# Privacy Policy

**Last Updated: 16 October 2026**

## Summary

> - Source photos are deleted 7 days after delivery.
> - Your gallery and private model are deleted 30 days after delivery.
> - We do not sell facial data.
> - We do not train a public or shared Smart Headshots AI model on your photos.
> - Your photos are processed by the named AI and infrastructure providers listed in section 7.
> - You can request earlier deletion from your dashboard.
>
> The full policy below controls if anything differs.

This Privacy Policy explains how CodeBucks, a sole proprietorship operating **Smart Headshots AI** ("Smart Headshots AI", "we", "us", or "our"), collects, uses, discloses, and retains personal information when you use our website and AI headshot service (the "Service").

CodeBucks operates from Gujarat, India. For privacy questions or requests, contact [support@smartheadshots.ai](mailto:support@smartheadshots.ai). Our privacy contact is [support@smartheadshots.ai](mailto:support@smartheadshots.ai).

## 1. Scope and our role

This policy applies to visitors, account holders, and customers of the Service. The Service is intended only for adults: you must be at least 18 to create an account, place an order or use headshot generation, and you must not provide us with a photograph of anyone under 18 for that purpose. Section 17 describes the free tools in ChatGPT and other MCP Apps hosts, which are suitable for general audiences.

For applicable privacy laws, CodeBucks is the controller or data fiduciary for the personal information described in this policy. Some providers may act as independent controllers for their own purposes. In particular, Dodo Payments acts as merchant of record and processes payment, tax, fraud, invoice, dispute, and refund information under its own terms and privacy notice. Google separately processes information when you choose Google sign-in.

## 2. Information we collect

### Information you provide

- **Account information:** your name, email address, account identifiers, email-verification status, and optional Google profile image. We currently use email codes and optional Google sign-in rather than password sign-in.
- **Order information:** your selected headshot pack and tier, order and checkout identifiers, amount, currency, tax, payment status, customer and invoice references, and refund information. We do not receive or store your complete payment-card number through Dodo Payments' hosted checkout.
- **Photos and file information:** source photographs, original filename, file type, file size, dimensions, and technical values used to manage duplicates and validation.
- **Headshot preferences:** information you select for the requested result, including age range, gender presentation, attire, backdrops, pack, and style preferences.
- **Generated and derived information:** suitability-screening results, rejection reasons, training captions, generation prompts, a private session-specific model, generated headshots, generation status or error information, and embedded IPTC/XMP metadata identifying delivered headshots as AI generated and crediting Smart Headshots AI.
- **Support and feedback:** the contents of messages you send, your account details, and relevant order or session context needed to answer you.
- **Welcome discount requests:** if you ask for a discount code on our website, the email address you enter, the code issued to it, when it was issued and when it expires, and whether it has been used. We use this only to email you that code, to send it again if you ask for it again, and to apply it when you check out with the same email address. We do not add the address to a newsletter or send further marketing email to it.

### Information collected automatically

When you use the Service, we or our service providers may collect:

- IP address, browser and device information, user agent, timestamps, request logs, and security events;
- authentication tokens, session identifiers, essential cookies, and draft-session identifiers;
- progress through the checkout, upload, training, generation, and delivery flow;
- rate-limit identifiers and counters used to prevent abuse; and
- technical error and performance information needed to operate and secure the Service.

We do not use advertising pixels, session replay, or behavioural or retargeting advertising. Only if you consent, we measure whether our Google ads lead to purchases. We do this from our servers, as described in the next subsection.

### Google Ads purchase measurement (only with your consent)

Our cookie banner asks whether you allow ad measurement. Whichever you choose, accept or reject, we store your choice, when you made it, and the version of the consent text you saw (your consent record) in the strictly necessary `sh_consent` cookie for 12 months, so the banner does not ask you again. Only if you choose Accept, or later switch on ad measurement in "Cookie settings", do we capture an ad click identifier and report purchases to Google Ads. If you reject or ignore the banner, we do neither.

