# Privacy Policy **Last Updated: 30 August 2026** ## Summary > - Source photos are deleted 7 days after delivery. > - Your gallery and private model are deleted 30 days after delivery. > - We do not sell facial data. > - We do not train a public or shared Smart Headshots AI model on your photos. > - Your photos are processed by the named AI and infrastructure providers listed in section 7. > - You can request earlier deletion from your dashboard. > > The full policy below controls if anything differs. This Privacy Policy explains how CodeBucks, a sole proprietorship operating **Smart Headshots AI** ("Smart Headshots AI", "we", "us", or "our"), collects, uses, discloses, and retains personal information when you use our website and AI headshot service (the "Service"). CodeBucks operates from Gujarat, India. For privacy questions or requests, contact [support@smartheadshots.ai](mailto:support@smartheadshots.ai). Our privacy contact is [support@smartheadshots.ai](mailto:support@smartheadshots.ai). ## 1. Scope and our role This policy applies to visitors, account holders, and customers of the Service. The Service is intended only for adults. You must not use it or provide us with a photograph of anyone under 18. For applicable privacy laws, CodeBucks is the controller or data fiduciary for the personal information described in this policy. Some providers may act as independent controllers for their own purposes. In particular, Dodo Payments acts as merchant of record and processes payment, tax, fraud, invoice, dispute, and refund information under its own terms and privacy notice. Google separately processes information when you choose Google sign-in. ## 2. Information we collect ### Information you provide - **Account information:** your name, email address, account identifiers, email-verification status, and optional Google profile image. We currently use email codes and optional Google sign-in rather than password sign-in. - **Order information:** your selected headshot pack and tier, order and checkout identifiers, amount, currency, tax, payment status, customer and invoice references, and refund information. We do not receive or store your complete payment-card number through Dodo Payments' hosted checkout. - **Photos and file information:** source photographs, original filename, file type, file size, dimensions, and technical values used to manage duplicates and validation. - **Headshot preferences:** information you select for the requested result, including age range, gender presentation, attire, backdrops, pack, and style preferences. - **Generated and derived information:** suitability-screening results, rejection reasons, training captions, generation prompts, a private session-specific model, generated headshots, generation status or error information, and embedded IPTC/XMP metadata identifying delivered headshots as AI generated and crediting Smart Headshots AI. - **Support and feedback:** the contents of messages you send, your account details, and relevant order or session context needed to answer you. ### Information collected automatically When you use the Service, we or our service providers may collect: - IP address, browser and device information, user agent, timestamps, request logs, and security events; - authentication tokens, session identifiers, essential cookies, and draft-session identifiers; - progress through the upload, checkout, training, generation, and delivery flow; - rate-limit identifiers and counters used to prevent abuse; and - technical error and performance information needed to operate and secure the Service. We do not currently use advertising pixels, behavioural advertising, session replay, or third-party advertising analytics. ### Information from other services If you choose Google sign-in, we receive the basic profile information you authorise, normally your name, email address, profile image, and provider account identifier. We do not request access to Gmail, Google Drive, or unrelated Google account content. Dodo Payments provides us with transaction status, amount, currency, tax, customer and invoice references, dispute events, and refund events necessary to reconcile your order. ## 3. Facial images and automated photo screening The Service automatically reviews uploaded photos for basic suitability. This may include whether exactly one face is visible, whether the subject appears to be an adult, and whether framing, distance, angle, lighting, blur, glasses, or obstruction may prevent a usable result. A photo may be rejected automatically, but you can try another photo or contact us for assistance. Photographs and models derived from them may reveal facial features and may be treated as sensitive or biometric information in some jurisdictions. We process this information to provide the headshot service you requested. The Service is not designed to verify your legal identity, authenticate you, identify you in a database, infer emotions, or make employment, credit, housing, insurance, healthcare, or other high-impact decisions. You must be the adult shown in the photographs or have that adult's informed, express permission to submit and process their likeness. Do not upload photographs of