Privacy policy

Updated October 28, 2026

We store account credentials, order records, uploaded reference photos and AI-generated results to operate this service. Google sign-in verifies identity through Google; email sign-in verifies mailbox access with a short-lived code. Passwords are stored as salted hashes. Verification and password-reset codes are stored as hashes and expire after 10 minutes. Cloudflare Email Sending delivers account verification, password-reset and transactional order notifications to your email address. We retain delivery status and provider message identifiers to diagnose failed messages. These messages are operational, not marketing subscriptions. We store the Google account identifier and verified email, not access to your Gmail or Drive.

Photo processing

Cloudflare provides application hosting, database and private photo storage. Reference photos are sent to the Ark image service operated by Volcengine in China for generation. Waffo Pancake processes payments. New purchases may be temporarily paused; existing orders remain accessible. When Waffo checkout is enabled, Waffo will process the checkout details you provide and the order information required to handle payment, fraud prevention and refunds. We do not store full card numbers. Before generation, text preferences are sent to Waffo’s content-safety service for screening; reference photos are not sent to that screening service. Generation proceeds only after an allowed verdict. Waffo states that this check does not retain prompt text. Do not upload another person’s photos or sensitive documents.

We do not use customer photos for our own model training or publish them as marketing samples. Provider-side processing and retention are governed by each provider’s terms; we do not claim control over their internal systems.

Account controls

We store your saved portrait selections, support conversations, notifications and coarse browser/device labels for active sessions. You can sign out individual sessions, export account records as JSON, and change your email after verifying both mailboxes. Email changes sign out all sessions. Photos are downloaded separately from each order; account exports do not contain passwords, session tokens or payment card information.

Retention and deletion

App-held input and output photos are scheduled for deletion after 30 days. You may delete order photos sooner from your account. Deletion stops further access and requests cancellation of active generation. Cloud backups and provider copies may have separate retention periods.

Account deletion removes access credentials and app-held photos and pseudonymizes the account. Payment and operational records needed for accounting, disputes and abuse prevention are retained. Authorized administrators may inspect results for support and quality review; access is logged.

Contact

Use the support request controls inside your order. You can also contact the operator at support@headshotlane.com for privacy questions, access or deletion requests, or to report misuse.

Aggregate product measurements

We count visits, package selections, photo-preparation outcomes, checkout starts and layout downloads by day, without storing photos, email addresses, page URLs or visitor identifiers in the counter table. Repeated actions count again. Counters are kept for up to about 30 days. The browser skips these events when Do Not Track or Global Privacy Control is enabled. Our request limiter uses short-lived hashed keys to reduce abuse; infrastructure logs may follow separate provider retention.

Optional availability email

If you opt in from your verified account, we store your preference and send one notification when public purchasing opens with available capacity. This does not reserve capacity or subscribe you to recurring marketing. You can cancel in your account; an email already being sent cannot be recalled. Account deletion removes the preference.

Local photo drafts

When you select photos, a draft is stored in your browser on this device so you can return from sign-in or checkout. Drafts expire after 30 minutes; expired copies are removed while the site is open or on your next visit. Use Clear draft to remove the local draft immediately. Local drafts are not uploaded until you start generation.

Account operations and traffic summaries

We record the registration method and most recent successful sign-in time to operate your account. You can optionally tell us how you heard about us when creating an account; this is a self-reported source, not a record of your browsing history. It is included in your account export and removed when you delete your account.

For anonymous visit summaries we retain hourly counts grouped by broad source category (such as search or ChatGPT), country inferred by our network provider, and broad device category for 30 days. These counts have no visitor identifier, raw IP address, full URL, or account linkage. Countries may reflect a VPN location. Do Not Track and Global Privacy Control signals disable these measurements. We do not use these counts to identify individual visitors.