Privacy

WorkHeadshot runs https://workheadshot.com. For privacy questions, write to privacy@workheadshot.com. We are the controller of the personal data described on this page, except for the billing details you enter on the checkout page. Dodo Payments handles that checkout as seller of record.

This notice covers the English and German versions of the site. It is written for the GDPR and the UK GDPR.

Depending on what you do on the site, we use:

• A random session id in a cookie named wh_session, so this browser can keep your headshot balance, plan, and saved headshots.
• Your email address, if you sign in, or if a successful payment returns it.
• The photo you upload, the look and light you pick, and any short note you type about clothes or the portrait.
• The finished headshot, the look name, and the time it was made.
• A payment reference and the plan. We do not receive or store your card number.
• Sign-in links, stored only as a hash. A link expires after 15 minutes and works once.
• IP address and basic request data that our host processes to deliver the site and block abuse.

We use the photo to make the headshot you asked for. The photo and the edit instruction are sent to Replicate, which runs the image model. We do not keep the upload as its own file after that request, and we do not put it in a public gallery.

We do not use your photo to train a model of our own, and we do not use it to recognize you among other people. A face in a portrait is personal data. We treat it as the source of an edit you requested, not as a biometric identification system.

The finished headshot is saved on your account so you can download it again. Only the browser, or the email account, that owns it can open it.

A text instruction may be sent to OpenAI so the look, light, clothes, and your note can be phrased clearly for the image model. Your photo is not included in that text.

The cookie is named wh_session. It is first-party, httpOnly, and SameSite=Lax. On the live site it is sent only over HTTPS. It lasts 180 days. It holds a random id, not your name. We set it when you browse the site, open your account, check your balance, start checkout, or make a headshot.

If you sign in, we email a one-time link from noreply@workheadshot.com and keep the balance with that email address. There is no password. The link in the email is not stored in plain text.

What is stored on your device is listed in the cookie policy.

Checkout, tax, and invoices are handled by Dodo Payments, the seller of record. You enter billing details on their page. We use the payment result only to add the headshots from the plan you bought to your account.

We record a short event on the session id when you visit a page, open the studio, choose a photo, start or leave checkout, and when a payment or a headshot succeeds or fails. We use that to see how many people use the site and where the path to a paid headshot stops. The legal basis is legitimate interests (Article 6(1)(f) GDPR). It is not advertising, and we do not sell it. You can object from the GDPR page.

If you use the contact form, we keep your name, email, and message so we can reply and review it in the admin panel. If you ask the on-site assistant, we keep the question and the answer on the same session. The legal basis is the contract when the question is about a purchase, and legitimate interests for other support questions. Write to us if you want that record deleted.

We use personal data for these reasons:

• To make the headshot, keep your account, and send the sign-in link. The legal basis is the contract (Article 6(1)(b) GDPR).
• The session cookie is necessary for that service. We do not treat it as an optional advertising cookie.
• To count visits and the steps from the studio to checkout and a finished headshot. The legal basis is legitimate interests (Article 6(1)(f) GDPR). This is not an advertising profile.
• To keep the site available and resist abuse. The legal basis is legitimate interests (Article 6(1)(f) GDPR). You can object, as described on the GDPR page.
• We do not use your data for advertising profiles, and we do not sell it.

We use these providers. They receive only what they need for the job described.

• Cloudflare hosts the site, stores account records and headshot files, sends the sign-in email, and protects the site. The database and the headshot files for this site are stored in the Asia-Pacific region.
• Replicate receives the uploaded photo and the edit instruction to produce the headshot.
• OpenAI may receive the text instruction only. It does not receive the photo.
• Dodo Payments receives the details you enter at checkout and is a separate controller for that payment data.

These providers can process data outside the European Economic Area and the United Kingdom, including in the United States and in the Asia-Pacific region where we store account records and files.

Where the law requires a safeguard for that transfer, we use the safeguard the provider makes available, such as Standard Contractual Clauses or, where it applies, the EU-US Data Privacy Framework.

The cookie lasts 180 days unless you delete it sooner. Sign-in links expire after 15 minutes. Older unused sign-in records for the same email are removed after a day.

We keep the account, the balance, the email, and the saved headshots until you ask us to delete them, or until we no longer need them to provide the service. Payment and invoice records stay with Dodo Payments for the period the law requires of them. We do not keep your card number.

If the GDPR or the UK GDPR applies to you, you can ask for a copy of your data, a correction, deletion, restriction, or a portable copy where that right applies. You can object to processing based on legitimate interests. You can also complain to a data protection authority. In the EEA, that is usually the authority where you live or work. In the UK, it is the Information Commissioner's Office.

How to send a request, and what we delete, is on the GDPR page. Write to privacy@workheadshot.com. We reply within one month.

We do not make a decision that produces a legal effect about you, or a similar significant effect, solely by automated means. A headshot is an image edit you requested. It is not a decision about hiring, credit, or anything similar.

WorkHeadshot is for people who are old enough to enter a contract where they live. It is not directed at children under 16. If you believe we have data about a child under 16, write to us and we will delete it.

The session cookie cannot be read by scripts on the page. Saved headshots are served only to the account that owns them. The live site is served over HTTPS.

When this notice changes, we update the date at the top. The paid service is covered by the terms. Device storage is covered by the cookie policy. Write to privacy@workheadshot.com.