minors. We do not sell, lease, trade, license, or disclose facial data in exchange for value. We charge for providing the requested headshot service, not for selling or licensing facial data. We do not create a facial-recognition or identity database. ## 4. How we use information We use personal information to: - create, authenticate, and secure your account; - preserve an unfinished draft and help you resume it; - screen uploaded photographs for suitability; - prepare training captions, create a private session-specific model, generate headshots, and deliver your gallery; - process and reconcile payments, taxes, invoices, disputes, reruns, and refunds; - provide customer support and respond to privacy or account requests; - send service communications, including sign-in codes, draft-recovery reminders, order confirmations, gallery notices, expiry reminders, and account-deletion notices; - prevent fraud, misuse, security incidents, and violations of our Terms; - troubleshoot and improve the reliability and safety of the Service; - establish, exercise, or defend legal claims; and - comply with legal, tax, accounting, regulatory, and law-enforcement obligations. We do not use your photographs in public advertising, testimonials, or marketing materials without separate permission. ## 5. AI processing and model training Providing the Service requires specialised AI service providers. These providers process your source photographs and limited order details to screen photo suitability, prepare generation instructions, train a private model used only for your session, and generate your ordered headshots. Source photographs are not sent to our text-model provider. As between you and CodeBucks, we do not use your source photographs, generated headshots, or private session model to train a public or shared Smart Headshots AI model. Providers process data under their applicable contracts, privacy notices, model terms, and configured service settings. Their limited security, abuse-prevention, operational, or legal retention may differ from our product-retention schedule. ### Provider terms Our AI providers are listed in section 7 and process your data under their standard published terms, privacy notices, and configured service settings; we have no negotiated agreements beyond those published terms. Where a provider's published terms state that customer content is not used to train its models, we rely on that commitment, and some providers may retain data for a limited security or abuse-monitoring period. If a provider's published commitments materially change, we will update this section. ## 6. Legal bases Where the GDPR, UK GDPR, or a similar law applies, we rely on one or more of the following legal bases: - **Contract:** to create an account, process an order, screen photographs, generate and deliver headshots, and provide support. - **Legitimate interests:** to prevent fraud and abuse, protect accounts and infrastructure, troubleshoot failures, enforce our Terms, and improve reliability, where those interests are not overridden by your rights. - **Consent:** where applicable law requires consent, including for particular facial, biometric, or sensitive-information processing or optional activities. - **Legal obligation:** to comply with tax, accounting, regulatory, court, law-enforcement, and other legal requirements. Where processing is based on consent, you may withdraw that consent by contacting us. Withdrawal does not affect earlier lawful processing and may prevent us from completing the Service. ## 7. How we disclose information We disclose information only as reasonably necessary to operate the Service, complete transactions, comply with law, or protect rights and safety. Providers currently include: - **Vercel:** hosting, deployment, and workflows; - **Neon:** managed PostgreSQL database infrastructure; - **Cloudflare:** R2 object storage and Image Transformations for image delivery; - **Replicate:** AI image processing; - **Google and Anthropic:** AI-model processing; - **Dodo Payments:** merchant-of-record checkout, payment processing, tax, invoicing, fraud controls, disputes, and refunds; - **Resend:** transactional and service email; - **Upstash:** rate limiting and abuse prevention; and - **Google:** optional Google sign-in. We may also disclose information: - to professional advisers, insurers, auditors, or contractors bound by appropriate duties; - when required by law, court order, or valid legal process; - to investigate fraud, security issues, prohibited conduct, or disputed transactions; - to protect CodeBucks, our users, or the public; or - in connection with a financing, restructuring, merger, acquisition, or sale of all or part of the business, subject to applicable law. We do not sell personal information. We do not share personal information for cross-context behavioural advertising. ## 8. International processing We operate from India and use providers that may process information in India, the United States, Europe, Australia, and other countries. Those countries may have privacy laws different from the laws where you live. Where required, we rely on lawful transfer mechanisms and contractual safeguards made available by our providers, such as data-processing agreements and standard contractual clauses. Contact us if you want further information relevant to a particular transfer. ## 9. Retention and deletion We retain information only as long as reasonably needed for the purposes described here, unless a longer period is required or permitted by law. - **Rejected or cancelled uploads:** staging copies are scheduled for deletion after validation or cancellation is finalised. - **Unfinished drafts:** a draft session and its uploaded photographs are deleted after 30 days of inactivity. The browser credential used to resume a draft normally expires earlier. - **Delivered source photographs and training archive:** deleted 7 days after delivery. - **Generated gallery and private session model:** deleted 30 days after delivery. - **Early deletion:** where the dashboard offers it, you can delete delivered source photographs or a gallery earlier. Deleting any source photograph early closes the contractual rerun and refund guarantee for that session because we can no longer compare the result with the complete source set. It does not remove rights that cannot lawfully be limited. - **Account deletion:** an account-deletion request starts a 30-day grace period during which you can cancel the request. After that period, the account and associated application data are scheduled for deletion. - **Transaction, security, support, and legal records:** Dodo Payments, other providers, or CodeBucks may retain limited records for tax, accounting, fraud prevention, security, chargebacks, legal compliance, or legal claims for the period permitted or required by law. Deletion from active application storage may not immediately remove information from provider logs, legally required records, backups, or temporary delivery caches. Cloudflare-transformed image variants may remain cached for up to approximately one day. Residual copies are not used for a new purpose. ## 10. Your choices and rights Depending on where you live, you may have rights to: - request access to personal information we hold about you; - request correction, completion, or updating of inaccurate information; - request deletion of information; - receive a portable copy of information you provided, where applicable; - object to or request restriction of certain processing; - withdraw consent where processing is based on consent; - ask for assistance or human review following an automated photo rejection; - nominate another person to exercise rights where applicable under Indian law; and - complain to a privacy or data-protection regulator. Email [support@smartheadshots.ai](mailto:support@smartheadshots.ai) from the address associated with your account to exercise a right. We may ask for information reasonably necessary to verify your identity and protect the account. We will respond within the period required by applicable law. Residents of the EEA, United Kingdom, or Switzerland may complain to their local data-protection authority. California and other US residents may have additional rights to know, correct, or delete covered information and to receive information about disclosures. We will not discriminate against you for exercising an applicable privacy right. ## 11. Cookies and similar technology We currently use essential and functional cookies or similar browser storage to: - keep you signed in and protect your session; - associate an unfinished headshot draft with your browser; - remember the last sign-in method or interface settings; and - secure the Service and prevent abuse. The Service may not work properly if you block essential cookies. Dodo Payments, Google, and other services may use their own cookies when you interact with their hosted pages or sign-in flows, subject to their own notices. ## 12. Security We use reasonable technical and organisational measures designed to protect personal information. These include secure transport, access controls, private object storage, expiring signed links, private per-session models, rate limiting, and provider security features where configured. No transmission, storage system, or online service is completely secure. You are responsible for protecting access to your email account and devices and for notifying us promptly if you suspect unauthorised access. If an incident affects personal information, we will investigate, take reasonable containment and remediation steps, and provide notices required by applicable law. ## 13. Children The Service is not directed to children. You must be at least 18 to use it, and you must not upload a photograph of a person under 18. If you believe a minor's information or photograph has been submitted, contact us so we can investigate and delete it where appropriate. ## 14. Changes to this policy We may update this policy when our Service, providers, practices, or legal obligations change. We will post the revised policy and update the "Last Updated" date. Where required by law, we will provide additional notice or obtain consent for a material change. ## 15. Contact **CodeBucks** Sole proprietorship operating Smart Headshots AI Gujarat, India [support@smartheadshots.ai](mailto:support@smartheadshots.ai)