Privacy Policy

1. Data controller

The data controller is FORUM D&P SARL, a société à responsabilité limitée registered in France (SIREN 985014463, VAT FR93985014463, registered office 24 Bd Masséna, 75013 Paris). Contact: contact@forumdnp.com

2. What we collect

• Email address — for delivery, support, and refund correspondence.
• Source selfies (10–15 photos) — for training your personalized AI model.
• Generated outputs — the AI headshots we produce for you.
• Payment metadata — Stripe transaction ID, last 4 digits of card, country. We never see or store full card numbers.
• Technical logs — IP address, request timestamps, error traces. Retained 30 days for security and abuse detection.

3. Legal basis (GDPR Art. 6)

• Contract performance (Art. 6.1.b) — generating and delivering your headshots.
• Legal obligation (Art. 6.1.c) — VAT invoicing, accounting records (7 years).
• Legitimate interest (Art. 6.1.f) — fraud prevention, service security.
• Explicit consent (Art. 6.1.a + 9.2.a) — biometric processing of facial features. You consent at upload by checking the consent box.

4. Retention

• Source selfies — auto-deleted from Cloudinary 14 days after forge completion.
• Generated outputs — deleted after the download window (7 days Starter/Pro, 14 days Studio).
• Private LoRA model weights — deleted alongside outputs unless you opt in to retention via email.
• Invoicing & payment records — retained 7 years for French accounting compliance.

5. Third-party processors

We share the minimum data necessary with the following sub-processors, each bound by GDPR-compliant data processing agreements:

• Stripe (Ireland / USA) — payment processing.
• Replicate (USA) — AI model training and inference. Source images deleted after job completion.
• Cloudinary (USA / EU) — image upload, transformation, CDN.
• Resend (USA / EU) — transactional email delivery.
• Vercel + Upstash (USA / EU) — application hosting and job state cache.

No personal data is sold or used for advertising or third-party model training.

6. Your rights (GDPR)

You may exercise at any time:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time (Art. 7.3)

Send requests to contact@forumdnp.com — we respond within 30 days. You also have the right to lodge a complaint with the French data protection authority (CNIL, cnil.fr) or your local supervisory authority.

7. International transfers

Some sub-processors are located in the United States. We rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) as transfer safeguards.

8. Cookies & analytics

We use strictly necessary cookies for session state and for your in-product preferences (locale, wizard progress, helper widget state).

With your explicit consent, we also use a single, anonymised analytics provider (Google Analytics 4 with IP anonymisation, Google Signals disabled, no advertising or remarketing) to understand which parts of HeadForge people find useful. Analytics is opt-in: the consent banner you saw on first visit lets you accept or reject anonymised analytics, and you can change your choice any time by clearing cookies. We do not use third-party advertising or remarketing cookies under any circumstance.

9. Changes

Material updates are notified via email at least 14 days in advance to the address on your most recent order.

10. Contact

FORUM D&P SARL · 24 Bd Masséna, 75013 Paris, France · SIREN 985014463 · contact@forumdnp.com