HeadshotHQ LogoHeadshotHQ

    Privacy Policy

    Last updated: 17 April, 2026

    We build AI tools that generate professional headshots from photos you provide. This Privacy Policy explains what we collect, when we collect it, why we use it, how we share it, and the choices you have. It applies to individual users (B2C) and to teams/organizations (B2B).

    Data controller: Lazy Group Ltd (trading as HeadshotHQ), 58 Tsar Simeon Street, Trakia District, 4000 Plovdiv, Bulgaria. Contact: [email protected].

    1. Information We Collect

    1.1 Information you provide (and when)

    • Account creation (registration): we collect your email to create and secure your account and to communicate with you about the Service.
    • Headshot generation flow: when you start a generation, we ask for name, age, gender, and eye colour to help guide the output style and improve result relevance.
    • Photos you upload: images you submit so we can generate your AI Headshots, and the AI Headshots we then create for you.
    • Support communications: messages you send us (e.g., via email or in-app).
    • Payments: handled by our payment providers; we receive confirmation details (e.g., payment status) but not your full card number.
    • Ratings and reviews: if you choose to submit a rating, review, or other feedback about your generated headshots, we collect your rating, any review content you provide, and the generated images associated with that review.

    1.2 Information collected automatically

    When you use the Service, we collect usage data (pages viewed, features used, session and event logs) and device/technical data (device, OS, browser, IP address, approximate location). We also use cookies and SDKs for core functionality, and, only with your consent, for analytics and advertising. See our Cookie Policy.

    1.3 Sensitive/biometric data

    Photos of your face may qualify as biometric data under GDPR Article 9. We process these images only with your explicit consent (Article 9(2)(a)) and solely to create your AI Headshots. We do not use your photos for unique identification of a natural person, and we do not use them to train our models unless you give separate, explicit permission. You can delete uploads and generated images at any time from your account or by contacting us.

    1.4 Images of other people

    If you upload photos of others, you must have a lawful basis and appropriate permission. Do not upload images of minors or any person without the required consent.

    2. How We Use Your Data

    We use your data for the following purposes, each grounded in a specific lawful basis under GDPR Article 6 (and Article 9 for biometric data):

    • Service delivery (contract, Art. 6(1)(b)): using your email, name, age, gender, eye colour, and uploaded photos to create your AI Headshots, operate your account, deliver results, and process payments.
    • Biometric processing (explicit consent, Art. 9(2)(a)): processing the facial features in your uploaded photos to generate AI Headshots. We will never use your uploaded photos to train our models unless you provide separate, explicit, informed consent.
    • Security and fraud prevention (legitimate interests, Art. 6(1)(f)): keeping the Service reliable and secure, preventing abuse and fraud, and understanding feature usage with appropriate safeguards.
    • Reviews and marketing (consent, Art. 6(1)(a)): if you voluntarily submit a rating, review, or feedback, we may use it together with the associated generated images for marketing, promotional, and testimonial purposes (e.g., on our website and reviews page). We also rely on consent for marketing emails and non-essential cookies.
    • Legal and tax obligations (legal obligation, Art. 6(1)(c)): retaining invoices and accounting records, and responding to lawful requests from authorities.

    3. How Long We Keep Data

    • Account/profile data (including name, age, gender, eye colour, email): for the life of your account, then up to 24 months after closure (unless the law requires longer).
    • Billing/records: up to 10 years (statutory retention).
    • Uploaded photos & generated images: you can delete them at any time. Otherwise we automatically delete them 90 days after purchase. Once deleted, they can no longer be accessed, viewed, or downloaded. Encrypted backup residue is purged within 90 days. This does not affect billing records or other information we are legally required to retain.
    • Reviews and testimonials: retained for as long as they are publicly displayed; you can ask us to remove them at any time.
    • Cookies/analytics: as described in our Cookie Policy.

    4. How We Share Information

    We do not sell personal data. We share it only with the following categories of recipients, each acting under a contract and appropriate safeguards:

    • Hosting and storage: Hetzner (servers and storage in Germany, EU).
    • Payments: Stripe (card processing and billing).
    • Product analytics: Microsoft Clarity (only with your consent).
    • Customer support: Chatwoot (in-app and email conversations).
    • Affiliate program: Partnero (only if you join our affiliate program; processes your contact and payout data on our behalf).
    • AI inference providers: third-party model providers used to generate your AI Headshots, acting as processors on our instructions.
    • Marketing pixels: LinkedIn, Meta, Google, TikTok, and Xing, only when you give marketing/advertising consent through the cookie banner.
    • Legal and government authorities: where required by law or to protect rights and safety.
    • Business partners: only with your explicit consent (for example, if you connect a partner service).

