload to generate headshots are automatically deleted from our active systems within 30 days of upload and removed from backups according to our standard backup retention cycles. You may delete them earlier at any time through your account settings.

Generated headshots

Generated headshots remain available in your account until you choose to delete them. You may download or delete your generated headshots at any time.

Account deletion

If you delete your account, all associated data — including uploaded photos, generated headshots, and order history — will be permanently deleted.

Account information

Your account information (email address) is retained as long as your account is active.

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: You can request details about the personal information we have collected about you and how we use it.
• Right to delete: You can request deletion of your personal information. You can do this directly through your account or by contacting us.
• Right to opt out of sale: We do not sell your personal information to third parties.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request correction of any inaccurate data.
• Right to erasure: You can request deletion of your data. Use the delete function in your account or contact us.
• Right to restrict processing: You can request that we limit how we use your data.
• Right to data portability: You can request your data in a machine-readable format.
• Right to withdraw consent: You can withdraw consent at any time by deleting your uploads and data through your account.

Our legal basis for processing your data is your explicit consent (provided when you upload photos and agree to our terms) and our legitimate interest in fulfilling your order.

Please note that your data is stored and processed in the United States. By using our service, you consent to the transfer of your data to the United States.

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Secure authentication through Supabase Auth.
• Access controls limiting who can access your stored photos and data.
• Regular security reviews of our infrastructure and dependencies.

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will notify you promptly in the event of a data breach affecting your personal information.

Aha! Headshots is not intended for use by anyone under the age of 18. We do not knowingly collect personal information or biometric data from children. If you are under 18, please do not use this service or upload any photos. If we learn that we have collected data from a child under 18, we will delete that data immediately. If you believe a child has used our service, please contact us at privacy@ahaheadshots.com.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of Aha! Headshots after any changes constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy, your data, or your rights, contact us at:

Aha Concepts LLC
Email: privacy@ahaheadshots.com

For biometric data inquiries specifically, please include "Biometric Data Request" in your subject line and we will respond within 30 days.