Legal
Privacy
Short version: we process your photos to generate headshots, keep them private, and delete them from ExactShot storage after 30 days. We don’t sell your data or train our own models on your photos.
What we collect
- Email (for sign-in and order updates)
- Selfies you upload and AI headshots we generate
- Payment metadata via Stripe (we don’t store card numbers)
- Basic technical logs needed to run and secure the service
- Affiliate referral id when you arrive via a partner link (Rewardful)
Cookies & similar tech
We always use these essential cookies:
- Auth session — keeps you signed in after login
- Guest / shoot access — links your upload and preview to your photoshoot before or without an account
- Cookie consent — remembers whether you accepted analytics and ads measurement
- Rewardful affiliate — attribution cookie so partner referrals can be tracked (loads when the affiliate script is configured; not gated by the cookie banner)
If you accept cookies in our banner, we also enable:
- Umami (privacy-friendly analytics on cloud.umami.is) for page views and referrers. The Umami script does not load until you accept.
- Google Ads measurement (gtag). The base tag may load with Consent Mode defaults set to denied; ad/analytics storage is granted only after you accept.
Photos & retention
Uploaded selfies and generated headshots are stored privately on ExactShot infrastructure and scheduled for deletion after 30 days. You can request earlier deletion via support, or a refund under our money-back guarantee (see Terms).
To generate and quality-check headshots, we send image data to our processors (below). We do not use your photos to train ExactShot’s own models. Under our image providers’ standard API terms, customer content is not used to train their models by default. Providers may retain inputs/outputs briefly for abuse monitoring under their policies (typically up to about 30 days). That processor retention is separate from ExactShot’s 30-day gallery deletion schedule.
Money-back guarantee
If none of your headshots look enough like you to use professionally, you can request a full refund within 14 days of payment from your results page or support, provided you have not opened a full-size photo or downloaded images and you followed the upload guidelines. Style preference alone is not covered. Generation failures on our side are eligible for a free retry or refund. See Terms.
Processors
- Railway — database, auth sessions, file storage
- Stripe — payments
- OpenAI — image generation (and QA fallback)
- Google (Gemini) — vision quality checks
- Resend — transactional email
- Rewardful — affiliate attribution
- Umami — privacy-friendly analytics (after consent)
- Google Ads — ads measurement (after consent for storage)
Your rights (EU/EEA)
You can request access, correction, deletion, or a copy of your data. Contact us via [email protected]. You may also lodge a complaint with your local supervisory authority.