Privacy

Last updated: October 2026

Who we are

Headr is run from Lithuania, in the European Union, and is responsible for your personal data (the "controller"). Contact: support@headr.ai.

What we collect, why, and on what basis

• Your order: email address, what you bought and when. To make and deliver your headshots and send you your links (to perform our contract with you). Payments are handled by Stripe; we never see your card.
• Your selfies and the features of your face in them: only to make your headshots, with your explicit consent, which you give with the checkbox before uploading. See the photo and biometric data policy.
• Your first download: the time, your IP address and your browser type, so we can show that the order was delivered if a payment is disputed (our legitimate interest in defending against chargebacks).
• Free headshot: your email address to send it to you, and a scrambled code made from your email address, kept in our records and in a cookie in your browser, so each person gets one free headshot (our legitimate interest in preventing misuse). We also count free headshots per internet address per day, using a scrambled code, not the address itself.
• Logging in to your studio: your email address, to send you a login link.

How long we keep it

• Selfies: deleted as soon as your headshots are made, at the latest 30 days after upload.
• Headshots: 30 days after delivery.
• Order record (email, plan, download time, IP address, browser type): deleted 60 days after the last change to your order. Stripe keeps payment records as the law requires.
• Free headshot: selfies deleted as soon as it is made, the headshot and your email address after 30 days. The scrambled code from your email address is kept for as long as we offer free headshots, so the offer stays one per person; the cookie expires after 400 days.
• Login links: 15 minutes. Login sessions: 30 days.

Who receives it

• Stripe, to take your payment.
• fal.ai, our AI image provider, to make your headshots. It keeps no request history for our requests and deletes its copies within a day.
• Cloudflare, to run this site, store your photos until they are deleted, mark the previews and check for bots.
• Resend, to send you emails.
• Meta, to measure our ads (see Cookies below).

We do not sell your data or share it for advertising. Some of these providers are in the United States. When your data goes outside the European Union, we rely on the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses in the providers' data processing terms.

Cookies

We use two cookies of our own, both needed for the service: one keeps you logged in to your studio (30 days), and one remembers that this browser already received a free headshot (400 days).

We also use the Meta pixel to see which of our ads lead to visits, free headshots and purchases. It sets Meta's cookies and sends Meta what you do on these pages and, if you type it, a scrambled (hashed) form of your email address. In the EU, the EEA, the UK and Switzerland it runs only if you allow it in the banner; you can change your mind by clearing this site's data in your browser. Elsewhere it runs when you visit. Meta's own privacy policy applies to what Meta does with it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. You can withdraw your consent for your photos at any time; we then delete them. Email support@headr.ai. We answer within one month.

You can also complain to a data protection authority: in Lithuania the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt), or the authority where you live.

Children

Headr is for people aged 18 and over. We do not knowingly accept photos of anyone younger.

Decisions about you

We make no automated decisions about you that have legal or similarly significant effects.