Security

Effective

You're trusting us with photos of your face, and we take that seriously. This page describes how we protect your information in practice. We're a small team, so we've focused on keeping as little data as we can, for as short a time as we can.

Collect less, keep less

  • Before launch, the only information we hold is what you enter in our waitlist and team forms.
  • After launch, we delete your uploaded selfies and face templates within 30 days of your order, or sooner if you ask.
  • We never sell your photos or use them to train models for anyone else.

Encryption

  • Every page and form on headshotlab.com is served over HTTPS, so information you send us is encrypted in transit.
  • Uploaded photos and finished headshots will be stored encrypted at rest with our cloud provider, Amazon Web Services.
  • Photo downloads use private, time-limited links rather than public URLs.

Payments

Card details are entered with and handled by our payment processor, which is certified to the PCI DSS standard. Your full card number never reaches our servers, and we never store it.

Access

  • Only the people who need it to run the service can access production systems and customer data.
  • Administrative accounts use strong, unique passwords and multi-factor authentication where available.
  • We don't look at your photos unless you ask us to, for example to help with a retouch or support request.

Service providers

We use established providers for hosting, form handling, payments and image generation. Each receives only the information it needs to do its job. They're listed in our Privacy Policy.

If something goes wrong

If we learn of a security incident that affects your personal information, we'll let you know promptly and tell you what happened and what we're doing about it, as the law requires.

Report a security issue

If you think you've found a vulnerability in Headshot Lab, please email hello@headshotlab.com with the details. We'll acknowledge your report, keep you updated, and won't take action against good-faith research that avoids privacy violations and service disruption.