Cookie Policy

At HeadshotHQ ("HeadshotHQ," "we," "our," or "us"), we use cookies and similar technologies to provide, improve, and personalize our online services. This Cookie Policy explains what cookies are, how we use them, and how you can manage your preferences. For more information on how we process personal data, see our Privacy Policy.

1. What Are Cookies?

Cookies are small text files stored on your device by your browser. They help us recognize your device, remember preferences, and improve your experience. We also use similar technologies such as pixels, tags, local storage, and SDKs. We apply the same consent rules to these non-essential technologies as we do for cookies. Essential local storage (such as authentication tokens and your cookie consent record) is exempt from consent under Article 5(3) of the ePrivacy Directive because it is strictly necessary to provide the service you requested.

• Session cookies: deleted when you close your browser.
• Persistent cookies: remain until they expire or you delete them.

2. Types of Cookies We Use

2.1 Essential cookies

Necessary for the website to function, including session security tokens, login state, payment processing, fraud prevention, load balancing, and your cookie consent record. These cannot be turned off in our systems but you can block them in your browser (site functionality may be affected).

2.2 Analytics cookies (consent required)

Help us understand how the site is used so we can improve performance, usability and reliability. We use Microsoft Clarity, which includes session replay and heatmaps, meaning Clarity records mouse movement, clicks, scrolling and timing of interactions on the pages you visit. Clarity uses masking to avoid capturing the content you type into form fields. Recordings are used solely to improve the product.

2.3 Functional cookies (consent required)

Remember choices and enable enhanced features such as our live chat support widget, Chatwoot, which stores a conversation identifier so support replies reach the right person.

2.4 Attribution cookies (consent required)

Used to credit affiliate partners when a visitor they referred signs up. We use Partnero for affiliate referral attribution.

2.5 Marketing & advertising cookies (consent required)

When you accept marketing cookies, we use the LinkedIn Insight Tag, Meta Pixel, Google Ads, TikTok Pixel and Xing Insight Tag to measure paid campaign performance, attribute sign-ups, and show relevant ads on those platforms. These cookies are set only after you accept marketing cookies in our banner and only while the relevant campaign is active. You can withdraw your consent at any time (see §5.4).

3. Third-Party Cookies and Providers

Some cookies are set by service providers that operate on our behalf. Each provider is bound by contractual obligations to implement appropriate security and privacy safeguards. We currently rely on the following third parties:

• Microsoft Clarity: product analytics, heatmaps, and session replay.
• Stripe: payment processing and fraud prevention.
• Partnero: affiliate referral attribution.
• LinkedIn Insight Tag: paid campaign measurement and retargeting (marketing consent only).
• Meta Pixel: Facebook/Instagram ad measurement and retargeting (marketing consent only).
• Google Ads: Search/Display ad measurement and retargeting (marketing consent only).
• TikTok Pixel: TikTok ad measurement and retargeting (marketing consent only).
• Xing Insight Tag: Xing ad measurement (marketing consent only).

Chatwoot powers our live chat support widget and is self-hosted by Lazy Group Ltd on infrastructure within the EU. Marketing partners are activated only when a paid campaign is running and only with your consent. Where a provider processes data outside the EU/EEA or the UK, we rely on adequacy decisions, the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses (SCCs) to ensure equivalent protection. See our Privacy Policy for more detail.

4. Why We Use Cookies (Legal Basis)

• Essential cookies: used to provide a secure, functional website. Exempt from consent under Article 5(3) of the ePrivacy Directive (the "strictly necessary" exemption).
• Analytics, functional, and attribution cookies: set only with your consent (GDPR Art. 6(1)(a) and ePrivacy Art. 5(3)). You can change your choice at any time.

5. Managing Your Cookie Preferences

5.1 Consent & records

When you first visit the site, our cookie banner lets you accept or reject non-essential cookies (analytics, functional and attribution). We keep a limited record of your consent choices (timestamp and preference state) in your browser's local storage to demonstrate compliance and respect your choice on subsequent visits. You can clear this record at any time through your browser settings to be re-prompted.

5.2 Browser controls

You can block or delete cookies using your browser settings. Disabling essential cookies may affect site functionality.

• Chrome (desktop & Android)
• Firefox
• Safari (macOS)
• Safari (iOS)
• Edge

5.3 Global Privacy Control (GPC)

Where your browser sends a recognized GPC signal, we treat it as an opt-out for non-essential cookies.

5.4 Withdraw or change your consent

You can withdraw your consent at any time by clearing your browser's site data for headshothq.ai (specifically the cookie-consent entry in localStorage). Once cleared, our cookie banner will reappear on your next visit so you can make a new selection. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

6. Retention Periods

• Session cookies: deleted when you close your browser.
• Persistent cookies: stored for up to 12 months unless you delete them earlier.
• Analytics (Microsoft Clarity): up to 13 months.
• Attribution (Partnero): up to 60 days.

We use the following cookies and similar technologies:

7. International Transfers

We are based in the EU (Bulgaria). Some of our sub-processors are located outside the EU/EEA. Where cookie-related data is transferred internationally, we rely on the following safeguards:

• Microsoft (Clarity): EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).
• Stripe (payments): EU–US Data Privacy Framework (DPF) and SCCs.
• Partnero (affiliate attribution): Standard Contractual Clauses (SCCs).
• LinkedIn, Meta, Google, TikTok (marketing): EU–US Data Privacy Framework (DPF) for US-based processing, with Standard Contractual Clauses (SCCs) as a fallback safeguard.
• Xing / New Work SE (marketing): based in Hamburg, Germany, so no international transfer applies.
• Chatwoot: self-hosted by Lazy Group Ltd on infrastructure within the EU, so no international transfer applies.

8. Children and Cookies

Our Service is not intended for children under 16 (see our Privacy Policy). Cookie choices are presented clearly and neutrally, with equal options to accept or reject and the ability to change your choice at any time.

9. Updates to This Cookie Policy

Material changes to this Policy or our cookie categories will trigger a refreshed consent banner so you can make a new selection. Minor changes will be reflected in the "Last updated" date at the top of this page.

10. Your Rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to, and port your personal data, as well as the right to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority. For users in Bulgaria, the lead authority is the Commission for Personal Data Protection (CPDP). See our Privacy Policy for full details on how to exercise these rights.

11. Contact details

Lazy Group Ltd (trading as HeadshotHQ)

58 Tsar Simeon Street, Trakia District, 4000 Plovdiv, Bulgaria

(БЪЛГАРИЯ, гр. Пловдив, р-н Тракия, „Цар Симеон", 58)

Email: [email protected]