Privacy Policy

1. Introduction

HeyPhoto by HeyDrop P.S.A. ("we", "our", or "us") is an AI-powered professional headshot generation service available as a mobile app (iOS) and web application. This Privacy Policy explains how we collect, use, share, and protect your personal information. By using HeyPhoto, you agree to the practices described in this policy.

2. Data We Collect

We collect the following categories of information:

• Photos (including face data) — images you upload for AI headshot generation. These contain your face and may constitute biometric data under applicable law (including GDPR Art. 9). Photos are processed solely to generate your requested headshots and are not used for AI model training or any other purpose. See Section 3 (Face Data) below for the full disclosure on how face data is collected, used, shared, stored, and retained.
• Payment information — processed securely by our payment providers (Paddle on web, RevenueCat / Apple App Store on iOS). We do not store your full card details.
• App usage data — on iOS, with your explicit consent via the App Tracking Transparency (ATT) prompt, we collect anonymised event data (e.g. screens visited, styles selected, generation started/completed) to understand how the app is used and improve it. If you decline ATT, no behavioural analytics are collected.
• Device & technical data — only if ATT is granted: device model, OS version, app version, and language. No IP address is collected by our analytics.
• Cookies (web only) — see Section 8 for details on cookies used on the HeyPhoto website.
• Partner program applications — if you apply to our partner program, we collect your name, email address, website or social profile links, country and the answers you give in the application. We use them only to evaluate your application and to contact you about the program, based on the consent you give when applying. Applications are shared with our team via our internal workspace (Slack) and are never sold or used for advertising. You can ask us to delete your application at any time at support@heydrop.app.

3. Face Data

HeyPhoto processes photos that contain your face. This section explains specifically how your face data is handled, as required by Apple App Store Review Guideline 5.1.1 and by GDPR Art. 9 on special-category data.

• What we collect — the selfies (photos of your face) that you voluntarily upload from your camera or photo library, typically 3 front-facing images per headshot order. We do not extract, store, or compute any biometric template, face embedding, face print, or identity vector. We do not use face recognition to identify you.
• How we use it — your selfies are transmitted to our AI processing partner (Fal.ai) solely to generate the professional headshots you purchased. The AI preserves your facial features so the results look like you. Face data is neverused to train our or Fal.ai's models, to build a biometric database, to profile you, to authenticate you, or for advertising or marketing purposes.
• Sharing with third parties — face data is shared only with Fal.ai (our AI processing provider, based in the United States), and only for the duration of the generation task. Fal.ai is contractually prohibited from using your photos to train its models. Your face data is not shared with Amplitude, Meta/Facebook, RevenueCat, Paddle, or any other third party.
• Storage — selfies are stored temporarily on secure servers operated by HeyDrop P.S.A. and Fal.ai (United States). All transmission uses TLS and files are encrypted at rest.
• Retention — uploaded selfies are deleted from our processing servers within 30 days of your order completing (typically within 24 hours). AI-generated headshots remain available for download for 30 days and are then deleted. You may request immediate deletion at any time by emailing support@heydrop.app — we will delete within 7 days.
• Legal basis (GDPR) — we rely on your explicit consent under GDPR Art. 9(2)(a), which you provide by uploading photos and completing a purchase. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data on the following legal bases:

• Contract performance — processing your photos to generate and deliver the headshots you purchased.
• Explicit consent (Art. 9) — processing photos as potential biometric data. By uploading your photos and completing a purchase, you provide explicit consent for this processing.
• Consent — analytics and behavioural tracking (iOS: only if you grant ATT permission; web: only if you accept non-essential cookies).
• Legal obligation — retaining payment and transaction records as required by applicable tax and accounting law.

5. How We Use Your Data

Your uploaded photos are transmitted to our AI processing partner (Fal.ai) solely to generate the headshots you requested. We do not use your photos for marketing, AI model training, or any other purpose. Generated headshots are made available for download and are deleted from our servers after a short retention window. We do not permanently store your original photos or generated images.

6. Third-Party Services

We use the following third-party services. Each operates under its own privacy policy:

• Fal.ai — AI processing infrastructure that generates headshots from your uploaded photos. Photos are transmitted to Fal.ai servers (United States) for processing.
• Amplitude — product analytics platform (United States). Used to understand app usage patterns. Only activated on iOS if you grant ATT permission; on web, only if you accept analytics cookies. Amplitude does not receive your photos or payment details.
• Meta (Facebook SDK)— used for advertising measurement on iOS. Only activated if you grant ATT permission. Meta's advertiser tracking is disabled unless ATT consent is given.
• RevenueCat — in-app purchase and subscription management for iOS. Receives purchase transaction data.
• Paddle — payment processing for web purchases. Paddle acts as Merchant of Record and processes your payment data under their own Privacy Policy.
• Vercel — web hosting infrastructure (United States). Processes standard web request logs.

7. International Data Transfers

Some of our third-party service providers are based in the United States. When we transfer personal data from the EEA to the US, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or the service provider's participation in a recognised data transfer framework. You can request information about the specific safeguards in place by contacting us at support@heydrop.app.

8. Data Retention

Uploaded photos and generated headshots are deleted from our processing servers shortly after generation is complete. We do not maintain long-term archives of your photos or generated images. Payment and transaction records are retained for the period required by applicable tax and accounting law (typically 5–7 years). Analytics data (if consent was given) is retained per Amplitude's standard retention policy and can be deleted upon request.

9. Cookies (Web)

The HeyPhoto website uses the following cookies and scripts:

• Essential cookies — required for the service to function (e.g. session state for your purchase flow). These cannot be disabled.
• Paddle.js — payment processing script. Loaded on all pages as it is required to complete purchases. Paddle may set functional cookies related to your checkout session.
• Analytics cookies — only loaded if you accept non-essential cookies via the cookie banner. Used to understand how visitors use the site.

You can manage your cookie preferences at any time using the cookie settings link in the footer of our website.

10. iOS Tracking (ATT)

On iOS, we request your permission to track your activity via Apple's App Tracking Transparency (ATT) framework when you first open the app. If you grant permission, we enable Amplitude analytics and Meta advertising measurement. If you deny, no behavioural analytics or advertising tracking is activated. You can change this preference at any time in your iPhone Settings → Privacy & Security → Tracking.

11. Your Rights (GDPR)

If you are in the European Economic Area, you have the following rights:

• Right to access the personal data we hold about you
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time (without affecting prior processing)

Since HeyPhoto does not create user accounts, we hold minimal personal data. To exercise any of the above rights, please contact us at support@heydrop.app with a description of your request. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

12. Children

HeyPhoto is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from minors. Users must be at least 18 years old to make purchases.

13. Contact & Data Controller

The data controller for HeyPhoto is HeyDrop P.S.A. For any privacy-related questions or requests, contact us at support@heydrop.app.