Privacy Policy

Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany (info@nubri.co) is the controller for the data processed by AI Headshots (aiheadshots.site).

Your Google account: when you sign in with Google we receive your name, email address, profile picture link and Google account ID. We use them to run your account (Art. 6(1)(b) GDPR).

Your selfies: you upload 5–20 photos of yourself. They show your face, so we only use them for the one purpose you ask for: training a private AI model of your face and generating your headshots. You confirm this when you upload (Art. 6(1)(b) and, as far as the photos are biometric data, your explicit consent, Art. 9(2)(a) GDPR). You can withdraw that consent at any time by deleting your account; this does not affect processing already done.

Your face model and headshots: the model trained on your photos and the 12 images generated from it.

Payment: Stripe processes your payment. We receive the payment status and a payment reference, not your card details.

• Selfies, the training archive and your face model: deleted automatically as soon as your headshots are ready or the order fails (usually within an hour of starting).
• Selfies on an order you never start: deleted after 7 days.
• Headshots: deleted 30 days after they are ready. Download them before then.
• Your account and order records: until you delete your account. Deleting your account (dashboard → Delete account) removes everything above at once.
• Payment records are kept by Stripe and in our accounting as tax law requires (up to 10 years).

• Amazon Web Services (servers and private photo storage, USA/EU).
• Replicate, Inc. (USA) — trains your face model and generates the headshots. Your photos are sent there only for that and the model is deleted from Replicate after your order.
• Stripe (payments).
• Google (sign-in).

Transfers to the USA are based on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses.

We set no tracking or advertising cookies. Your sign-in token is kept in your browser's local storage for 7 days; Google's sign-in button loads from Google and may set its own cookies.

Our web server records the IP address, time, requested URL, response status and browser type of each request to keep the service secure and working (Art. 6(1)(f) GDPR). These logs are deleted after at most 8 days.

You have the right to access, rectification, erasure, restriction, data portability and to object, and to withdraw consent. Email info@nubri.co. You may also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.