Privacy Policy
Last updated 24 October 2026
Studio Forty turns a few selfies into professional headshots. Photos of your face are personal data, so this page explains plainly what we collect, why, who helps us process it, and how long we keep it.
What we collect
- Account: your email address (from Google sign-in or an email link).
- Selfies you upload and the headshots we generate from them.
- Your consent record: the wording you agreed to, when, your IP address and browser.
- Orders: what you bought, the amount, and the payment reference. We never see or store your card or UPI details; Dodo Payments handles those.
- Usage analytics: which steps you complete (for example "selfies uploaded"), linked to your account id after you sign in. We don't set tracking cookies.
- Error reports: technical details when something breaks. These never include your photos.
How we use it
- An automated AI check reviews each selfie (one adult face, sharp, no filters, no nudity) and tells you what to fix.
- AI image models generate your headshots from your selfies, and an automated AI review picks the best ones.
- To take payment, send receipts and "your headshots are ready" emails, prevent abuse, and fix problems.
We never use your photos to train AI models, and we never sell or share your data for advertising. You must give consent before uploading, and you can withdraw it at any time by deleting your photos or account.
How long we keep it
- Selfies: deleted automatically after 7 days.
- Headshots you don't favourite: deleted after 30 days. Images our review discards: deleted within a day.
- Headshots you favourite: kept until you delete them or your account.
- ZIP downloads: deleted after 24 hours.
- Orders and consent records: kept as long as the law requires for tax, accounting and proof of consent.
Who processes your data for us
- Supabase: accounts, database and private photo storage.
- Google Cloud (Vertex AI): the selfie check, generating your headshots and picking the best ones. Google doesn't use this data to train its models.
- Dodo Payments: our merchant of record. It processes payments and handles sales tax, VAT and GST.
- Resend: transactional emails.
- PostHog: product analytics. Sentry: error monitoring.
- Cloudflare: hosting and security for this website.
These providers process data only to deliver their service to us, under their own security and data-processing terms. Some are outside your country, so your data may be transferred internationally.
Your rights
You can ask us to access, correct or delete your data, or withdraw consent, by emailing us (below). Deleting your account removes your photos, headshots and account; we keep only the order records we're legally required to. You have rights under India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR and similar laws, including the right to complain to your data protection authority.
Security
Photos are stored in private storage that only your account can read, served through links that expire, and encrypted in transit. Access by our team is limited to what's needed to support you.
Children
Studio Forty is only for adults (18+). Photos of minors are rejected.
Changes
If we change this policy in a way that matters, we'll update the date above and tell you by email. See also our Terms and Refund Policy.
Contact
[Your legal entity name], [Registered address]. Email [support@yourdomain.com]. Grievance officer: [Name, email].