If you accept, we collect:

- **Ad click identifier:** if you reached our website by clicking one of our Google ads, the click identifier Google adds to that link (called gclid, gbraid, or wbraid) and the time we captured it. It is kept in the `sh_ad_click` cookie in your browser for up to 90 days.
- **Purchase facts:** when you open checkout, we attach the click identifier and your consent record to that checkout with Dodo Payments, based on your choice at that moment. If you buy the headshot order, they are saved with your order record, and we then send Google Ads the click identifier, the order ID (the Dodo Payments payment ID), the order value excluding tax, the currency, and the time of the purchase.

These reports never include your email address, name, photographs, postal or billing address, or any other account or order details. We do not load a Google tag or other advertising scripts on our website; the reports go directly from our servers to Google. Each report tells Google that you did not consent to personalised advertising. If an order is refunded, we update the value reported to Google to reflect the refund (zero for a full refund). Team credit purchases are not reported.

Google processes the information it receives as described in [Google's Privacy Policy](https://policies.google.com/privacy) and in [How Google uses information from sites or apps that use our services](https://policies.google.com/technologies/partner-sites).

### Information from other services

If you choose Google sign-in, we receive the basic profile information you authorise, normally your name, email address, profile image, and provider account identifier. We do not request access to Gmail, Google Drive, or unrelated Google account content.

Dodo Payments provides us with transaction status, amount, currency, tax, customer and invoice references, dispute events, and refund events necessary to reconcile your order.

## 3. Facial images and automated photo screening

The Service automatically reviews uploaded photos for basic suitability. This may include whether exactly one face is visible, whether the subject appears to be an adult, and whether framing, distance, angle, lighting, blur, glasses, or obstruction may prevent a usable result. A photo may be rejected automatically, but you can try another photo or contact us for assistance.

Photographs and models derived from them may reveal facial features and may be treated as sensitive or biometric information in some jurisdictions. We process this information to provide the headshot service you requested. The Service is not designed to verify your legal identity, authenticate you, identify you in a database, infer emotions, or make employment, credit, housing, insurance, healthcare, or other high-impact decisions.

You must be the adult shown in the photographs or have that adult's informed, express permission to submit and process their likeness. Do not upload photographs of minors.

We do not sell, lease, trade, license, or disclose facial data in exchange for value. We charge for providing the requested headshot service, not for selling or licensing facial data. We do not create a facial-recognition or identity database.

## 4. How we use information

We use personal information to:

- create, authenticate, and secure your account;
- preserve an unfinished draft and help you resume it;
- screen uploaded photographs for suitability;
- prepare training captions, create a private session-specific model, generate headshots, and deliver your gallery;
- process and reconcile payments, taxes, invoices, disputes, reruns, and refunds;
- provide customer support and respond to privacy or account requests;
- send service communications, including sign-in codes, draft-recovery reminders, order confirmations, a reminder to add photos to a paid order, gallery notices, expiry reminders, and account-deletion notices;
- send a discount code you request on our website, and apply it at checkout when you use the same email address;
- only with your consent, measure whether our Google ads lead to purchases, so we can judge which ads work and where to spend our advertising budget (see "Google Ads purchase measurement" in section 2);
- prevent fraud, misuse, security incidents, and violations of our Terms;
- troubleshoot and improve the reliability and safety of the Service;
- establish, exercise, or defend legal claims; and
- comply with legal, tax, accounting, regulatory, and law-enforcement obligations.

We do not use your photographs in public advertising, testimonials, or marketing materials without separate permission.

We do not run a newsletter. When you ask for a discount code, we email you that code, and we only send it again if you ask for it again. We do not use the address to send you a newsletter or any other marketing email.

## 5. AI processing and model training

Providing the Service requires specialised AI service providers. These providers process your source photographs and limited order details to screen photo suitability, prepare generation instructions, train a private model used only for your session, and generate your ordered headshots. Source photographs are not sent to our text-model provider.

