Privacy policy

1. Data controller

Vitoria Marcos Soares, CPF 396.296.368-59, address Avenida Dionizio Tellaroli, 668, Jardim São Rafael 2, 14806-880 Araraquara - SP, Brasil. Data protection contact: privacy@imagespic.com. Phone +55 16 98121-0241.

2. Applicable law

Processing is governed by the Brazilian General Data Protection Law, since the operator resides in Brazil, and by the European General Data Protection Regulation, since the service is offered to people resident in the European Union.

3. What data we process

Only what is needed to provide the service:

• The photo you upload, which contains your facial image.
• The images generated from it.
• Your email address, when you make a purchase.
• The minimum transaction data returned by the payment processor: amount, currency, last digits and outcome. We never receive the full card number.
• A random identifier stored in a technical cookie, linking your credits to your browser.
• Basic technical connection data needed for the service to work and to prevent abuse.

4. About the photos

The image of a face is personal data. We do not use it to uniquely identify any person, we do not run facial recognition and we do not build biometric templates. It is used solely as input to the model that produces your headshots.

5. Purposes and legal bases

Each processing activity has a specific legal basis:

• Generating the headshots you request: performance of the contract, plus your express consent regarding the photo you upload.
• Handling payment and issuing the receipt: performance of the contract and legal obligation.
• Letting you recover your credits on another device: performance of the contract.
• Providing support and handling complaints: performance of the contract and legitimate interest.
• Preventing fraud and abuse of the service: legitimate interest.
• Meeting tax and accounting obligations: legal obligation.

6. We do not train models on your images

Your photos and the generated headshots are not used to train or fine tune artificial intelligence models, neither by the operator nor, under the applicable contractual terms, by the generation providers used.

7. Retention periods

We keep each piece of data only as long as strictly necessary:

• The source photo is deleted within a maximum of 2 hours after processing.
• Generated headshots are kept while your account stays active so you can download them again, and are deleted at your request.
• Your email and transaction data are kept for 5 years, for tax and accounting obligations.
• The record of your cookie decision is kept for one year.

8. Who we share data with

We work with providers acting as processors that only handle data on our instructions:

• Stripe Payments Europe, to process payment.
• Vercel Inc., for hosting and site delivery.
• The image generation model provider, which receives the photo only for as long as needed to produce the result.
• The database and storage provider, to keep your balance and your headshots.
• The email delivery provider, for the balance recovery link.

9. We do not sell data

We do not sell, rent or transfer personal data to third parties for advertising. We do not send marketing messages without prior and separate consent.

10. International transfers

The operator resides in Brazil and some providers are established in the United States or in the European Union, so international data transfers take place. They rely on the standard contractual clauses approved by the European Commission and on the equivalent safeguards provided under Brazilian law. You can request information about these safeguards at privacy@imagespic.com.

11. Security

Communications are encrypted in transit. Access to generated images is restricted to the session that created them and files are stored in private repositories. No system is infallible: if a security breach creates a risk to your rights, the competent authority and the affected people will be notified within statutory deadlines.

12. Minors

The service is not aimed at people under 18 and uploading images of minors is not allowed. If we detect a minor data, it is deleted immediately.

13. Your rights

You may exercise the following rights at any time, free of charge:

• Access to the data we process about you.
• Rectification of inaccurate data.
• Erasure of your data and your images.
• Restriction of and objection to processing.
• Portability of the data you provided to us.
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
• Information about data sharing and about the consequences of refusing consent, under Brazilian law.

14. How to exercise them

Write to privacy@imagespic.com from the address linked to your purchase, or from any address providing enough information to verify your identity. We respond within thirty days at most.

15. Complaints

If you believe the processing does not comply with the law, you can complain to the competent supervisory authority: the Autoridade Nacional de Proteção de Dados in Brazil, the Agencia Española de Protección de Datos in Spain, the Comissão Nacional de Proteção de Dados in Portugal, or the authority of your country of residence.

16. Cookies

Cookie use is described in the cookie policy, which forms part of this privacy policy.

17. Changes

This policy may be updated. The date of the last revision appears at the top of the page. Substantial changes will be communicated visibly.