Privacy Policy

Last updated: October 4, 2026. The changes in this version – the questions we may ask when you create an account, and how long guest sessions keep their photos (sections 1, 2, 5 and 6) – take effect on October 18, 2026.

This policy explains what data Photolaria ("we", "us") collects, why, who we share it with, and the controls you have. The short version: your galleries are private on every plan, Photolaria never uses your photos to train AI models, and you can delete your data yourself at any time.

Questions or requests: [email protected].

1. What we collect

You provide:

  • Email address – used for sign-in codes, receipts, and service messages. Product news and offers only if you opt in (see section 2).
  • Google sign-in (optional) – if you choose "Continue with Google", we receive your email address, your name, and a unique Google account identifier from Google instead of you typing them. We use them only to create and sign you into your account.
  • Account questions – when you create an account, we may ask a few short questions, for example what you plan to use Photolaria for. Your answers are kept with your account and deleted with it.
  • Photos – the photos you upload and the images you create (edited or generated).
  • AI headshot generator – the selfies you upload (up to three), the backdrop, outfit and retouching you choose, and the results of the automatic photo check described in section 4: whether each photo is usable, short descriptions of visible features such as hair, eyebrows, facial hair, glasses and head covering, whether you present as a woman or a man (used only to preselect clothing – you can change it), and where your eyes are in each photo (used only to straighten a tilted photo). These results are used only to make your headshots look like you – never to identify you.
  • Payment – handled entirely by Stripe, our payment processor. We never see or store your card number; we keep only a reference to your Stripe customer record and your subscription/credit status.

Collected automatically:

  • Session cookies – a guest session cookie before login and a user session cookie after login. These are functional cookies that keep you signed in; we do not use advertising or cross-site tracking cookies.
  • Basic usage and log data – IP address, browser type, pages requested, and timestamps, kept in standard server logs for security and debugging.
  • Usage statistics (our own) – on the AI headshot generator's pages we record how visitors use them, to learn which parts help and where people stop: the pages you open and the steps you complete, how far you scroll, which sections, buttons and questions you open, how long the page is in use, the choices you make (such as backdrop and outfit), how you arrived (the referring website, the campaign tags in the link, and whether you came from a Google ad – but not the ad click identifier itself), your country and device type, and – if you enter an email address – only its domain (for example gmail.com). The records are linked to your session cookie, so the steps of one visit are counted together, and to your account once you have one. They contain no IP addresses and no photos, add no cookies of their own, and are kept for 30 days. We use them only for our own statistics – never for advertising, never shared or sold, and no advertising pixels are involved. If your browser sends a Global Privacy Control or Do Not Track signal, none of this is recorded.

2. How we use your data

  • To provide the service: run your generation jobs, show your gallery, manage your credits and subscription.
  • To communicate with you: sign-in codes, receipts, important service announcements, and – for the headshot generator – a note when your headshots are ready.
  • To send you product news and offers by email – only if you opt in (the checkbox at sign-up, the one-time prompt on the site, or the switch in your profile). The legal basis is your consent; we record when and how you gave it and which version of this policy applied. Every such email includes an unsubscribe link, and you can turn it off in your profile at any time. Opting out never affects sign-in codes, receipts, or service messages.
  • To keep the service secure: abuse prevention, rate limiting, and enforcement of our Acceptable Use Policy.
  • To understand who uses Photolaria and keep it safe: the answers to the account questions described in section 1. The legal basis is our legitimate interest in preventing misuse and in shaping the service for the people who use it.
  • To understand and improve our pages: the usage statistics described in section 1. The legal basis is our legitimate interest in knowing which pages and steps work; you can object at any time by turning on Global Privacy Control or Do Not Track in your browser, or by writing to us.

We do not sell your personal data. Photolaria never uses your photos to train AI models. Your photos are sent to our AI providers solely to generate the results you asked for; we choose providers and configurations intended to keep your content out of model training. Their handling of content is governed by their own terms – we hold them to that, but we cannot audit third-party infrastructure ourselves.

3. Privacy of your photos

  • Galleries are private by default on every plan, including free usage. Only you can browse your gallery.
  • We do not publish, showcase, or share your uploaded photos or generated images.
  • During generation, working copies of your photos pass through our AI providers' infrastructure at unlisted, unguessable addresses used to move files between systems. They are never published, listed, or indexed, are not part of your gallery, and are removed from the provider's systems according to the provider's own retention terms.