As between you and CodeBucks, we do not use your source photographs, generated headshots, or private session model to train a public or shared Smart Headshots AI model. Providers process data under their applicable contracts, privacy notices, model terms, and configured service settings. Their limited security, abuse-prevention, operational, or legal retention may differ from our product-retention schedule.

### Provider terms

Our AI providers are listed in section 7 and process your data under their standard published terms, privacy notices, and configured service settings; we have no negotiated agreements beyond those published terms. Where a provider's published terms state that customer content is not used to train its models, we rely on that commitment, and some providers may retain data for a limited security or abuse-monitoring period. If a provider's published commitments materially change, we will update this section.

## 6. Legal bases

Where the GDPR, UK GDPR, or a similar law applies, we rely on one or more of the following legal bases:

- **Contract:** to create an account, process an order, screen photographs, generate and deliver headshots, and provide support.
- **Legitimate interests:** to prevent fraud and abuse, protect accounts and infrastructure, troubleshoot failures, enforce our Terms, and improve reliability, where those interests are not overridden by your rights.
- **Consent:** where applicable law requires consent, including for particular facial, biometric, or sensitive-information processing or optional activities.
- **Your request for a discount code:** we process the email address you enter to send you the code you asked for and to apply it at checkout. We rely on the consent you give by submitting the request and, because the code is only used towards a purchase, on steps taken at your request before entering into a contract. You can withdraw your consent at any time by contacting us, and we will delete an unused discount record.
- **Ad measurement:** we capture the Google Ads click identifier and report purchases to Google Ads only on the basis of your consent (Article 6(1)(a) GDPR). Storing the `sh_ad_click` cookie on your device and reading it also require your consent under the ePrivacy rules, including §25(1) TDDDG in Germany and Article 22.2 LSSI-CE in Spain. You can withdraw this consent at any time in "Cookie settings"; section 11 explains which orders this covers. Withdrawal does not affect processing carried out before it, and refusing or withdrawing has no effect on your use of the Service.
- **Legal obligation:** to comply with tax, accounting, regulatory, court, law-enforcement, and other legal requirements.

Where processing is based on consent, you may withdraw that consent by contacting us or, for ad measurement, in "Cookie settings". Withdrawal does not affect earlier lawful processing. Withdrawing some consents may prevent us from completing the Service; withdrawing consent to ad measurement does not.

## 7. How we disclose information

We disclose information only as reasonably necessary to operate the Service, complete transactions, comply with law, or protect rights and safety. Providers currently include:

- **Vercel:** hosting, deployment, and workflows;
- **Neon:** managed PostgreSQL database infrastructure;
- **Cloudflare:** R2 object storage and Image Transformations for image delivery;
- **Replicate:** AI image processing;
- **Google and Anthropic:** AI-model processing;
- **Dodo Payments:** merchant-of-record checkout, payment processing, tax, invoicing, fraud controls, disputes, and refunds;
- **Resend:** transactional and service email, including a discount code you request;
- **Upstash:** rate limiting and abuse prevention;
- **Google:** optional Google sign-in; and
- **Google Ireland Limited (Google Ads):** measurement of purchases that follow a click on one of our Google ads, only with your consent (see section 2). Google may act as an independent controller for its own processing of this information.

We may also disclose information:

- to professional advisers, insurers, auditors, or contractors bound by appropriate duties;
- when required by law, court order, or valid legal process;
- to investigate fraud, security issues, prohibited conduct, or disputed transactions;
- to protect CodeBucks, our users, or the public; or
- in connection with a financing, restructuring, merger, acquisition, or sale of all or part of the business, subject to applicable law.

We do not sell personal information. Only with your consent, we share limited purchase measurement data with Google for ad measurement, which some US state privacy laws may treat as "sharing" for advertising. You can withdraw that consent at any time in "Cookie settings", and we honour that choice.

