Trust and data handling
Written for a person, not a lawyer. If any of this is unclear, that is our fault — write to us and we will fix the wording.
Where your photos live
Photos you upload and images generated from them are stored in EU data centres. Account records and payment references are stored in the EU as well.
What is sent to the model provider
To generate images, your photo is sent to Google's generative image service, running under a business agreement rather than a consumer one. Under that agreement the content is processed to return a result to us and is not used to train their models. No name, email address or account identifier is sent with the photo.
Deleted after 30 days
Photos and generated images are deleted automatically 30 days after they are created. You do not have to ask, and the clock does not restart when you look at them.
Deleted immediately if you ask
From your account page you can erase a set of images, a source photo and everything made from it, or your whole account. Erasure reports what was actually deleted rather than simply claiming success — if part of it fails, you are told.
Never used to train models
We do not train models on your photos, and we do not license them to anyone who would.
Consent is recorded
Before a photo is processed you confirm that you are the person in it, that you are 18 or over, and that you accept the processing described here. Exactly what you ticked is recorded, because that record is the evidence that you agreed.
Who else touches your data
These are the only third parties involved in running Staffshots.
| Service | What it does | Region |
|---|---|---|
| Google Cloud | Hosting, storage and image generation | EU |
| Stripe | Payment processing | EU / US |
| Resend | Sign-in and notification email | EU / US |
Who is responsible
Staffshots is operated by Erik Finans AB, Sweden, the data controller for everything described here. For access, correction or erasure requests, write to privacy@staffshots.com.
Read the privacy and erasure page