4. Who we share data with

We share data only with the processors needed to run the service, and only what each one needs:

  • Stripe – payment processing and billing. Stripe receives your email and payment details under its own privacy policy.
  • Resend – sends our transactional emails (sign-in codes, welcome and service messages, receipts) and, if you opted in, our product news and offers to your email address.
  • Google – only if you choose "Continue with Google": Google handles the sign-in and shares your email address, name, and a unique account identifier with us. The sign-in button on our sign-in page is served by Google and operates under Google's own privacy policy.
  • AI inference providers – your photos and prompts are sent to specialized AI infrastructure providers that route requests to the image models powering Photolaria (currently models from Google and OpenAI), solely to process your request. Under their terms, these providers may process your content only to operate and improve their services; they may not sell or publish it. See section 2 for what this means for AI training.
  • OpenAI – powers our automated content-safety checks (prompts and uploaded photos may be screened by OpenAI's moderation service before generation) and the photo check of the AI headshot generator: your selfies are sent to an OpenAI model that checks they are usable (one clearly visible face, sharp enough, the person appears to be an adult) and returns the short descriptions listed in section 1. Under its API terms, OpenAI does not use this content to train its models.

Beyond that, we disclose data only if required by law, or to protect the rights, safety, or property of our users or the service.

5. Deleting your data

You are in control, self-serve, on every plan including free:

  • Delete individual images – the trash icon on any image moves it to the Bin; emptying the Bin (or 30 days passing) removes it for good. In guest sessions the guest retention period (section 6) applies to binned images too.
  • Delete my data – the "Delete my data" link in your profile, and in the editor's Bin tab wherever it is shown, permanently wipes all your images and generation history at once, including your headshot selfies and sets. Photos from a guest session that never moves into an account are deleted automatically (section 6), and you can also ask us to delete them earlier.
  • Delete account – available in your profile; cancels any subscription and removes your account and associated data.

Deleted content is removed from live systems immediately and purged from short-lived backups on their rotation schedule. Billing records that we are legally required to keep (invoices, tax records) are retained for the statutory period.

6. Retention

  • Account holders (anyone with an account – free or paid): your photos and account data are kept until you delete them or your account.
  • Guest sessions (what you create before you sign in): photos are stored for up to 7 days from creation – including images moved to the Bin – then automatically deleted. If you create an account or sign in within that time, the photos from your guest session move into your account and are kept like the rest of your photos. You can delete them earlier yourself wherever your session shows them, or ask us to.
  • AI headshot generator – selfies uploaded for a set you never confirm with your email, and any headshots already made from them, are deleted 24 hours after upload. A free set that isn't unlocked – selfies, headshots and previews – is deleted 30 days after it was created; you can then make a new free set. An unlocked set is kept like the rest of your photos, until you delete it or your account.
  • Usage statistics (section 1): kept for 30 days, then automatically deleted.
  • Marketing consent records (when and how you opted in or out, and which policy version applied) are kept with your account as evidence of your choice and are deleted with it.
  • Server logs are kept for a short rolling window; legally required billing records for the statutory retention period.

7. Your rights

Wherever you live, we extend you the same baseline rights – and if you are in the EEA, UK, Switzerland, or California, these are backed by GDPR/CCPA:

  • Access – ask what personal data we hold about you.
  • Correction – fix inaccurate data.
  • Erasure – use the self-serve deletion tools above, or email us.
  • Portability – receive your data in a usable format.
  • Objection / withdrawal of consent – where processing is based on consent. For marketing emails, use the switch in your profile or the unsubscribe link in any such email.
  • Likeness removal – if your likeness is being used on Photolaria without your consent (whether or not you have an account), email [email protected] with enough information to identify you and, if possible, the content. We will investigate, and where the claim checks out we will remove the content and the source photos. We treat these requests with priority.
  • Complaint – you may lodge a complaint with your supervisory authority; we'd appreciate the chance to resolve it first at [email protected].

We will never discriminate against you for exercising your privacy rights. We do not "sell" personal information as defined by the CCPA.

8. Security

Traffic is encrypted with HTTPS. Payment data is handled by Stripe, a PCI DSS Level 1 certified processor. Access to production data is restricted. If a breach affects your personal data, we will notify you so you can take protective steps.

9. Children

Photolaria is for adults (18+). We do not knowingly collect data from anyone under 18. The AI headshot generator refuses photos in which the person appears to be under 18. If you believe a minor has provided us data, contact us and we will delete it.

10. Changes

We may update this policy; the "Last updated" date reflects the current version. Material changes are posted here at least 14 days before they take effect, with the date they take effect next to the "Last updated" date – except changes required by law, which may apply immediately.

11. Contact

[email protected]