## 8. Team accounts

A team is a group of accounts that shares prepaid credits bought by the team owner. Where a team pays for a member's session, that member still holds their own account, gives their own consent before uploading, and remains the person whose personal information the session concerns. We treat the buyer as our customer for the purchase and the member as the person whose information we process to deliver the session.

The team owner and team administrators can see the team's membership, which members have used a credit, the progress of each member's session, and the generated headshots delivered to those members, including a download of those headshots. They cannot see or download the photographs a member uploaded, and they cannot see a member's other sessions. Disclosing a member's delivered headshots to the team in this way is necessary to provide the team service the credits were bought for.

Generated headshots delivered to a member stay in that member's own account, subject to the retention periods in section 10, whether or not the member remains part of the team and whether or not the team is later deleted. If an administrator returns a member's credit to the team, that member's generated gallery and private session model are deleted at that point.

Information about a team, such as its name, its membership, its credit balance, and its purchase records, is visible to the team owner and administrators and is retained while the team exists and afterwards only as described in section 10.

## 9. International processing

We operate from India and use providers that may process information in India, the United States, Europe, Australia, and other countries. Those countries may have privacy laws different from the laws where you live.

Where required, we rely on lawful transfer mechanisms and contractual safeguards made available by our providers, such as data-processing agreements and standard contractual clauses. Contact us if you want further information relevant to a particular transfer.

If you consent to ad measurement, Google may process the information described in section 2 in the United States. For those transfers, we rely on the certification of Google LLC under the EU-U.S. Data Privacy Framework and, where applicable, on the standard contractual clauses included in Google's data protection terms.

## 10. Retention and deletion

We retain information only as long as reasonably needed for the purposes described here, unless a longer period is required or permitted by law.

- **Rejected or cancelled uploads:** staging copies are scheduled for deletion after validation or cancellation is finalised.
- **Unfinished drafts:** a draft session and its uploaded photographs are deleted after 30 days of inactivity. The browser credential used to resume a draft normally expires earlier.
- **Photos added to a paid order:** kept while the order waits for you to submit them. They are deleted when the order is refunded, or when it expires 12 months after payment if you never submit them. After submission, the schedule for delivered source photographs below applies (7 days after delivery).
- **Delivered source photographs and training archive:** deleted 7 days after delivery.
- **Generated gallery and private session model:** deleted 30 days after delivery.
- **Early deletion:** where the dashboard offers it, you can delete delivered source photographs or a gallery earlier. Deleting any source photograph early closes the contractual rerun and refund guarantee for that session because we can no longer compare the result with the complete source set. It does not remove rights that cannot lawfully be limited.
- **Account deletion:** an account-deletion request starts a 30-day grace period during which you can cancel the request. After that period, the account and associated application data are scheduled for deletion.
- **Welcome discount records:** a discount code record and the email address it was sent to are kept until the code expires and then for a limited period after the code expires, so we can answer questions about it and prevent misuse, after which they are deleted. They are also deleted when an account with that email address is deleted at the end of the account-deletion grace period. You can ask us to delete them earlier as described in section 11. If you used the code, the discount applied to your order forms part of your order information and follows the retention for transaction records.
- **Ad measurement:** the `sh_ad_click` cookie expires 90 days after the click is captured and the `sh_consent` cookie 12 months after you make your choice. Rejecting ad measurement or withdrawing your consent deletes `sh_ad_click` from your browser at once, and clearing your browser's cookies deletes both. If you buy, the click identifier and consent record saved with your order record are kept for as long as that order record is kept. Google keeps the information it receives under its own policies.
- **Transaction, security, support, and legal records:** Dodo Payments, other providers, or CodeBucks may retain limited records for tax, accounting, fraud prevention, security, chargebacks, legal compliance, or legal claims for the period permitted or required by law.

Deletion from active application storage may not immediately remove information from provider logs, legally required records, backups, or temporary delivery caches. Cloudflare-transformed image variants may remain cached for up to approximately one day. Residual copies are not used for a new purpose.

