Privacy policy

Who is responsible for your data?

The data controller is Headshots ApS, CVR 46801024 (Danish company number), Nørrebrogade 12A, 2., 2200 København N, Denmark. Email us at hey@headshots.dk if you have questions about how we process your data.

This policy covers all our sites: Headshots.dk, Headshots.se, Headshots.no and Headshots.so.

What data we process and why

• Account and order. Your email, name, country and language, and what you bought. We use them to create your account, deliver your portraits and send your receipt and a message when your photos are ready. The legal basis is our contract with you (GDPR Art. 6(1)(b)).
• Your selfies. The photos you upload and the gender you choose. We use them to train an AI model of you and create your portraits. The photos are also checked automatically, for example for glasses, other people in the frame and repeated backgrounds, so the results come out better. The legal basis is our contract with you.
• Your portraits. The photos we create for you, your favorites and any photo you upload yourself when you edit a portrait. We keep them so you can view, pick and download them. The legal basis is our contract with you.
• Payment. You pay through Stripe, and we never see your card details. We receive the amount, currency and your contact details, and keep the order as Danish bookkeeping law requires (Art. 6(1)(b) and (c)).
• Teams. If you are on a team, we get your name and email from the person who invites you. The team owner can see members' portraits and download their favorites. The legal basis is our contract with the team's company and our legitimate interest in providing the team service (Art. 6(1)(b) and (f)).
• Gift cards. Your and the recipient's name and email and your message, so we can send the gift card on the right day (Art. 6(1)(b)).
• When you contact us. What you send us by email, in the chat or through a form, such as your name, email, phone number and message. We use it to reply to you (Art. 6(1)(f), our legitimate interest in helping you).
• Visiting the site. IP address, browser and device, the page you came from and the campaign or ad you clicked. We use it to run and protect the site, prevent abuse and see which ads work (Art. 6(1)(f), our legitimate interest in running and marketing the site).

Who we share data with

We never sell your data. We use a number of services to run Headshots, and each only gets the data it needs for its job. Most of them process it on our behalf and on our instructions. Meta, Google and LinkedIn also use the data under their own privacy policies.

Some of these services are based in the USA. When data is transferred outside the EU/EEA, the transfer is based on the European Commission's standard contractual clauses, or on the EU-US Data Privacy Framework if the service is certified under it.

We also disclose data to authorities when the law requires it.

How long we keep your data

• Uploaded selfies are deleted automatically 45 days after your order, once your portraits have been delivered.
• Portraits and edits are kept for as long as you have your account, so you can download them again. Email us and we'll delete them.
• Your AI model is stored with fal.ai and only used for your portraits. Copies held by our AI providers are deleted under their rules, or when you ask us to.
• Your account is kept until you ask us to delete it.
• Orders and invoices are kept for 5 years from the end of the financial year, as Danish bookkeeping law requires.
• Messages to us are kept for as long as we need them to help you and follow up.

Cookies

We use cookies and similar technology. Some are needed for the site to work. Others we use for statistics and to measure whether our ads work. You can delete or block cookies in your browser at any time.

• Necessary. _headshots_session keeps you logged in (14 days), return_to remembers where you were heading (3 days) and team_invite_code remembers a team invitation (14 days).
• Statistics. hs_src remembers which campaign or link brought you here (90 days). Plausible counts visits without cookies and without recognizing you.
• Marketing. Meta, Google Ads and LinkedIn set cookies so we can measure whether our ads lead to purchases. Rewardful sets a cookie when you arrive through an affiliate link.
• Chat. Crisp sets cookies so the chat can remember your conversation.

Emails from us

We send you the emails that belong to your order: your receipt, a message when your portraits are ready and, for example, password resets.

If you have bought from us, we may also send you news and offers on similar products through MailerLite. You can unsubscribe at any time with the link at the bottom of every email or by writing to us.

Your rights

You have the right to:

• access the data we hold about you
• have incorrect data corrected
• have your data deleted
• restrict how we process it
• receive your data in a common format (data portability)
• object to processing based on our legitimate interest, and always to direct marketing
• withdraw your consent. This does not affect processing that took place before you withdrew it.

Email hey@headshots.dk and we will reply within one month.

If you are unhappy with how we process your data, you can complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk, or to the data protection authority where you live.

How we protect your data

Your photos are stored encrypted with Amazon Web Services in Stockholm, and the site and database run on Render in Frankfurt. All traffic to and from the site is encrypted, only staff who need it have access, and our administrators sign in with two-factor authentication.

Changes

We update this policy when we change how we process data. The date at the top shows when it was last changed.