Consumer health data privacy policy

Washington’s My Health My Data Act treats “biometric data”, including imagery of the face from which an identifier template can be extracted, as consumer health data. Photos of your face are central to Studioless, so we treat them under this law. We do not collect any other kind of health information: no medical conditions, treatments, medications or health records.

• Photos of your face that you take or upload for passport and ID photos or AI headshots.
• Face measurements our software computes in your browser to crop your photo (these stay on your device).
• Face measurements or embeddings our AI provider computes while generating your headshots.
• Generated headshots, which depict your face.
• Photos you send to Studioless Restore, which may show your face or the faces of relatives or others.
• Face measurements our software computes on our own computer while restoring a Studioless Restore photo (never stored).

From you, when you take or upload a photo, and from our software and service providers processing that photo for you.

Only to provide the service you ask for:

• to crop, check and deliver your passport or ID photo;
• to generate, check and deliver your AI headshots;
• to restore the photo you send to Studioless Restore, check the likeness and deliver your files.

We ask for your consent before any face processing starts, and we never use this data for advertising, profiling or AI training.

Processors that act only on our instructions under contract: cloud hosting and storage (Vercel), AI image generation (OpenAI through the OpenAI API, Google through the Gemini API, or fal.ai), AI image repair and, when color is ordered, colorization for Studioless Restore (OpenAI OpCo, LLC, for any restore order; you agree to it on the restore order form), and automated photo and image checks (Anthropic, or OpenAI for headshots). The current list is on our subprocessors page.

Third parties and affiliates: none. We do not sell consumer health data, share it for advertising, or give it to anyone else except when the law, a warrant or a subpoena requires it.

Selfies are deleted within 24 hours of upload. Passport and ID photos and generated headshots are deleted 7 days after your order. Studioless Restore photos are deleted 14 days after an unpaid preview or 30 days after delivery; OpenAI may keep a copy of a Restore photo it received for up to 30 days for abuse monitoring. Face measurements made in your browser never leave your device. The full schedule is in our biometric data policy.

If you are a Washington consumer, you can:

• confirm whether we collect, share or sell your consumer health data, and see it, including the list of processors that received it;
• withdraw your consent;
• have it deleted, including from our processors (a copy OpenAI keeps of a Studioless Restore photo for abuse monitoring is deleted on OpenAI’s own schedule, as above);
• appeal if we decline your request.

Email support@getstudioless.com or use the support form and choose “Privacy request”. We verify requests by email and answer within 45 days. To appeal a decision, reply to it with “Appeal” in the subject; if we deny the appeal, you can contact the Washington State Attorney General.

AboutUsAgency Inc., support@getstudioless.com. See also our privacy policy.