## 11. Your choices and rights

Depending on where you live, you may have rights to:

- request access to personal information we hold about you;
- request correction, completion, or updating of inaccurate information;
- request deletion of information;
- receive a portable copy of information you provided, where applicable;
- object to or request restriction of certain processing;
- withdraw consent where processing is based on consent;
- ask for assistance or human review following an automated photo rejection;
- nominate another person to exercise rights where applicable under Indian law; and
- complain to a privacy or data-protection regulator.

Email [support@smartheadshots.ai](mailto:support@smartheadshots.ai) from the address associated with your account to exercise a right. We may ask for information reasonably necessary to verify your identity and protect the account. We will respond within the period required by applicable law.

**Cookie settings:** you can accept or reject ad measurement in the cookie banner, and change your choice at any time through the "Cookie settings" link in the footer of our website or in the privacy settings of your dashboard. Rejecting or withdrawing your consent has no effect on your use of the Service. When you open checkout, we attach the measurement data to that order based on your choice at that moment. If you withdraw your consent, the click identifier is deleted from your browser and purchases from checkouts you start afterwards are not reported to Google. An order whose checkout you had already opened before withdrawing may still be reported. If you want such an order excluded, email [support@smartheadshots.ai](mailto:support@smartheadshots.ai) and we will not report it or, where it was already reported, we will set its reported value to zero.

Residents of the EEA, United Kingdom, or Switzerland may complain to their local data-protection authority. California and other US residents may have additional rights to know, correct, or delete covered information and to receive information about disclosures. We will not discriminate against you for exercising an applicable privacy right.

## 12. Cookies and similar technology

We use first-party cookies and similar browser storage. Most are strictly necessary or functional: they make the Service work, remember settings you chose, or protect the Service against abuse, and we use them without asking. One cookie is used only for ad measurement and is set only after you accept it.

### Strictly necessary and functional

- **`hs_draft`** (cookie, 30 days): links an unfinished headshot draft, or a paid order that is waiting for your photos, to your browser so you can continue it.
- **`hs_phone`** (cookie, 60 minutes): lets a phone you connected by QR code upload photos to your draft or order.
- **`better-auth.session_token`** (cookie, 7 days): keeps you signed in and protects your session.
- **`better-auth.session_data` and `better-auth.state`** (cookies, 5 minutes): briefly cache your session and protect the Google sign-in flow.
- **`better-auth.last_used_login_method`** (cookie, 30 days): remembers whether you last signed in with Google or an email code.
- **`NEXT_LOCALE`** (cookie, 1 year): remembers your language.
- **`sidebar_state`** (cookie, 7 days): remembers whether the dashboard sidebar is open or collapsed.
- **`sh_consent`** (cookie, 12 months): remembers your cookie choice, when you made it, and the consent version, so the banner does not ask you again. It does not contain a click identifier.
- **`hs_offer_dismissed_at` and `hs_offer_claimed_at`** (local browser storage, until you clear it): remember that you closed the discount offer, which then stays hidden for 3 days, or that you already requested a code. These entries stay in your browser, are not sent to us, and are not used for tracking or advertising.
- **`dodo-payment-started`** (session browser storage, until you close the tab): limits how long the page you return to after payment waits for the payment confirmation.

On secure connections, the sign-in cookie names may begin with `__Secure-`.

### Ad measurement (only with your consent)

- **`sh_ad_click`** (cookie, 90 days): set only after you accept ad measurement, and only if you reached our website from one of our Google ads. It holds the Google Ads click identifier and the time it was captured, so that a purchase within that period can be reported to Google Ads as described in section 2. Rejecting ad measurement or withdrawing your consent deletes it.

If you reject or ignore the banner, `sh_ad_click` is never set and nothing about your visit or purchases is reported to Google Ads. You can change your choice at any time in "Cookie settings".

