1. Personal Data We Collect

In this Policy, “Personal Data” means any information relating to an identified or identifiable natural person. We may collect and process Personal Data about you in the ways outlined below. Where applicable, we indicate whether and why you must provide us with your Personal Data, as well as the consequences of failing to do so. If you do not provide Personal Data when requested, you may not be able to benefit from our Services if that information is necessary to provide you with them or if we are legally required to collect it.

Information you provide to us

• Registration and Profile Information. If you sign up for an account, we may ask you for your name, company name, email address, address, and telephone number.

• Portrait Photo Information. When you use our Services, we ask you to upload photos of yourself to create amazing portrait photos. When you do so, we may also ask you to provide some details that will help us create the best quality photos that most accurately represent you, such as your age, gender, ethnicity, eye color, hair color, body type, profession etc. Depending on your location, applicable laws might define the information we collect to generate your portrait photos as a biometric identifier, biometric information, or biometric data. By using our Services to create generated portrait photos, you consent to our AI Photo Privacy Notice.

• Communications. If you contact us directly, we may receive additional Personal Data about you, such as your name, email address, job title, company name and size, location, the contents of a message or attachments that you may send to us, and other Personal Data you choose to provide. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.

• Payment Information and Purchase History. If you purchase our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf and we gather related information such as the records and information about the Services purchased.

• Marketing Information. If you sign up for our mailing list, you may provide us with Personal Data, such as your name and contact details (including email address).

Information collected via automated means

• Usage Information. To help us understand how you use our Services and to help us improve them, we automatically receive Personal Data about your interactions with our Services, like your last login, your IP address, your device ID, advertising ID, user ID, the pages or other content you view, your advertising interactions, the searches you conduct, and the dates and times of your visits.

• Cookies and similar technologies. We use cookies and similar technologies (collectively “cookies”) to ensure that our Services function properly, to improve our products and services and to assist with marketing campaigns. Cookies are small text files containing a string of alphanumeric characters. We and third-party partners collect information using cookies, pixel tags, or similar technologies. We and third-party service providers may use the following cookies:

  • Functional cookies. Some cookies are strictly necessary to make our Services available to you. For example, to allow you to fill out forms. We cannot provide you with the Services without this type of cookie.

  • Analytics cookies. We use cookies for website analytics purposes in order to operate, maintain and improve our Services. We use the following cookies:

    Cookie Name	Purpose	Retention Period
    Google Analytics	Track Website activity such as session duration, pages per session, traffic information etc.	2 years
    Hotjar	Analyze data and give feedback data for user engagement	1 year
    Intercom	Intercom uses this as an anonymous visitor identifier cookie.	9 months

  • Advertising cookies. We work with third party advertising partners to show you ads that we think may interest you. These advertising partners may set and access their own cookies on our Services and they may otherwise collect or have access to information about you which they may collect over time and across different online services. We use the following cookies:

    Cookie Name	Purpose	Retention Period
    Facebook Connect	Advertising and user engagement	3 months
    TikTok	Advertising and user engagement	13 months
    Google ads	Advertising and user engagement	90 days

• The information collected via such cookies may include information such as your IP address, device ID, advertising ID, clicks, URLs visited and other interactions, inferred location data, and advertising interactions.

Information we obtain from third parties:

• Social media information. We may maintain pages on social media platforms, such as Facebook, TikTok, Instagram, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider's privacy policy will apply to your interactions and their collection, use and processing of your Personal Data. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Policy.

• Third-party login information. When you link, connect, or login to the Services with a third-party service (e.g. Google or Facebook), you direct the service to send us information such as your registration, friends list, and profile information as controlled by that service or as authorized by you via your privacy settings at that service.

• Other Sources. We may obtain your Personal Data from other third parties, such as marketing partners, publicly available sources and data providers.

2. How We Use Personal Data

We will only process your Personal Data based on a valid legal ground, which may vary depending on the country where you are located. The table below describes the legal ground by purpose.

