ExecShot is operated by CRAFTDLAB (SMC-PRIVATE) LIMITED (“CraftdLab,” “we,” “our,” or “us”), which is the data controller for the personal data described in this Privacy Policy. This Policy explains what ExecShot collects, how it is collected and used, when it is shared, how long it is retained, and the controls available to you.
Information we collect
Photos, instructions, and generated content
When you use ExecShot’s headshot features, we collect:
- photos you select from your device or capture with the camera;
- optional reference photos you choose to provide;
- headshot customization choices, including clothing, hairstyle, background, expression, color grade, pose, and other style selections;
- custom instructions you enter for the requested headshot; and
- the professional headshots generated from your request.
ExecShot receives only the photos you deliberately select or capture for the feature you request. Photos may contain facial characteristics and other personal details. ExecShot uses those photos only to provide requested app functionality and AI processing that you authorize. You should upload only photos that you own or have permission to use.
Account information
Depending on how you use or sign in to ExecShot, we collect:
- your name, when you provide it;
- your email address or Apple private relay address;
- the identifier Apple provides when you use Sign in with Apple;
- an internal user ID used to keep your account data separate and secure; and
- authentication information needed to keep you signed in.
ExecShot does not receive your Apple Account password.
Subscription and purchase information
We collect subscription status and purchase history needed to provide credits, paid features, restore purchases, verify entitlements, prevent duplicate credits, and resolve transaction issues. This may include the purchased product, entitlement status, renewal or expiration information, transaction identifiers, credit balances, and generation usage.
Apple processes App Store payments. CraftdLab does not receive or store your full payment card number or banking information.
Technical and operational information
ExecShot and its service providers collect limited technical information needed for security, reliability, fraud prevention, and troubleshooting. This may include an IP address, request date and time, app and operating-system version, authentication and request identifiers, network or server errors, and basic device or connection information.
Support communications
If you contact us, we collect your contact details, the contents of your message, and any information or attachments you choose to provide so we can respond to your request.
How we collect information
We collect information in the following ways:
- Directly from you: when you select or capture a photo, provide an optional reference photo, choose a style, enter custom instructions, create or update an account, contact support, or otherwise use the app.
- Through Sign in with Apple: when you choose that sign-in method, Apple provides the account identifier and the name and email address—or Apple private relay address—that you authorize Apple to share.
- Through Apple and RevenueCat: when you purchase a subscription or paid feature, we receive the purchase, subscription, and entitlement information needed to provide credits and paid access.
- Automatically during app operation: our systems and service providers receive essential technical information when you connect to or use ExecShot so we can secure, operate, and troubleshoot the service.
How we use information
We use the information described above to:
- generate the professional headshots you request;
- apply your selected styles, customization choices, and custom instructions;
- store and display generated headshots in your private library;
- create, authenticate, maintain, and secure your ExecShot account;
- process subscriptions and verify access to credits and paid features;
- restore purchases and maintain accurate credit and entitlement records;
- prevent duplicate requests, fraud, misuse, and free-generation abuse;
- maintain service reliability and troubleshoot technical problems;
- respond to privacy, support, and account requests;
- comply with legal obligations; and
- protect ExecShot, its users, and our service providers.
AI processing and your permission
ExecShot uses third-party AI processing to turn the materials you provide into a professional headshot. Before ExecShot sends personal data for AI processing, the app asks for your explicit permission and explains what will be sent and who will process it.
What is sent
The AI-generation request may include the photo you selected or captured, any optional reference photo, your selected styles and customization choices, and your custom instructions. ExecShot shares this information only to provide the AI headshot generation you requested—not for advertising or cross-app tracking.
How the request is processed
- Your photos, optional reference photos, selected styles, and custom instructions are sent through ExecShot’s backend hosted by Supabase.
- Where applicable, the input photos are kept in private Supabase Storage and made available for processing through short-lived, secured links.
- The secured links and generation instructions are provided to Replicate.
- Replicate processes the request using OpenAI’s GPT Image model.
- The generated headshot is returned to ExecShot and placed in your private library.
Your control
You may decline AI-processing permission. If you decline, ExecShot does not upload the photos, reference photos, style choices, or custom instructions for AI processing, and the generation does not begin.
You may withdraw permission later from Account → Privacy & Data → AI Photo Processing. Withdrawal prevents future AI submissions. It does not reverse processing already completed or remove generated headshots already stored in your private library; you can delete those images using the controls described below.
Service providers and sharing
ExecShot uses the following service providers:
- Supabase provides authentication, database services, backend functions, and secure, private file storage. Supabase Privacy Policy
- Replicate receives secured links and generation instructions and coordinates the requested AI image processing. Replicate Privacy Policy
- OpenAI provides the GPT Image model used through Replicate to process the requested AI headshot generation. OpenAI Privacy Policy
- RevenueCat receives subscription and purchase information needed to verify entitlements, restore purchases, and provide credits and paid features. RevenueCat Privacy Policy
- Apple provides App Store distribution, subscriptions and purchases, transaction information, entitlement-related services, Sign in with Apple where used, and system photo, camera, save, and sharing interfaces. Apple Privacy Policy
We share only the information reasonably necessary for each provider to deliver the service described above. We do not authorize these providers to use ExecShot user data for third-party advertising or cross-app tracking.
