Privacy Policy

2. How We Use Your Personal Data

We process your Personal Data only when we have a valid legal basis to do so. We use your information for the following purposes:

• Providing the Services. To operate, maintain, and deliver our AI headshot generation service, including processing your uploaded photos and generating headshots.
• Personalization. To customize your experience and produce headshots that most accurately represent you in your chosen styles.
• Support. To provide technical support and resolve issues you report.
• Communications. To send you administrative messages, order updates, and respond to inquiries.
• Analytics and Improvement. To analyze usage trends and preferences to improve our Services, develop new features, and enhance the quality of AI-generated results for all users.
• Research and Development. To create new features, test and improve our machine learning algorithms, and develop new products. We may use your Personal Data to analyze the effectiveness of our AI models and improve their accuracy for all users.
• Marketing. To send promotional materials you may find relevant. You can opt out at any time via the unsubscribe link in our emails.
• Security and Fraud Prevention. To keep our Services secure and prevent fraudulent activity.
• Legal Compliance. To comply with applicable laws, regulations, and legal processes.

Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR to process your Personal Data:

• Consent. Where you have given us permission to use your Personal Data for a specific purpose, such as uploading photos for AI headshot generation. You can withdraw your consent at any time.
• Performance of a Contract. Where processing is necessary to fulfill our contractual obligations to you, including providing the Services.
• Legitimate Interests. Where processing is necessary for our legitimate business interests (such as analytics, fraud prevention, and improving our Services), provided those interests are not overridden by your rights.
• Legal Obligations. Where processing is necessary for compliance with a legal obligation, such as responding to a court order or regulatory requirement.
• Vital Interests. Where processing is necessary to protect your vital interests or those of another person.

3. How We Use Your Photos

Your uploaded photos are used to generate your AI headshots. Photos are encrypted at rest using AES-256 encryption and in transit using TLS 1.3. We use uploaded photos and generated images to analyze and improve the performance of our artificial intelligence models. This allows us to provide higher quality results for all users. Your AI model is unique to you and is not shared with other users.

De-Identified and Aggregated Data. We may convert your Personal Data into de-identified or aggregated data (data that can no longer reasonably identify you). We reserve the right to use, disclose, and retain this de-identified data for any lawful purpose, including training our AI models, without further notice to you. When used for these purposes, data is stripped of all personal identifiers, file metadata, and account associations, and aggregated by style and quality metrics rather than by individual user.

Automated Decision-Making

Our Service uses automated processing, including artificial intelligence and machine learning algorithms, to generate your AI headshots from your uploaded photos. This automated processing is necessary for the performance of our contract with you and is carried out with your explicit consent. You have the right to request human review of any automated decision that significantly affects you, to express your point of view, and to contest the decision by contacting us via our contact form.

4. How We Share Your Personal Data

We may share your Personal Data with third parties in the following circumstances:

• Service Providers. We work with service providers for data storage, cloud infrastructure, payment processing, customer support, email, and analytics. They access your data only to perform services on our behalf and are contractually bound to protect it.
• Payment Processor. Payments are handled by Polar Software, Inc., who acts as the Merchant of Record. Polar collects and processes your payment information according to their Privacy Policy.
• Legal Requirements. We may disclose your data if required by law, in response to a court order, subpoena, or governmental request, or to protect our rights, safety, or property.
• Business Transfers. In connection with a merger, acquisition, sale of assets, or similar transaction, your data may be transferred. We will notify you of any such change.
• With Your Consent. We may share your data when you give us explicit permission, such as sharing generated headshots publicly.

We have not sold your personal information to third parties and will not do so.

5. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law.

All data is automatically deleted after these periods. You can request early deletion at any time—we process requests within 24 hours.

6. Your Rights and Choices

Depending on where you reside, you may have the following rights with respect to your Personal Data:

• Access and Portability. Request a copy of the Personal Data we maintain about you, including in a machine-readable format.
• Rectification and Deletion. Request that we correct inaccuracies or delete your Personal Data.
• Restriction and Objection. Request that we restrict or stop processing your Personal Data.
• Consent Withdrawal. Withdraw any consent you previously provided. This will not affect the lawfulness of processing before withdrawal.
• Right to Object to Training. You may request that your data be excluded from future model training datasets by contacting us. Note that this will not affect models that have already been trained using de-identified data derived from your use of the Service.
• Marketing Opt-Out. Unsubscribe from promotional emails at any time via the unsubscribe link.
• Complaint. Lodge a complaint with a supervisory authority in your jurisdiction.

To exercise these rights, contact us via our contact form. We will respond to all requests within 1 business day.

7. U.S. State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another U.S. state with applicable privacy legislation, you may have additional rights including:

• Right to know whether we are processing your personal data
• Right to access and obtain a copy of your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to non-discrimination for exercising your rights
• Right to opt out of the sale of personal data (we do not sell your data)
• Right to opt out of targeted advertising and profiling
• Right to limit the use and disclosure of sensitive personal data

How to Exercise Your Rights

To exercise these rights, contact us via our contact form. We may ask you to verify your identity before fulfilling your request. You may also designate an authorized agent to make a request on your behalf; we may deny a request from an agent that does not submit proof of valid authorization.

Request Verification

Upon receiving your request, we will verify your identity to confirm you are the same person whose information we hold. We will only use Personal Data provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from information we already maintain, we may request additional information for verification and security purposes.

Appeals

If we decline to take action regarding your request, you may appeal our decision by contacting us via our contact form. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” Law: California Civil Code Section 1798.83 permits California residents to request information about our disclosure of Personal Data to third parties for direct marketing purposes. We do not disclose Personal Data to third parties for their direct marketing purposes.

8. Security

We implement appropriate technical and organizational security measures to protect your Personal Data. This includes AES-256 encryption at rest, TLS 1.3 encryption in transit, secure key management, regular security audits, and strict access controls. Our infrastructure is hosted on SOC 2 compliant cloud providers.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Breach Notification

In the event of a data breach that affects your Personal Data, we will notify you and any applicable regulatory authorities as required by law. For users in the European Economic Area, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach, and will notify affected individuals without undue delay where the breach poses a high risk to their rights and freedoms. For U.S. residents, we will comply with applicable state breach notification laws.

9. Children's Privacy

We do not knowingly collect, maintain, or use Personal Data from individuals under 18 years of age, and no part of our Services is directed to children. If you learn that a child has provided us with Personal Data, please contact us and we will take steps to delete such information promptly.

10. Cross-Border Data Transfers

Our Services are hosted in the United States. If you access our Services from outside the U.S., please note that your Personal Data will be transferred to and processed in the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland, we will comply with applicable data protection laws when transferring your data, including relying on adequacy decisions, standard contractual clauses, or other valid transfer mechanisms.

11. Do-Not-Track Signals

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting. At this time, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. California law requires us to disclose how we respond to DNT signals. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Policy.

12. Third-Party Links

Our Services may contain links to third-party websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information to them.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable laws. If we make material changes, we will notify you through the Services or by email. The “Last Updated” date at the top indicates when the Policy was last revised. We encourage you to review this Policy periodically.

14. Contact Us

Gradient V5, Inc. is the entity responsible (or “data controller”) for the processing of your Personal Data as described in this Policy. For privacy questions, data requests, or to exercise your rights, contact us at: