1OneShot Headshot

Privacy Policy

Last updated: August 22, 2026

Not legal advice. This reflects how the product actually works today, but hasn't been reviewed by a lawyer. Have it reviewed before relying on it for a real launch.

This Privacy Policy explains how Jose Silva III ("OneShot," "we," "us," or "our") collects, uses, stores, and shares information when you use OneShot Headshot (the "Service").

1. Information we collect

Account information

When you create an account, we collect your email address and information necessary to authenticate your account.

If you sign in using Google, we receive certain account information from Google, such as your email address and basic profile information, as permitted by your Google account settings and the authorization you provide.

Uploaded photos and generated images

When you use the Service, you may upload a photograph for processing. We collect and store:

  • the photograph you upload;
  • the AI-generated headshot produced from that photograph; and
  • information associated with the generation, such as the date of generation and your account.

Payment information

If you purchase credits, payment information is processed by our third-party payment processor, Stripe.

We do not store your full payment card number or card security code on our own systems.

Technical information

We may automatically receive limited technical information necessary to operate, secure, and troubleshoot the Service, such as IP address, browser type, device information, and basic usage information.

We do not use this information for third-party behavioral advertising.

2. How we use your information

We use information we collect to:

  • create and deliver AI-generated headshots;
  • authenticate and maintain your account;
  • store and retrieve your uploaded photographs and generated images;
  • process payments and manage credits;
  • provide customer support;
  • maintain, secure, and troubleshoot the Service;
  • detect and prevent fraud, abuse, and security incidents;
  • comply with legal obligations; and
  • otherwise operate the Service as described in this Privacy Policy.

We do not sell your personal information.

3. How we process your photos

When you upload a photograph, we send the photograph to Replicate, Inc., our third-party AI inference provider, so that the AI model can process the image and generate your requested headshot.

We do not use your uploaded photographs or generated headshots to train or fine-tune our own AI models.

Your photograph may therefore be processed by our service providers outside of our own systems. We have not been able to confirm that our AI provider excludes API inputs like your photo from their own model-training practices — their public terms are ambiguous on this specific point — so we are not making that claim here. The handling of information by those providers is also subject to their own privacy policies and contractual obligations.

4. Facial and biometric information

Your uploaded photograph may contain information about your physical characteristics, including facial features.

We use the photograph only as reasonably necessary to provide the image-generation functionality you request. We do not create or maintain a separate facial-recognition profile for you — our system locates the general head-and-shoulders region of the photo using fixed proportional regions of the frame, not facial detection or landmark recognition.

We do not use your photograph for facial recognition, identification, authentication, or surveillance.

5. Where your information is stored

Your uploaded photographs and generated headshots are stored in private Supabase Storage buckets with access controls designed to restrict access to your account.

Account and generation information is stored in a Supabase Postgres database with row-level security configured to restrict user data to the applicable account.

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, or destruction.

However, no internet-connected system can be guaranteed to be completely secure.

6. Service providers

We use third-party companies to help us operate the Service. These providers may process information on our behalf as necessary to provide their services.

Our current providers include:

  • Supabase — authentication, database infrastructure, and file storage.
  • Replicate, Inc. — AI inference and image processing.
  • Resend — account-related emails such as verification and password-reset messages.
  • Stripe — payment processing.

We do not permit service providers to use your personal information for purposes unrelated to providing their contracted services, except where otherwise permitted or required by law.

7. Data retention

We currently retain uploaded photographs and generated headshots for as long as your account remains active.

You may request deletion of your account and associated personal information by contacting us at gordovsilva@gmail.com.

Because we do not currently provide a self-service account deletion feature, deletion requests are handled manually.

We may retain certain information when reasonably necessary to comply with legal obligations, resolve disputes, prevent fraud or abuse, enforce our agreements, or otherwise fulfill legitimate legal requirements.

8. Your privacy rights

Depending on where you live and which privacy laws apply to you, you may have rights regarding your personal information, including rights to:

  • request access to personal information we maintain about you;
  • request correction of inaccurate information;
  • request deletion of personal information;
  • request information about how your personal information is collected and used; and
  • opt out of certain forms of processing where applicable law provides such a right.

To exercise an applicable privacy right, contact us at gordovsilva@gmail.com.

We may need to verify your identity before completing certain requests. We will respond to valid requests within the time required by applicable law.

If you believe we have not properly handled a privacy request, you may have the right to contact your state attorney general or another applicable regulatory authority.

9. Cookies and similar technologies

We use cookies and similar technologies that are necessary to operate the Service, including authentication/session cookies provided through Supabase.

We do not currently use third-party advertising cookies or sell information for targeted advertising.

10. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided us with personal information, please contact us at gordovsilva@gmail.com.

11. International processing

Our service providers may process or store information in countries other than the country in which you live.

By using the Service, you acknowledge that your information may be transferred to and processed in other jurisdictions, subject to applicable legal requirements and the protections described in this Privacy Policy.

12. Data security

We maintain reasonable technical and organizational safeguards designed to protect personal information.

These measures include access controls, authentication controls, database security policies, and restricted access to stored files.

Despite these measures, no method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

13. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes to the Service, our data practices, or applicable law.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy. If required by applicable law, we will provide additional notice or obtain your consent.

14. Contact us

If you have questions about this Privacy Policy or want to exercise an applicable privacy right, contact us at:

Jose Silva III
gordovsilva@gmail.com

← Back home