Privacy Policy

1. Overview

SnapAU.ai ("we", "us", "our") is an AI-powered professional headshot and photo platform available at snapau.com.au. This policy explains what personal information we collect, why we collect it, and how we protect it.

By using our services you consent to the practices described below. If you do not agree, please do not use SnapAU.ai.

2. Information We Collect

Account information (APP 3)

• Email address — used for login, order notifications, and support
• Password — stored as a bcrypt hash; we never store the plaintext
• Referral code — optional, provided at sign-up
• Language preference — stored in a first-party cookie (snapau_locale)

Facial biometric data — sensitive information (APP 3.3)

• The selfie or reference photo you upload to generate AI headshots
• AI-generated output images produced for your account

We do not use your facial images to train shared or public AI models. Your photos are processed exclusively to generate your personal headshots.

Payment information

All payments are processed by Stripe (PCI-DSS Level 1 certified). We do not store your card number, CVV, or full payment details. We retain only a Stripe session reference and order status.

Usage data

• IP address, browser type, and device information (standard web server logs)
• Feature usage logs (generation requests, timestamps) for service improvement

3. How We Use Your Information (APP 6)

• AI generation: Your uploaded photo is passed to our AI pipeline to produce headshots. It is used for no other purpose.
• Payment processing: Order details are sent to Stripe to complete your purchase.
• Account management: Your email is used for login, order confirmations, and important service notifications.
• Customer support: We may reference your account details when responding to enquiries.
• Service improvement: Aggregated, anonymised usage statistics (never linked to individuals).

We do not sell, rent, or share your personal information or photos with third parties for marketing purposes.

4. Data Storage and Security (APP 11)

• Our database and primary infrastructure is hosted in Australia (Sydney region)
• All data is encrypted in transit using TLS 1.2 or higher
• Images stored in Cloudflare R2 use server-side encryption at rest
• Access to production systems is restricted to authorised personnel only

Retention and automatic deletion

• Uploaded selfies: Automatically and permanently deleted within 14 days of upload — no manual step required
• Generated headshots: Stored in your dashboard for 180 days so you can re-download; deleted automatically after that
• Account data: Retained while your account is active; deleted within 30 days of an account deletion request
• Payment records: Retained for 7 years to comply with Australian taxation law
• Server logs: Purged automatically after 90 days

5. Third-Party Data Sharing (APP 6)

We share your data only with the following service providers, and only to the minimum extent required to operate the service:

We do not sell your data to any third party.

6. Cross-Border Disclosure (APP 8)

Some of our AI inference providers (fal.ai, Anthropic) are based outside Australia. Before your photo is sent to these providers for processing, you are notified and your use of the service constitutes consent under APP 8.1(a). These providers process your photo only transiently to generate the output image; they do not store or retain it. We take reasonable steps to ensure these providers uphold privacy standards substantially similar to the APPs.

7. Your Rights (APP 12 & APP 13)

Under the Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or out-of-date information
• Delete your account and associated data (email us — done within 30 days)
• Withdraw consent for processing your facial images at any time
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your information

OAIC contact: oaic.gov.au/privacy/privacy-complaints · 1300 363 992

To exercise your rights, email us at hello@snapau.com.au. We will respond within 30 days.

Account deletion

Email hello@snapau.com.au with subject line "Delete my account". We will confirm deletion within 30 days. Payment records are retained for 7 years as required by Australian law.

8. Cookies

• Essential: snapau_locale (language preference), Supabase auth session cookie — required for the service to function
• Analytics: We do not currently use third-party analytics cookies. If this changes, we will update this policy and request consent.

We do not use advertising or tracking cookies.

9. Children's Privacy

SnapAU.ai is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, please contact us immediately and we will delete the account within 48 hours.

10. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify registered users by email at least 14 days before the change takes effect. The effective date at the top of this page reflects the latest revision.

11. Contact Us