Privacy notice

This notice explains how Likeness Pro (“we”) handles personal data when you use our AI headshot service.

Who is responsible

The data controller is OrBrain Tech LLC (United States), operating Likeness Pro. Contact: orbraintech@gmail.com.

What we collect

• Account data: email address, login session, order history.
• Selfies you upload: facial images. Under UK GDPR these can be special category biometric data when used to uniquely identify you for generating lookalike photos.
• Generated headshots, style choices, flags such as “doesn’t look like me”, and basic technical logs (IP, browser) needed to run and secure the service.
• Payment data: processed by Stripe. We receive payment status and limited billing metadata; we do not store full card numbers.

Why we process it (legal bases)

• Contract: to create your account, take payment, generate and deliver headshots.
• Explicit consent (UK GDPR Art. 9): for biometric processing of your selfies. Consent is collected on a separate screen, is not bundled with the Terms, and is never pre-ticked. You can withdraw it any time from your account; we then stop new processing and delete remaining selfies and results as soon as practicable.
• Legitimate interests: security, fraud prevention, improving reliability (never by training general AI models on your face).
• Legal obligation: tax and accounting records where required.

How long we keep data

• Selfies: deleted automatically 7 days after upload (or sooner if you delete your data).
• Generated photos: deleted automatically 30 days after creation (or sooner on request).
• Account and order records: kept as long as your account exists, then deleted or anonymised except where law requires longer retention of payment records.

We do not train general models on your face

Your selfies and headshots are used only to fulfil your order (and any agreed redo). They are not used to train general-purpose AI models.

Processors and international transfers

We use:

• Cloudflare — hosting, database, storage and CDN.
• BytePlus (ModelArk / Seedream) — image generation from your reference selfies.
• Stripe — payments (including tax calculation where enabled).

These providers may process data in the UK, EEA, United States or other countries. Where UK GDPR requires safeguards for transfers outside the UK, we rely on the provider’s Standard Contractual Clauses (or equivalent approved mechanisms) and their published security measures. Ask us if you want the current list of sub-processors.

Your rights

Under UK GDPR you can request access, correction, deletion, restriction, portability, and object to certain processing. You can withdraw biometric consent at any time. You may complain to the UK Information Commissioner’s Office (ICO). To exercise rights, use the controls on your account page or email the contact above.

More detail on biometric processing: Biometric data notice. How we label AI output: AI disclosure.