The Service may not work properly if you block strictly necessary cookies. Dodo Payments, Google, and other services may use their own cookies when you interact with their hosted pages or sign-in flows, subject to their own notices.

## 13. Security

We use reasonable technical and organisational measures designed to protect personal information. These include secure transport, access controls, private object storage, expiring signed links, private per-session models, rate limiting, and provider security features where configured.

No transmission, storage system, or online service is completely secure. You are responsible for protecting access to your email account and devices and for notifying us promptly if you suspect unauthorised access. If an incident affects personal information, we will investigate, take reasonable containment and remediation steps, and provide notices required by applicable law.

## 14. Children

The Service is not directed to children. You must be at least 18 to create an account, place an order or use headshot generation, and you must not upload a photograph of a person under 18. The free tools described in section 17 are suitable for general audiences and available to anyone who meets the host platform's minimum age; they process photos on your device, and we do not collect those photos. We do not knowingly collect personal information from children under 13. If you believe a minor's information or photograph has been submitted, contact us so we can investigate and delete it where appropriate.

## 15. Changes to this policy

We may update this policy when our Service, providers, practices, or legal obligations change. We will post the revised policy and update the "Last Updated" date. Where required by law, we will provide additional notice or obtain consent for a material change.

## 16. Contact

**CodeBucks**  
Sole proprietorship operating Smart Headshots AI  
Gujarat, India  
[support@smartheadshots.ai](mailto:support@smartheadshots.ai)

## 17. Smart Headshots AI app for ChatGPT and other MCP Apps hosts

The Smart Headshots AI app/plugin provides free photo preparation tools in ChatGPT and other platforms that support MCP Apps. No Smart Headshots AI account is required. If you use our website separately, the website practices described above apply. You may use these tools if you meet the host platform's minimum age; the 18+ requirement in section 14 applies only to accounts, orders and headshot generation.

Photos you choose in the widget, or attach in the chat for the app to check or crop, are processed on your device and are not sent to Smart Headshots AI. Local face detection only locates faces for framing and quality checks; it does not perform biometric identification or authenticate people. We do not store these photos or detection results on our servers. They remain in temporary widget memory, cleared when you remove or replace the photo or close the widget. Crops you save from the widget are saved to your device, unless you choose the optional host save described below. Where the host platform supports it, the widget may share a short text summary of the check results, such as each check's outcome and the image dimensions, with the chat so the assistant can explain them; the photo itself is not shared.

If you attach a photo in the chat and ask the app to check or crop it, the host platform passes our tool a temporary link and file identifier for that photo. Our server receives them within the tool request but does not download, store or log the photo, the link or the identifier; it only passes them to the widget. The widget then loads the photo from the host platform's file storage into your browser and runs the same on-device checks.

Where the host platform supports it, the widget offers an optional button to save your crop through the host platform. Only if you click it, the cropped image is uploaded to your own file storage with the host platform, such as OpenAI for ChatGPT, so that you can download it from there. Smart Headshots AI does not receive that image.

Tool requests, including language, tool mode and an optional style category, reach our server. We use the connecting IP address, which may be the host platform's address, with Upstash for rate limiting and abuse prevention. Upstash rate-limit counters expire about 20 minutes after creation. Our hosting provider may keep standard request logs, and our application logs technical errors. These records follow the security and legal retention criteria in section 10; the rights in section 11 also apply without an account.

The widget loads example images from our servers, and face-detection software and model files from jsDelivr and Google content delivery services. These requests disclose network metadata such as IP address and browser information to the respective providers, without sending them your selected photos. Links to our website carry UTM campaign parameters containing campaign labels, without personal data.

Where GDPR, UK GDPR or similar law applies, we rely on contract for the tools you request and legitimate interests for abuse prevention and secure, reliable delivery, subject to your rights, as described in section 6.

Content, including photos, that you share in the chat itself, and crops you save through the host platform, are governed by the host platform's privacy policy, such as OpenAI's for ChatGPT.