In short
We enhance your image - we never harvest your identity. From the moment a selfie is uploaded to the moment it's deleted, the data exists for one purpose: creating the headshot set you asked for. Photos are never used to train general models, never sold, and deleted within 30 days of generating your headshots, or earlier on request. The plain-language summaries here orient you; the numbered sections are the policy.
01
Introduction
This Privacy Policy explains how HYPERZ AI B.V. ("HYPERTURE", "we", "us") collects, uses, shares, and safeguards personal data when you use HYPERTURE, our AI photo studio for B2B teams. It applies to our website, the studio application, and related services.
We've written it to be read. Where a topic also appears in our Data Processing Addendum - which governs personal data we process on behalf of a customer - that document gives the detailed terms.
02
Who we are
HYPERTURE is operated by HYPERZ AI B.V., a company registered in the Netherlands. For personal data we determine the purposes and means of processing, we act as the data controller. For personal data we process on behalf of a customer team, we act as a data processor (see section 12).
03
Data we collect
We collect data you provide, data created when you use the service, and a limited amount from our service providers.
You provide
Uploaded photos, brand assets, account details (name, work email, role), team and company name, and any messages you send us.
Collected automatically
Device and connection information (IP address, browser, operating system), and usage details such as which features you access. Used to run, secure, and improve the service.
Generated by the service
The headshots we produce for you, the provenance metadata signed into each image, and face embeddings used to check that each headshot resembles the person.
04
Photos & biometric data
The photos you upload are facial images. To check that each headshot resembles the person, we create numerical representations of facial features (face embeddings) from the uploaded photos and the generated headshots and compare them. This comparison is made only between a person's own photos and their own headshots. We do not use it to identify or authenticate anyone, and we do not compare faces across different people or customers. Because face embeddings may constitute biometric data, we treat uploaded photos and embeddings as special-category data under the GDPR and process them only with the explicit consent of the person concerned.
Each person gives explicit consent before uploading photos and decides which headshots are shared with their organization; only approved headshots are shared. A person can withdraw consent at any time in their account or by emailing privacy@hyperture.ai. Withdrawing consent stops further processing, and we delete that person's source photos, face embeddings and per-person model within thirty (30) days, without affecting processing that already took place. Headshots already delivered to the organization are held by the organization, which the person should contact about their further use.
05
How we use data
Where we act as controller (see section 12), we process personal data for the purposes and on the legal bases below. Where we act as processor for a customer, the customer determines the purposes and legal basis.
- Provide the service - generate, verify, and deliver headshots, and run team management and review flows. (Performance of a contract; explicit consent for facial images and face embeddings.)
- Keep the service secure and prevent abuse. (Legitimate interests.)
- Support you and respond to your requests. (Contract / legitimate interests.)
- Improve the service and understand how it is used in aggregate, using usage data only. Photos and generated headshots are never used for this purpose. (Legitimate interests.)
- Send service and, where permitted, marketing communications. (Consent / legitimate interests.)
- Comply with legal obligations. (Legal obligation.)
06
AI processing of photos
To create a set, your uploads are used to train a private, per-person model in EU data centers that exists only to generate that individual's headshots. We do not use your photos or your generated images to train general-purpose or shared AI models, and we do not make them available to other customers.
The hard rule
Your photos never enter our general model-training pipeline. They are processed for your headshots, then handled under the retention rules in section 9.
07
Sharing & sub-processors
We do not sell personal data and we do not share it with advertisers or data brokers. We do use a small set of trusted service providers (sub-processors) to run HYPERTURE - for example cloud hosting, GPU compute, AI image generation, email delivery, payments, and product analytics. They process data only on our instructions and under written contracts. The current list of sub-processors is published in Annex C of our Data Processing Addendum at hyperture.ai/data-processing-addendum.
We may also disclose data where required by law, to protect the service or our rights, or as part of a corporate transaction, in which case we'll keep your data subject to protections at least as strong as these.
08
International transfers
We store customer data, including source photos and generated headshots, on infrastructure located in the European Union, and train per-person models in EU data centers. Some processing takes place in the United States: our web application runs on Vercel in the United States, AI headshot generation is performed by Features & Labels, Inc. (fal.ai) in the United States, and transactional email is sent by Postmark in the United States. For each such transfer we rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses, together with supplementary measures identified in a transfer impact assessment. For AI headshot generation, request-payload storage is disabled and uploaded files are deleted after processing. Our sub-processors and the safeguards used are listed in Annex C of our Data Processing Addendum.
09
Retention
We keep personal data only as long as needed for the purposes above. Account data is retained for the life of the account. Source photos, face embeddings and the per-person model used to generate a set are deleted within 30 days of generating the headshots, or sooner on request.
- On demand: an administrator or member can request deletion of a member's data at any time.
- Withdrawal of consent: source photos, face embeddings and the per-person model are deleted within 30 days, as described in section 4.
- Generated headshots: kept until the customer deletes them or the account is closed.
- Account closure: when an account is closed, we delete or anonymize personal data within ninety (90) days, except billing records, which we keep for seven years to meet Dutch tax obligations.
- Backups: source photos, face embeddings and per-person models are never included in backups. Other deleted data is removed from backups within thirty (30) days through routine overwriting.
10
Security
We protect personal data with technical and organizational measures including encryption in transit and at rest, role-based access controls, audit logging, and a least-privilege approach to internal access.
No system is perfectly secure, but if a personal data breach affects you, we will act and notify in line with our legal obligations.
11
Your rights
Subject to applicable law, you have the right to access, correct, and delete your personal data; to restrict or object to processing; to data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority - in the Netherlands, the Autoriteit Persoonsgegevens.
Where we process your data on behalf of your organization, we will refer your request to them and assist as their processor. To exercise a right, contact privacy@hyperture.ai.
12
Controller & processor roles
Because HYPERTURE is a team product, your employer or organization is usually the controller of team members' personal data, and HYPERTURE acts as its processor - processing photos and account data on the organization's documented instructions. Our Data Processing Addendum sets out those terms and forms part of the agreement with the customer.
For our own website visitors, billing, and marketing, HYPERTURE is the controller and this policy applies directly.
13
Cookies & analytics
We use essential cookies to run the service and, with your consent where required, analytics to understand how the site and product are used so we can improve them. You can manage non-essential cookies through your browser settings or our cookie controls. We do not use your uploaded photos for advertising.
14
Children
HYPERTURE is a business service intended for people aged 18 and over. We do not knowingly process the personal data of children. If you believe a child's data has been uploaded, contact us and we will delete it.
15
Changes to this policy
We may update this policy from time to time. We'll post the new version here with an updated effective date, and where a change materially affects your rights, we'll give you appropriate notice and, where required, ask for consent.
16
Contact
For questions about this policy or to exercise your rights, contact our privacy team at privacy@hyperture.ai.