How we protect your photos
Head Shot PROs works with photos of your face, so here is exactly what happens to them: they stay private to your account, they're used only to make your result, and the uploads are deleted as soon as each run finishes.
Deleted after every run
Your uploads are removed from our storage as soon as each run finishes, whether it works or fails.
Never used to train AI
We don't use your photos to train AI models, and we never sell them or use them for advertising.
Private to your account
Files are kept in private storage, in a folder only your account can open. There is no public gallery.
Payments stay with Razorpay
Your card, UPI and bank details go to Razorpay. We never see or store them.
What happens to a photo, step by step
- 1
Prepared on your phone or computer
Before anything is uploaded, the site shrinks your photo to at most 2,048 pixels on its longest side and saves it again. This also removes hidden details stored in photos, such as the GPS location where it was taken.
- 2
Uploaded to private storage
The photo travels over an encrypted connection into a private folder that belongs to your account. Other accounts can't open it, and it has no public address.
- 3
Shared with the AI only to make your result
Our server gives the AI provider, Magnific, a private link to the file. The link stops working within two hours, and Magnific uses the file only to create your result.
- 4
Your result is saved to your account
The finished pictures or video are saved in your private folder, where only you can see them, on your History page.
- 5
Your upload is deleted
As soon as the run finishes, successfully or not, the uploaded photo is deleted from our storage. Uploads from a run that never started are removed by an hourly clean-up within a few hours.
- 6
Private links when you download
Each time you view or download a result, the site makes a private link to it that works for one hour. You keep results until you delete them.
Who can see your photos
Only you, when you're signed in. Results are never shown to other visitors or listed anywhere on the site.
If you make headshots inside a team with Headshots for Teams, the team owner can see and download those team headshots, because the team pays for them. Everything else you make stays private.
A result leaves your account only when you download it or share it yourself.
How the service is protected
Encrypted connections
Every page, upload and download uses HTTPS, so nobody on your network can read what you send.
Encrypted storage
Our database and files are kept with Supabase, which encrypts all stored data with AES-256.
Each account sees only its own data
Rules inside the database (row-level security) let an account read only its own photos, results, credits and purchases. Credit balances and payments can only be changed by our server, never from the browser.
No passwords to leak
You sign in with a link we email you, which expires in one hour, or with Google. We don't store passwords at all.
Uploads checked twice
File type and size are checked in your browser and again on our server, which reads the file itself before any AI work starts.
Keys kept on the server
The keys for payments and AI services live only on our server. The website you load contains no secret keys, and every update is scanned to make sure of it.
Free tools that never upload
The exam photo resizer and the passport size photo maker work entirely in your browser. Your photo and signature never leave your phone or computer, and you don't need an account.
Analytics only with your OK
We count visits and clicks with Google Analytics and Microsoft Clarity only if you allow it in the cookie notice. Clarity never runs on pages that can show your photos, and your photos and results are never sent to them. Change your choice any time with “Cookie settings” at the bottom of every page.
Who processes your data, and where
- SupabaseDatabase, sign-in and private file storage, on servers in the United States.
- Magnific (formerly Freepik)Runs the AI models that create your results, using the files you upload. Based in Spain.
- RazorpayTakes payments, in India.
- Hostinger and VercelServe the website's pages. Your photos don't pass through them.
- GoogleSign-in, only if you choose to sign in with Google. Google Analytics, only if you allow analytics cookies.
- Microsoft ClarityRecords visits to public pages, only if you allow analytics cookies, and never on pages that can show your photos.
The full details are in our privacy policy, written for India's Digital Personal Data Protection Act, 2023.
You're in control
- Delete any result at any time from your History page. It's removed permanently.
- Delete your whole account, with all its photos and results, from your Profile page. How account deletion works
- Ask to see, correct or delete your personal data by writing to blazetech.devtools@gmail.com.
- Only upload photos you own or have permission to use, and never photos of anyone under 18. See our acceptable use rules.
Found a security problem?
Please write to blazetech.devtools@gmail.com with what you found and how to see it. Our grievance officer, Tanveer Singh Sidhu, acknowledges messages within 48 hours.