Trust and data handling
Written for a person, not a lawyer. If any of this is unclear, that is our fault — write to us and we will fix the wording.
Where your photos live
Photos you upload and images generated from them are stored in Google Cloud's Stockholm region. Account records and payment references are stored in the EU as well.
What is sent to the model provider
To generate images, your photo is sent to Google's generative image service, running under a business agreement rather than a consumer one. Under that agreement the content is processed to return a result to us and is not used to train their models. No name, email address or account identifier is sent with the photo. That service has no EU-only endpoint yet, so your photo may be processed outside the EU, under Google's data processing terms and the EU standard contractual clauses.
Your photo is deleted after 30 days
The photo you upload, the face measurements taken from it and any preview you did not buy are deleted automatically 30 days after they are created. You do not have to ask. Headshots you buy are kept in your account so you can download them again, until you delete them or until two years pass without a sign-in.
Deleted immediately if you ask
From your account page you can erase a set of images, a source photo and everything made from it, or your whole account. Erasure reports what was actually deleted rather than simply claiming success — if part of it fails, you are told.
If you join a company's team
The team's owner can see and download the headshots bought with the team's credits, because the company paid for them, and any headshot you choose to share with the team. You are told this before you join.
Never used to train models
We do not train models on your photos, and we do not license them to anyone who would.
Consent is recorded
Before a photo is processed you confirm that you are the person in it, that you are 18 or over, and that you accept the processing described here. Exactly what you ticked is recorded, because that record is the evidence that you agreed.
Who else touches your data
These are the only third parties involved in running Staffshots.
| Service | What it does | Region |
|---|---|---|
| Google Cloud | Hosting and storage | EU (Stockholm) |
| Google Vertex AI | Image generation | Global, may be outside the EU |
| Stripe | Payment processing | EU / US |
| Resend | Sign-in and notification email | US (sent from Ireland) |
| Google Analytics | Website analytics, only with your consent | EU / US |
Who is responsible
Staffshots is operated by Erik Finans AB, Sweden, the data controller for everything described here. For access, correction or erasure requests, write to privacy@staffshots.com.