3. How We Disclose Your Personal Data

We may disclose your Personal Data to third parties in the following circumstances:

• Service providers, vendors, and analytics partners. We work with service providers and vendors to help us operate our Services, such as for helping us analyze the photos and the other information you provide about yourself to create the image model that generates your portrait photos, data storage and cloud services, payment processing, website chat and customer support messaging, transactional and marketing emails, application monitoring and error logging, and giving credit to affiliates that bring users to our Website. We further use service providers and vendors for analyzing data, providing IT-hosting and maintenance, assisting with customer relationship management, and other activities related to our Services. These third parties may have access to or process your Personal Data as part of providing those services to us. In addition, we use analytics service providers such as Mixpanel and Google Analytics to collect and process certain analytics data. Google’s Policies Page expands more about their practices and opt-out by downloading the Google Analytics opt-out browser add-on.

• Affiliates. We may disclose Personal Data to our affiliates, subsidiaries, and branch offices to which it is reasonably necessary or desirable for us to disclose Personal Data for the above-mentioned purposes.

• Legal. We may disclose your Personal Data to third parties if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose your Personal Data that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability, (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity, (iii) investigate and defend ourselves against any third-party claims or allegations, (iv) protect the security or integrity of our Services and any facilities or equipment used to make our Services available, or (v) protect our property or other legal rights, including to enforce our agreements, or the rights, property, or safety of others.

• Merger, Sale, or Other Asset Transfers. We may transfer your Personal Data to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your Personal Data following any of these events will be governed by the provisions of this Policy in effect at the time the applicable Personal Data was collected.

• Consent. We may also disclose your Personal Data with your permission, such as if you choose to disclose your generated headshots with others.

4. Data Retention

We take measures to delete your Personal Data or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we need to retain certain information as required by law, including to comply with tax requirements, or for as long as is reasonably necessary to meet regulatory requirements, resolve disputes, prevent fraud and abuse or enforce our terms and conditions. When determining the specific retention period, we take into account various criteria, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and the relevant statute of limitations.

5. Your Rights in Relation to Your Personal Data

Update Your Information. You can update your account and profile information through your profile settings. You can close your account by emailing us at: support@kiraheadshots.com.

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.

Depending on where you reside, you may have the following legal rights:

• Access and Portability. You may ask us to provide you with a copy of the Personal Data we maintain about you, including a machine-readable copy of the Personal Data that you have provided to us, and request information about its processing.

• Rectification and Deletion. You may ask us to update and correct inaccuracies in your Personal Data, or to have the information anonymized or deleted, as appropriate.

• Restriction and Objection. You may ask us to restrict the processing of your Personal Data, or object to such processing.

• Consent Withdrawal. You may withdraw any consent you previously provided to us regarding the processing of your Personal Data, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

• Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place. We would, however, appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us in the first instance.

You may exercise these rights by contacting us using the contact details at the end of this Policy. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.

6. Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

7. Security

We make reasonable efforts to protect your Personal Data by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information, to the extent permitted by applicable law.

8. Children's Privacy

We do not knowingly collect, maintain, or use Personal Data from children under 18 years of age, and no part of our Services are directed to children. If you learn that a child has provided us with Personal Data in violation of this Policy, then you may alert us by contacting us using the contact details at the end of this Policy.

9. Cross-Border Data Transfers

Our Services are hosted in the United States (“U.S.”). If you choose to use our Services from regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your Personal Data outside of those regions to the U.S. for storage and processing.

If you are located in the European Economic Area, the United Kingdom or Switzerland (“Europe”), we will comply with applicable data protection laws when transferring your Personal Data outside of your jurisdiction. In particular we will rely on (i) an EU Commission, UK, or Swiss government adequacy decision, (ii) contractual protections for the transfer of your Personal Data, or (iii) another valid data transfer mechanism. If you are located in Europe, you may contact us as specified below for more information about the safeguards we use to transfer Personal Data outside of Europe.

10. Changes to this Policy

We may update this Policy from time to time to reflect changes in our privacy practices. If we modify this Policy, we will indicate the date of the latest revision at the top of this Policy. If we materially change the ways in which we use or disclose Personal Data previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

11. Our Contact Information

KiraHeadshots is the entity responsible or “data controller” for the processing of your Personal Data as described in this Policy. Should you have any queries regarding this Policy, about KiraHeadshots's processing of your Personal Data or if you wish to exercise your rights with respect to your Personal Data, you can contact KiraHeadshots by email at support@kiraheadshots.com or by writing to us at: KiraHeadshots, 23910 Jensen Drive, West Hills, CA 91304.