AI headshot privacy checklist: questions before you upload

Before uploading

• Whose face is in the photos? Confirm that the subject is an adult and has agreed to the upload and generation. Make sure you have the right to use the photos.
• What is collected? Look beyond selfies: check for email, payment-related information, support messages, and technical or browsing data.
• What is the purpose? Ask whether photos and results are used only for the order or also for general model training or advertising.
• Who processes the information? Look for the companies involved in hosting, payment, AI processing, email, and analytics. Ask where processing may occur.

Fylvy’s Privacy Policy identifies service providers, including Vercel for hosting and temporary photo storage, fal.ai for AI processing, Stripe for payment, and Resend for order and support emails. It also lists jsDelivr and Google Cloud Storage as file hosts for the in-browser photo check on the upload page, and says the check runs in the browser and photos are not sent to either provider. The policy says Fylvy does not use photos or results to train general AI models. Separately, it says they are not used in marketing without your written permission.

During and after the order

• What happens to uploads and the model? Ask when each is deleted, whether the model can be deleted on request, and whether a redo affects its use.
• How are results accessed? Ask how long the link works and who can view it.
• What remains after a request? Ask separately about results, the model, order records, support messages, and logs. Do not assume one deletion setting covers every category.
• How do you make a request? Find the contact address and what information the provider needs to locate your order.

Fylvy’s published policy sets different retention and deletion rules for uploaded selfies, the trained model, and generated results. Read sections 2 and 6 for the current limits, including how a requested redo uses the model. Ask support to clarify a failed or unfinished order before uploading if that possibility matters to you. Published deletion commitments are not independent verification that every backend copy or log has been removed.

The policy says results are available through a private link for at least 30 days and can be deleted on request. Anyone given the link can view the images. It also describes separate retention for order records and support messages. For requests, contact support@fylvy.com from the order email address.

Check analytics choices separately

Fylvy’s policy describes Your Privacy Choices and a browser’s Global Privacy Control as opt-outs covering GA4 and Umami. It says Umami does not load for an initial opt-out, and stops sending statistics if you opt out while a page is open. The policy also says Fylvy has not independently confirmed its Umami server configuration against published defaults, or what appears in server logs and how long those logs are kept.

Those analytics choices do not themselves delete an order or stop information needed to process it. Ask support about a deletion request separately. If uploading facial images does not feel appropriate for your situation, use an existing real photo or work with a photographer and discuss handling with them.

Frequently asked questions