# AI headshot privacy and security Face photos are biometric data. Here is exactly what happens to yours - including the parts that are less flattering than a marketing page usually admits. > Canonical: https://aiheadshot.me/security Face photos are biometric data, so AI headshot privacy has teeth here: what happens to yours, including the unflattering parts. ## Four AI Headshot Privacy Commitments Each one is enforced by code, and each has a way to check it. ### Your photos never train any model Every provider in our routing must carry a reviewed training-exclusion position before it can receive an image. A provider with no reviewed position is unroutable - the guarantee is structural, not a promise. ### Uploads are deleted on a stated schedule Default 30 days after generation, or 7 if your organisation chooses. A scheduled sweep enforces it and we alert ourselves on a single overdue photo. ### You can delete them immediately One button on the shoot page erases every photo you uploaded, right away. Your finished headshots are unaffected. ### Every image is marked as AI-generated Delivered headshots carry embedded content credentials, and we measure whether that marking survived our own processing rather than assuming it did. ## How AI headshot privacy protects uploaded photos From upload to deletion. ### Encrypted in transit and at rest TLS on the way in, encrypted storage at rest. Uploaded selfies live in a private bucket prefix that is denied at the edge and never publicly addressable. ### Never publicly linkable There is deliberately no public-URL field on an uploaded photo. Internal access uses short-lived signed grants measured in minutes. ### Consent recorded against exact wording Before processing we show precisely what is collected, why, and for how long, then record your agreement against a hash of that exact text - so what you agreed to is provable years later. ### No face embeddings stored Likeness scoring compares images and keeps only a number. We never produce or persist a face vector, because a stored embedding is a stored biometric identifier. ## Compliance Posture Including where we are strong and where we are still building. ### Biometric privacy law Our consent flow is built to the standard biometric statutes expect: notice displayed rather than linked, a separate unbundled written release, a stated purpose and retention period, and an append-only record. It is enforced server-side, so it cannot be bypassed by a client. ### GDPR and CCPA We act as processor for organisation accounts; your organisation is controller. Access, export, and erasure requests are supported, and account deletion removes uploaded photo bytes rather than just database rows. ### EU AI Act Article 50 Delivered images carry machine-readable AI marking, and the shoot page discloses that images are AI-generated at first exposure. We measure marking survival per image and treat a stripped image as a defect. ### What we do not claim Frontier image models are largely US-hosted, so we do not advertise EU-only processing. We would rather state our actual region than claim coverage we cannot back - a residency promise you cannot verify is worse than an honest one you can. ## The Lifecycle of an Uploaded Photo Every stage, in order. ### Upload Sent directly to a private bucket prefix over TLS. We verify the stored object matches what was declared, because a presigned URL is not a promise about its contents. ### Check Validated for usability before any credits are spent. Rejected photos still fall under the same retention and deletion rules. ### Generate Sent once to a provider contractually excluded from training on it, used to render your headshots, and not retained by us for any other purpose. ### Delete Erased on your retention schedule, or immediately on request. Storage bytes are deleted before the record is marked purged, so a failure can never look like a success. ## Before You Upload Data minimisation starts with the customer. These four choices reduce unnecessary personal information and keep control of the account and its outputs with you. ### Upload only photos you are allowed to use Use your own image or one you have permission to process. Do not upload another person's portrait, confidential workplace material, or identity documents. ### Crop out information the model does not need A head-and-shoulders crop avoids sharing screens, badges, addresses, family members, or other background details that do not improve the result. ### Protect access to the account Use a unique password or supported social sign-in, keep recovery access current, and review active sessions before starting a sensitive team rollout. ### Delete early when you are finished The retention window is a maximum, not a requirement. Use the deletion controls as soon as you have downloaded the outputs you intend to keep. ## Operational Controls The unglamorous parts that actually matter. ### Least-privilege access Production access is scoped and logged; sensitive administrative actions are written to an append-only audit trail. ### Rate limiting Per-IP and per-account limits on upload and generation paths, with bounded concurrent private uploads per identity. ### Content moderation Inputs and generated outputs are both screened, and uploads are checked for apparent minors with a fail-closed default. ### Published subprocessors The vendors that process photos are listed, so you always know who is involved. ### Retention monitoring Overdue deletions are alerted on as incidents rather than tracked as a queue depth. ### Breach notification Affected customers are notified promptly on any confirmed personal-data breach. ## Your Photos, Your Control Face photos are biometric data. We treat them that way in the product, not just in the policy page. ### Your photos never train any AI model Uploads are used once to generate your headshots and are never used to train, fine-tune, or improve a model. No exceptions, and every provider we route to is contractually bound to the same rule. ### Automatic deletion after 30 days Uploaded selfies are permanently deleted 30 days after your headshots are generated. A scheduled sweep enforces it, and we alert ourselves if a single photo is ever overdue. ### Delete everything right now, in one click You do not have to wait for the retention window. A single button on your shoot page erases every selfie you uploaded, immediately and permanently. ### Explicit consent, recorded properly Before anything is processed we show exactly what is collected, why, and for how long, and record your consent against that precise wording - the standard biometric privacy laws expect. ### Every image is labelled as AI-generated Delivered headshots carry embedded content credentials marking them as AI-generated, so the images stay honest wherever they travel. ## AI headshot privacy questions Individuals and security reviewers ### Is it safe to upload my photos to an AI headshot generator? Whether uploading your photos is safe depends entirely on the operator, so judge AI headshot privacy against four checkable claims rather than a reassuring tone. Are your uploads contractually excluded from model training, including at every downstream provider? Is there a stated retention window, and can you trigger deletion early yourself? Is consent recorded against the specific wording you were shown, which biometric privacy law generally requires? And is a face template or embedding persisted after the shoot finishes? This page answers all four for us, in that order, and the deletion control is a button on your shoot page rather than a support request. ### Are my photos used to train AI? No. Every provider we route to must carry a reviewed training-exclusion position; one without it cannot receive an image at all. The guarantee is enforced in code rather than stated in copy. ### How long do you keep my photos? Thirty days after your headshots are generated by default, or seven if your organisation sets that. You can delete them immediately at any time, and we send a heads-up before automatic deletion. ### Can anyone else see my uploads? No. Uploads live in a private prefix that is denied at the edge and has no public URL. Internal access uses short-lived signed grants. ### Do you store a face template or embedding? No. Likeness scoring compares images and keeps only a resulting number. No face vector is produced or persisted, because that would itself be stored biometric data. ### Where is my data processed? Primarily in the United States, because the image models we route to are US-hosted. We say so plainly rather than advertising an EU-only guarantee we could not honour. ### What happens if I delete my account? Uploaded photo bytes are deleted, not just the database rows pointing at them. Storage objects are tracked in a deletion ledger from the moment they are created precisely so erasure can find them. ### Will you sign a DPA? Yes, for organisation accounts. We act as processor and your organisation remains controller. ### How do I know an image is AI-generated? Every delivered headshot carries embedded content credentials identifying it as AI-generated, and the delivery page states it plainly. We measure whether that marking survived our processing rather than assuming it did. ### How do you handle a security incident? Affected customers are notified promptly on a confirmed personal-data breach, with the scope and remediation described rather than summarised. ### Can I use what Security and Privacy makes commercially? Every paid plan includes a commercial licence for what Security and Privacy makes; the free tier is for personal use. ## Questions We Have Not Answered? Security reviewers are welcome to send a questionnaire. We would rather answer it precisely than have you guess. _Last updated July 28, 2026_