← Back to VeriPortrait

Privacy Policy

1. Controller

Hazdret Zuka, Hofackerstrasse 18, 8953 Dietikon, Switzerland, email: info@veriportrait.com

2. What data we process

Order data: email address, chosen package, payment reference. Photo data: the selfies you upload and the professional headshots created from them. Facial images may constitute special categories of personal data (Art. 9 GDPR / UK GDPR); we process them exclusively on the basis of your explicit consent, which you give at upload (Art. 6(1)(a), Art. 9(2)(a) GDPR / UK GDPR) and for the performance of the contract (Art. 6(1)(b) GDPR / UK GDPR).

3. Purpose of processing

Solely to create your professional headshots, deliver them and process your order. Your photos are not used for advertising, not sold to third parties and not used to train our own AI models.

4. Storage period and deletion

Your selfies and the created photos are automatically and permanently deleted 72 hours after delivery. Invoice and payment data are subject to statutory retention periods.

5. Processors and recipients

Hosting: Hostinger (web hosting, EU). Payment processing: Stripe Payments Europe Ltd. (Ireland); Stripe processes your payment data on its own responsibility and we never receive your full card details. AI image processing: to create the photos, we transmit your selfies to a specialised AI service provider (Higgsfield); this may involve processing on servers outside the EU/UK (including the USA). The transfer takes place on the basis of your explicit consent (Art. 49(1)(a) GDPR / UK GDPR) or appropriate safeguards provided by the provider.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and withdrawal of consent with effect for the future (an email is sufficient: info@veriportrait.com), as well as the right to lodge a complaint with a data protection supervisory authority (in the UK: the ICO).

7. Server logs

When you visit the website, the hosting provider processes technically necessary access data (IP address, time, page accessed) to ensure operation (Art. 6(1)(f) GDPR / UK GDPR).