Privacy notice: AI profile photos

Last updated: 30 September 2026

Your photos are processed by Google (Gemini API, paid tier) on our behalf; this can happen in any country. Google does not use them to train its models and keeps the request and the result for up to 55 days to detect abuse. We store the photos on our servers in the USA and delete them automatically — 72 hours after upload if you don’t buy, or 30 days after delivery if you do.

This notice explains how we handle your personal data when you use AI profile photos on idphotoby.ai. The controller is Idphotobyai LLC, 8182, 1021 E Lincolnway, Cheyenne, WY, Laramie, US, 82001 (“we”). This notice supplements our general Privacy Policy, which also covers cookies and analytics on this website.

1. What this service does

You upload one photo of yourself. AI replaces your clothing, background and lighting and creates professional profile photos. You get one free watermarked preview; the full set is paid.

2. What we process

  • your uploaded photo and the images created from it;
  • technical quality measurements of the photo (face size, sharpness);
  • if you agree, a likeness score (see section 5);
  • your email address;
  • order and payment details — payments are processed by Stripe, and we never see your card number;
  • abuse-prevention data: a keyed hash of your IP address, a hash of a random device identifier stored in your browser, and your country derived from the IP address (also used to show prices in your local currency).

3. Why and on what legal basis

  • creating your preview and the photos you order — Art. 6(1)(b) GDPR (performing our contract with you, including the steps before you buy);
  • preventing abuse of free previews (limits, CAPTCHA by Cloudflare Turnstile) — Art. 6(1)(f) GDPR (legitimate interests);
  • likeness check — Art. 9(2)(a) GDPR (your explicit consent);
  • order records — Art. 6(1)(c) GDPR (legal obligation).

4. Where your photos are processed and stored

  • The AI step is run by Google (Gemini API, paid tier) as our processor. Google does not use your photos to train its AI models, except the models it uses to detect abuse. It keeps the request and the result for up to 55 days, solely to detect and prevent abuse or to disclose them where the law requires; requests flagged by its filters may be reviewed by authorised Google staff. Google may process and temporarily store this data in any country where Google or its agents have facilities.
  • Your photos are stored on our servers in the USA; our own processing (quality check, retouching, likeness check, watermark, exports) runs there too.
  • Photos are never sent through messaging apps and never attached to emails; our emails contain only a link.

5. Likeness check (optional)

  • If you agree, software (OpenCV SFace) compares the facial features in your photo with each generated image so that images that no longer look like you are regenerated.
  • The check runs only in memory: face templates are discarded immediately and never saved — we keep only the likeness score (a number).
  • Without this consent the service still works, and the check is not performed.
  • You can withdraw your consent at any time by writing to [email protected]; if you have bought a package, you can also delete your photos with “Delete my photos now” in your gallery. Withdrawing consent does not affect the lawfulness of checks made before you withdrew it.

6. How long we keep your data

  • if you do not buy a package: your uploaded photo and the preview — deleted automatically 72 hours after upload;
  • if you do not buy a package: your email address — deleted 30 days after upload;
  • if you buy a package: your uploaded photo and all created photos — deleted automatically 30 days after delivery, or earlier if you choose “Delete my photos now” in your gallery;
  • order records (email, amount, currency, date) — as long as tax and accounting law requires;
  • technical logs without images — 30 days.

7. No training, no sale, no publication

We do not use your photos to train AI models, we do not sell your data, and we do not publish your photos.

8. AI labelling

Delivered photos carry Google’s invisible SynthID watermark and machine-readable metadata (IPTC) stating that they were edited with AI.

9. Recipients and processors

  • Google (Gemini API, AI processing);
  • our hosting provider (USA);
  • Stripe (payments);
  • Cloudflare (network security, CAPTCHA);
  • Google Workspace (email delivery, links only).

Our internal monitoring messages contain no photos and no email addresses.

10. Your rights and contact

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, to object to processing and to withdraw your consent. You can also lodge a complaint with a supervisory authority.

Contact: [email protected]