Portrais creates studio-quality headshots from reference photos of you. Doing so means processing photographs of your face — sensitive personal data — so we explain clearly below what we collect, why, who we share it with, how long we keep it, and the rights you have.
Who we are
Portrais is operated by lalec (lalec.ch), a sole proprietorship based in Switzerland, which is the controller of your personal data (“we”, “us”). For any privacy question or request, contact privacy@portrais.com.
The law that applies
We process personal data under the Swiss Federal Act on Data Protection (revFADP). If you are in the European Economic Area or the United Kingdom, the EU/UK GDPR also applies, and its rights and legal bases apply to you in addition to your rights under Swiss law.
What we collect
| Category | What it is | Why |
|---|---|---|
| Account | Your email address, via Google Sign-In. | To create your account, sign you in, and contact you about your order. |
| Reference photos | The photos of your face that you upload — biometric, sensitive personal data. | Only to generate your headshots. Never to build a biometric profile or identify you elsewhere. |
| Generated images | The headshots we produce for you. | To deliver and display your order for download. |
| Order & payment | Your package and payment status. Card details go directly to Stripe — we never see or store your card number. | To process your purchase and handle support and refunds. |
| Usage & device | Analytics events, approximate location, device/browser, and IP address. Analytics is collected only if you accept it in the banner we show on your first visit. | To run, secure, and improve the service. |
How your photos are processed by AI
To create your headshots, your reference photos and the resulting images are processed by Google Cloud Vertex AI acting as our processor, solely to render your order. Google does not use this data to train its foundation models, and we do not use your photographs to train any model of our own.
Legal bases
- Contract — to create your account and produce and deliver the headshots you order.
- Explicit consent — to process the biometric data in your reference photos. You give it when you upload photos, and it covers the photos you upload for this purpose, now and later. You can withdraw it at any time in your account settings, which also deletes the photos you uploaded.
- Consent — for analytics. We load Google Analytics only after you accept it in our banner, and you can withdraw at any time (see “Cookies and analytics” below).
- Legitimate interests — to secure the service and prevent abuse.
Sharing and sub-processors
We do not sell your personal data. We share it only with the providers needed to run Portrais:
| Provider | Purpose |
|---|---|
| Google Cloud / Firebase | AI image generation, storage, database, authentication, analytics, and hosting. |
| Stripe | Payment processing. |
| ImprovMX | Email forwarding. |
We may also disclose data where required by law or to protect our users’ rights and safety.
International transfers
Our providers may process data outside Switzerland and the EEA. Where they do, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses and recognised Swiss transfer mechanisms.
Data retention
- Reference photos are deleted automatically 7 days after upload.
- Generated headshots are deleted automatically 90 days after they are produced — download anything you want to keep before then.
- Account and order records are kept while your account is active and as long as tax and accounting law requires.
- You can delete any past run from your dashboard at any time.
- Withdrawing your consent deletes your uploaded reference photos — both the originals and the full-resolution copies kept alongside each pack. If a pack is still being generated we delete them as soon as it finishes, because it is still using them. Your delivered headshots are not affected.
- We keep the record that you gave consent and that you withdrew it, with the dates, because we have to be able to show that the processing was allowed while it ran and that it stopped when you said so.
Your rights
You can withdraw your consent to biometric processing at any time under Account in the app. It takes effect immediately, stops any new pack from starting, and deletes the reference photos you uploaded. Withdrawing does not affect processing already carried out, and the headshots already delivered to you stay yours.
Subject to applicable law, you can also request access to, correction of, deletion of, or a copy of your data, and restrict or object to certain processing. Email privacy@portrais.com to exercise any of these. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EEA/UK, your local authority.
Security
Your data is stored in private, access-controlled storage and transmitted over encrypted connections, with access tied to your authenticated account. No system is perfectly secure, but we apply measures appropriate to the sensitivity of the data.
Cookies and analytics
Strictly-necessary cookies and similar identifiers keep you signed in and secure payments; these are always set. Analytics cookies are different: on your first visit we ask, and until you accept, Google Analytics is not loaded at all — no analytics request is sent to Google and no analytics cookie is set. If you reject, it stays that way. We use no advertising or cross-site tracking cookies, and advertising and personalisation signals are switched off permanently.
Your choice is stored in your browser under the key portrais_consent and applies to that browser only. To withdraw it — or to change your mind after rejecting — clear this site’s cookies and site data in your browser settings; the banner reappears on your next visit and analytics stays off until you accept again.
Children
Portrais is not directed at children. You must be at least 16 to use it, and you may upload photos of someone under 18 only as their parent or legal guardian.
Changes
We may update this policy from time to time; the “Last updated” date above reflects the current version, and we will flag material changes where appropriate.
Contact
Questions or requests: privacy@portrais.com.