Privacy Policy

headShawty (“headShawty”, “we”, “us”) turns photos you upload into AI-generated headshots. This policy explains what we collect, why, who we share it with, how long we keep it, and how to delete it. It covers headshawty.com and the headShawty iOS and Android apps.

headShawty is operated by HEADSHAWTY, LLC. Questions? Email contact@headshawty.com.

Information we collect

• Email address. Used to create your account and sign you in. We use passwordless sign-in, so we generally do not store a password for you.
• Photos you upload. The selfies you provide so an AI model can be trained on your likeness.
• Generated images. The headshots produced for you.
• Purchase history. Which credit packs you bought and when. We never see or store your full card number.
• Usage data. Anonymous, aggregated analytics about page views and performance. This is not tied to your identity and is not used for advertising.

We do not buy personal data, we do not sell your personal data, and we do not use it for cross-app advertising or tracking.

Your photos and how AI uses them

This is the part that matters most, so we will be specific. When you upload photos, they are stored securely and sent to Astria, our AI processing provider, which trains a private model of your face and generates your headshots from it.

• Your photos are used only to produce headshots for you.
• Your model is private to your account. It is not shared with other users and is not used to generate images for anyone else.
• We do not use your photos to train any general-purpose or public AI model, and we do not publish them.
• Only upload photos of yourself, or of someone who has given you permission. Do not upload photos of other people without their consent, of public figures, or of minors.

Face data

Because headShawty works with photographs of your face, we treat that as sensitive information and describe it separately here.

• What we collect. The photographs you choose to upload, which contain your face, and a private AI model derived from them that encodes your facial likeness. We do not use Face ID, TrueDepth, ARKit face tracking, or any depth or face-mapping sensor, and we do not create a faceprint for identifying or authenticating you.
• Why we collect it. Solely to train your private model and generate the headshots you asked for. We do not use face data for advertising, profiling, identification, surveillance, or any form of matching against other people.
• Who it is shared with. Only Astria (astria.ai), our AI processing provider, which trains your model and generates your images under contract and may use the data only for that purpose. We share face data with no one else. We never sell it, and never share it with advertisers or data brokers.
• Where it is stored. Uploaded photos are stored by our hosting provider Vercel; the trained model and generated images are stored by Astria. Both operate in the United States. Data is encrypted in transit.
• How long we keep it. Your uploaded photos and trained model are kept while your account is open, so you can revisit your models. Generated headshots are available to download for 30 days after they are created.
• How it is deleted. Deleting your account from headshawty.com/account permanently removes your uploaded photos, your generated headshots, and your trained model — including instructing Astria to delete the trained model from their systems. You may also email contact@headshawty.com to request deletion.
• Your face data is never used to train any general-purpose, shared, or public AI model. Your model is private to your account and is never used to generate images for anyone else.

Before any photo is sent, the app tells you what will be sent and who it will be sent to, and asks you to agree. Nothing is uploaded until you do.

Service providers we share data with

We use a small number of vendors to run headShawty. They process data on our behalf, under contract, and may not use it for their own purposes:

• Astria — AI model training and image generation (receives your uploaded photos).
• Supabase — accounts, sign-in, and database.
• Vercel — website and app hosting, image storage, and privacy-friendly analytics.
• Stripe — payments made on the website.
• Apple and Google — in-app purchases made inside the iOS and Android apps. Their payment terms and privacy policies apply to those transactions.
• Resend — sending sign-in and account emails.

Protection by these providers. We share only what each provider needs to do its job, and we do not permit any of them to use your data for their own purposes. For Astria, the third-party AI service that receives your photos, their published terms confirm that you own the photos you upload and the images generated from them, and that training photos and trained models are automatically deleted 30 days after training completes. When you delete a model or your account, we additionally instruct Astria to delete your trained model. We consider these protections equivalent to those described in this policy, and we do not send Astria your name, email address, or payment details.

We may also disclose information if legally required, or to protect the rights, safety, or property of headShawty or others.

How long we keep things

• Generated headshots are available to download for 30 days after they are created.
• Uploaded photos and your account are kept while your account is open, so you can revisit your models.
• Purchase records may be retained longer where tax or accounting law requires it.

Deleting your data

You can permanently delete your account at any time from headshawty.com/account, or in the app via the sign-out menu → Manage or delete account. Deletion removes your account, your trained models, your uploaded photos, and your generated headshots. Unused credits are forfeited and it cannot be undone.

Depending on where you live, you may also have the right to access, correct, or export your data, or to object to certain processing. Email contact@headshawty.com and we will help.

Security

Data is encrypted in transit, access to production systems is limited, and payment details are handled entirely by Stripe, Apple, or Google. No system is perfectly secure, so we cannot guarantee absolute security.

Children and minimum age

headShawty is intended for adults. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18. If you believe a minor has used the service, contact us and we will delete the account. Do not upload photos of minors.

International users

headShawty is operated from the United States and our providers may process data there. By using the service you understand your information may be transferred to and processed in the United States.

Changes

If we update this policy we will revise the date above and, for significant changes, tell you in the app or by email.