Privacy Policy
Last updated: September 17, 2026
1. Data Controller
kaptura.ai (“we”, “our”, “us”) is an AI headshot generation service based in New York, United States. For any questions about data protection or this privacy policy, you can reach us at hello@kaptura.ai, which also serves as our data protection contact point.
2. Information We Collect
We collect the following types of information:
Account Information: Your email address, used for authentication and to send you notifications about your headshot orders.
Photos You Upload (including biometric data): The selfies you provide are used to train a personalized AI model that learns your facial features. This constitutes biometric data processing under applicable privacy laws. Before facial analysis and upload, we ask you to affirm that you are at least 18, that the photographs are of you and that you have the right to use them, and to specifically authorize the processing. We retain a dated record of the statement you accept.
Payment Information: Payment processing is handled entirely by Stripe. We do not store your credit card details on our servers.
Usage Data: With your analytics consent, we use Google Analytics (GA4) and our own measurement of visits, sign-ups, completed uploads and checkout steps. Our records use a random browser identifier, campaign labels and broad device category. With that consent, we can link the identifier and campaign to an order to measure conversions; these measurement records are deleted after 90 days. We do not include photos, names or email addresses in these events. Payment and accounting records follow their separate retention requirements. We also use Vercel Analytics, which is cookieless and collects anonymous performance data.
3. Legal Basis for Processing (GDPR)
We process your data under the following legal bases:
Consent: For processing your facial photographs and biometric data to train AI models and generate headshots. You may withdraw consent at any time by contacting us, though this will prevent us from providing the service.
Contract performance: For processing your email address, payment, and delivering the headshot generation service you purchased.
Legitimate interest: For anonymous analytics (Vercel Analytics) and essential security measures.
Consent: For optional analytics and advertising cookies, which are only loaded after you choose the corresponding purpose in Cookie settings.
4. How We Use Your Information
We use your information to provide and deliver our AI headshot generation service, send you email notifications about your order status (via Resend), process payments through Stripe, improve our service and user experience, and respond to your support requests.
5. Photo Data, Biometric Processing & AI
Your uploaded photos are used to train a personalized AI model (LoRA fine-tuning) that learns your facial features to generate professional headshots. This process involves biometric data processing — specifically, analysis of your facial geometry and characteristics. Your photos are processed through our AI partner (Astria) for model training and image generation. Your photos are not shared with other users or used to train general-purpose AI models. For new sessions under the September 17, 2026 retention policy, uploaded originals are scheduled for deletion seven days after upload, including provider copies and the personalized model when no longer needed. Results are available for 30 days after complete delivery. All generated headshots are created using artificial intelligence, as indicated on the results page.
6. Data Storage & Security
Your data is stored securely using industry-standard cloud infrastructure. We implement appropriate security measures to protect your personal information. All data transmission is encrypted using HTTPS/TLS. Photos are stored in private Supabase Storage buckets. Access is restricted to the owner and authorized server operations. Astria processes the photos for generation. Deletion failures are monitored and escalated; deleting an account record alone is not treated as deleting its files.
7. International Data Transfers
Your data is processed by service providers located in the United States, including Vercel (hosting), Supabase (private photo storage, database and authentication), Astria (AI image generation), Stripe (payment processing), and Resend (email delivery). If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data transfer restrictions, your data will be transferred to the United States. These transfers are necessary for the performance of our contract with you (Art. 49(1)(b) GDPR) and are made with your explicit consent (Art. 49(1)(a) GDPR). Each provider maintains appropriate security measures and data processing standards.
8. Data Retention
For new sessions under this policy, originals are deleted seven days after upload. Abandoned uploads are deleted after seven days without activity, without extending the original-photo deadline. Results expire 30 days after complete delivery; the gallery shows the date and we send a reminder three days beforehand. Failed paid orders have a resolution window of up to seven days from payment, limited by the original-photo deadline, and are recovered or closed with a refund. Payment records and evidence of consent are retained separately as required for legal and operational purposes. To request earlier deletion or withdraw consent, contact hello@kaptura.ai.
9. Third-Party Services
We use the following third-party services to provide our service: Stripe (payment processing — privacy policy), Supabase (authentication and database — privacy policy), Astria (AI image generation — privacy policy), Vercel (hosting — privacy policy), Resend (transactional emails — privacy policy), and Google Analytics (website analytics, only with your consent — privacy policy).
10. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data (“right to be forgotten”).
Withdraw consent: Withdraw your consent for biometric data processing at any time.
Data portability: Receive your data in a portable format.
Lodge a complaint: If you are in the EEA, you have the right to lodge a complaint with your local data protection authority.
To exercise any of these rights, please contact us at hello@kaptura.ai. We will respond within 30 days.
11. Cookies
We use essential cookies for authentication and session management (these are necessary for the service to function). We use Google Analytics (GA4) for website traffic analysis — this is only loaded if you choose analytics in our cookie settings. We use Vercel Analytics for anonymous performance metrics (this is cookieless and does not require consent). With your separate advertising consent, we use the Meta Pixel to measure public-page visits and confirmed purchases and attribute them to our Facebook and Instagram ads. Meta receives browser and connection information, cookie identifiers, and purchase value, currency and an opaque event identifier. We do not send your photos, names, email addresses or payment card details to Meta. Advertising measurement is off until you opt in and stays off when your browser sends Global Privacy Control. You can withdraw consent at any time using Cookie settings in the footer. See Meta’s privacy policy at https://www.facebook.com/privacy/policy/.
12. Age Restriction
Our service is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you are under 18, please do not use our service. If we learn that we have collected data from a minor, we will delete it promptly.
13. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the “Last updated” date. For material changes affecting your biometric data processing, we will seek renewed consent.
14. Contact
If you have questions about this privacy policy, your data, or wish to exercise your rights, please contact us at hello@kaptura.ai.
