Photo and biometric data policy

Last updated: October 2026

What this covers

The selfies you upload to Headr, and the features of your face in them. Some laws treat facial features as biometric data, for example the Illinois Biometric Information Privacy Act, the Texas and Washington biometric laws, and the EU General Data Protection Regulation. This page applies to every customer, wherever you live.

Why we use them

Only to make the headshots you asked for: your paid headshots, the changes you type, or your one free headshot. We ask for your consent with a checkbox before any photo is uploaded, and we do not accept photos without it.

We do not sell, lease, trade or otherwise profit from your photos or your facial features. We do not use them to train AI, to identify you, or for advertising.

Who receives them

• Our AI image provider (fal.ai, United States), only to make your headshots. We tell it not to keep a request history, and the copies it makes are deleted from its servers within a day.
• Our hosting and storage provider (Cloudflare), to store your photos until they are deleted.

Nobody else, unless a law or a court order requires it.

When they are deleted

• Your selfies: as soon as your headshots are made. If something stops your order before that, at the latest 30 days after you uploaded them.
• Your headshots: 30 days after delivery.
• Free headshot: the selfies as soon as it is made, the free headshot after 30 days.

We do not create or keep face templates or measurements of your face. You can ask us to delete your photos and headshots earlier at any time by email.

How we protect them

Photos are stored encrypted (AES-256) and always sent over encrypted connections (TLS). Your gallery is reachable only through the private link we email you.

Your consent

You can withdraw your consent at any time by emailing us. We then delete your photos and headshots. Withdrawing does not undo what was lawfully done before.

Contact

Headr. Email [email protected].