Service providers are expected to process information only for the services they provide and to maintain privacy and security protections consistent with this Policy, ExecShot’s obligations, and applicable law. Their own processing and retention practices are also governed by the applicable provider terms, agreements, and privacy policies. This Policy does not make promises about a provider’s model-training or retention practices beyond those applicable terms.
We may also disclose information when reasonably necessary to comply with law or valid legal process, investigate fraud or security threats, protect users or the public, enforce our agreements, or complete a merger, acquisition, financing, reorganization, or transfer of the service subject to appropriate protections.
Storage and retention
- Input and reference photos: These files are temporarily stored in secure, private Supabase Storage for processing and are removed after normal processing completes. Short-lived signed links are used where applicable to provide temporary access for the requested generation.
- Interrupted or failed requests: If a request is interrupted or fails, temporary input files may remain until automated cleanup removes them or you delete your account.
- Generated headshots: Generated images remain in your private library until you delete an individual photo, use “Delete My Photos,” or delete your ExecShot account.
- Customization information: Style selections and custom instructions may be retained with the associated generation record until that record is deleted.
- Account and purchase records: Account, subscription, entitlement, purchase, credit, and transaction records may be retained as necessary for account operation, purchase restoration, fraud prevention, dispute resolution, legal compliance, and transaction records.
- Technical and support records: Essential logs and support communications are retained only as reasonably necessary for security, reliability, fraud prevention, troubleshooting, support, backup, and legal compliance.
Service providers may retain limited operational records or backup copies under their own applicable terms, agreements, legal obligations, and retention policies.
Privacy practices
ExecShot:
- does not sell personal data;
- does not use personal data for third-party advertising;
- does not perform cross-app tracking;
- does not request Apple’s advertising identifier; and
- uses photos only for the app functionality you request and the AI processing you authorize.
If you choose to save or share a generated headshot through Apple’s system interfaces, the destination app, service, or recipient you choose controls what happens to the exported image after it leaves ExecShot.
Your choices and rights
AI-processing permission
You can decline permission before an AI request is submitted. You can withdraw permission for future submissions at any time from Account → Privacy & Data → AI Photo Processing. Withdrawal does not reverse processing already completed.
Delete generated photos
You can delete individual generated headshots from your private library or use Delete My Photos to remove your generated photos and associated generation records. Purchase, credit, and completed usage records may remain where necessary for the purposes described in this Policy.
Delete your account
You can delete your ExecShot account and associated app data from Account settings. Account deletion removes your profile, generated headshots, and associated app data from ExecShot’s active systems, subject to the limited retention described above.
Deleting your ExecShot account does not automatically cancel an App Store subscription. You must manage or cancel the subscription separately through Apple.
Access, correction, and other privacy requests
Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or an export of your personal data, and to object to certain processing. You can contact CraftdLab using the details below. We may need to verify your identity before completing a request.
Legal bases for processing
Where applicable law requires a legal basis, we rely on one or more of the following:
- Performance of a contract: to operate ExecShot, generate requested headshots, maintain your library, and provide purchases, credits, and paid features.
- Consent: for AI photo processing and other processing for which we ask your permission.
- Legitimate interests: to secure and operate the service, prevent fraud and abuse, troubleshoot problems, provide support, and maintain reliable operations where those interests are not overridden by your rights.
- Legal obligations: where processing or retention is required by law.
Where processing is based on consent, you may withdraw that consent for future processing. Withdrawal does not affect processing that was lawful before withdrawal.
International data transfers
CraftdLab and the service providers identified in this Policy may process information in countries other than the country where you live. Those countries may have different data-protection laws. Where required, appropriate safeguards are used for international transfers in accordance with applicable law.
California and other U.S. privacy rights
Residents of California and certain other U.S. states may have rights to know, access, correct, or delete personal data and to obtain information about how it is disclosed.
CraftdLab does not sell personal data and does not share personal data for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable privacy right.
Requests may be sent to support@craftdlab.com.
Security
We use reasonable technical and organizational measures designed to protect personal data, including encrypted network connections, authentication controls, private storage, user-scoped access rules, and short-lived signed links where applicable.
No online service or storage system can guarantee absolute security. You are responsible for protecting access to your device and Apple Account.
Children’s privacy
ExecShot is designed for professional use and is not directed to children under 13, or a higher minimum age where required by local law.
We do not knowingly collect personal data from children below the applicable minimum age. If you believe a child has provided information to ExecShot, contact support@craftdlab.com, and we will take appropriate steps in accordance with applicable law.
Changes to this Privacy Policy
We may update this Privacy Policy when ExecShot’s features, data practices, service providers, or legal obligations change. The revised Policy will show a new “Last updated” date. Where required, we will provide additional notice of material changes.
Contact and data controller
The data controller responsible for ExecShot is CRAFTDLAB (SMC-PRIVATE) LIMITED.
For privacy questions, data requests, account deletion, or support, contact:
CRAFTDLAB (SMC-PRIVATE) LIMITED
Lahore, Pakistan
Email: support@craftdlab.com
Website: https://craftdlab.com