    5. International Transfers

    We are based in the EU (Bulgaria) and primarily host data in the EU (Hetzner, Germany). Some of our service providers may process data in other countries. Where a destination has an adequacy decision, transfers are straightforward. For transfers to the United States, we rely on providers certified under the EU–US Data Privacy Framework (DPF) where available. Otherwise, we apply the European Commission's Standard Contractual Clauses (SCCs) and complementary safeguards to ensure your data is protected to a high standard wherever it is processed.

    6. Your Rights

    You can:

    • Access your data;
    • Correct inaccurate information (e.g., your account or profile details such as email, name, age, gender, or eye colour);
    • Delete your data (including uploaded photos and generated images we store);
    • Restrict or object to certain processing;
    • Request portability; and
    • Withdraw consent at any time (this does not affect processing already carried out).

    We generally respond within one month. If a request is complex or numerous, we may extend by up to two months and will let you know within the first month. Note that "correction" refers to personal/account details, not retouching or editing uploaded or generated images.

    You also have the right to lodge a complaint with a data-protection authority. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (CPDP): https://www.cpdp.bg/en/.

    7. Security and Data Protection

    We use appropriate technical and organizational measures to protect personal data: encryption in transit (TLS) and at rest, EU hosting on Hetzner infrastructure (Germany), least-privilege access controls, internal authentication and audit logging, and ongoing security monitoring. No system is perfectly secure, but we work to prevent, detect, and respond promptly to security issues.

    8. Automated Processing and AI

    Our AI generates images from the photos you provide. This is algorithmic processing, but it does not make decisions about you or affect your legal rights or opportunities. In line with the EU AI Act (Article 50), we mark AI-generated outputs as such and embed machine-readable provenance metadata where technically feasible, so AI Headshots can be identified as AI-generated. If you discover content generated, uploaded, or distributed via the Service that you believe is illegal (for example, unauthorized use of a person's likeness, defamation, or IP infringement), please report it as described in our Terms of Service.

    9. Your Choices

    • Delete photos and AI Headshots at any time via your account or by contacting us.
    • Unsubscribe from marketing emails at any time using the unsubscribe link in every marketing email.
    • Adjust cookie preferences at any time by clearing your browser's site data for headshothq.ai (specifically the cookie-consent entry in localStorage); the cookie banner will reappear so you can make a new selection. See our Cookie Policy.

    10. Children's Data

    The Service is intended for users aged 18 and over. We do not knowingly collect data from anyone under the age of 16, which is the digital age of consent under GDPR in Bulgaria. If you believe a child has provided data, contact us and we will delete it.

    11. Regional Notices

    We operate from the EU (Bulgaria) and apply this Policy globally. Our practices are designed to meet EU/EEA and UK data-protection requirements.

    Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to processing, and to manage marketing and cookie consent. You can use the mechanisms in Section 6 (Your Rights) and Section 14 (Contact details) to exercise them; we may verify your identity and will respond within the timelines required by law.

    If personal data is transferred outside the EU/EEA or UK, we use adequacy decisions, the EU–US Data Privacy Framework where available, or the European Commission's Standard Contractual Clauses (SCCs) to ensure appropriate protection. You may also contact your local data-protection authority. Our lead authority is the Bulgarian CPDP (see Section 6).

    12. Data Breach Notification

    In line with GDPR Articles 33 and 34, we notify the Bulgarian Commission for Personal Data Protection (CPDP) within 72 hours of becoming aware of a personal-data breach that is likely to result in a risk to your rights and freedoms. Where the risk to affected users is high, we will also notify you directly without undue delay and provide guidance on protective steps you can take.

    13. Changes to This Policy

    If we make significant changes, we will notify you clearly (e.g., email or in-product/website notice) before updates take effect.

    14. Contact details

    Lazy Group Ltd (trading as HeadshotHQ)

    58 Tsar Simeon Street, Trakia District, 4000 Plovdiv, Bulgaria

    (БЪЛГАРИЯ, гр. Пловдив, р-н Тракия, „Цар Симеон", 58)

    Email: [email protected]