Privacy policy
Effective date: September 14, 2026
Last updated: September 14, 2026
Biometric Photos LLC ("PassportPhotos AI", "we", "us") runs passportphotos.ai and the photo service at photos.passportphotos.ai. This policy explains what we collect when you use the service, what we do with it, who else touches it, how long we keep it, and the choices you have. It is written to be read. Where the law requires specific wording, that wording is in the section for that state.
The short version: you upload a photo, our software uses it to make the photo you ordered, we delete it 30 days after delivery, and we never use it to train AI. You can delete it sooner with one click.
1. What we collect
Photos you upload or take. The original photo, the finished photo, and the working files in between (the cropped version, the version with the replaced background, the print sheet, and the retouched version if you bought retouching).
Face and image measurements. To make a document photo, our software measures where the face is in the photo: the position of the eyes, chin and top of the head, whether the eyes are open, whether glasses or a head covering are present, head tilt, brightness and sharpness. Some of these measurements are made on your own phone, inside the browser, before anything is uploaded. Others are made on our servers after you tap Continue. These measurements may be considered biometric identifiers or biometric information under some state laws. Section 4 covers that in full.
Order details. Your name, email address, the document you chose, the product you bought, the delivery option, the store you chose for pickup, and for mailed prints your shipping address. Payment is handled by Shopify; we never see your full card number.
Order notes. Anything you type in the order note at checkout, for example a disability or an accessibility need that affects the photo. We use it only to make your photo and answer your questions about it.
Technical data. IP address, browser and device type, pages visited, the events in the upload flow (uploaded, passed the initial check, reached checkout, paid, delivered), and error logs. We use Shopify's analytics and Google Analytics 4 for this.
Support messages. Emails you send to hello@passportphotos.ai, and rejection documents you send us to claim the guarantee.
We do not collect photos of anyone from any source other than you.
2. What we use it for
- To make the photo you ordered: crop, background replacement, resizing, the checks against the published rules, and retouching if you bought it.
- To deliver it by email, on your order page, by mail or by pickup at a location.
- To place print orders at the store you chose, or with our fulfillment center for mailed prints.
- To send the emails about your order: paid with the download, pickup ready, shipped.
- To honor the guarantee and process refunds.
- To keep the service working, find and fix errors, and prevent fraud and abuse.
- To answer your questions.
What we never use your photos for. We do not use your photos, or any measurements taken from them, to train, improve or evaluate any artificial intelligence or machine learning model, ours or anyone else's. We do not sell them. We do not share them for advertising. We do not use them for anything except your order.
3. Who else handles your data (subprocessors)
We use other companies to run parts of the service. Each one receives only what it needs for its part. The image and face processing companies are bound by contract not to use your photos to train their own models.
| Company | What it does for us | What it receives |
|---|---|---|
| Shopify Inc. | Storefront, cart, checkout, payment processing, order records, receipt emails | Name, email, order details, shipping address for mailed prints, payment details (Shopify only; we never see the full card number) |
| Photoroom (Artizans of Photo Video Pixel SAS) | Replaces the background of your photo | The photo |
| Amazon Web Services, Inc. (Amazon Rekognition) | Detects the face and reports attributes needed for the check: eyes open, mouth open, glasses, head pose, face covered, brightness, sharpness | The photo |
| Google LLC (Gemini image model) | Replaces the background when our first tool cannot | The photo |
| Resend, Inc. | Sends our order, download, pickup and shipping emails | Email address, name, order number, the download link |
| Cloudflare, Inc. (R2 storage) | Stores your uploaded and finished photos until they are deleted | The photos and working files |
| Railway Corp. | Runs our photo service and the print queue | All service data in transit and in memory |
| Our support staff and contractors | Answer your questions, handle guarantee claims and place pickup print orders | The photo, the check results, the document chosen, the order note |
| Walgreens, Duane Reade, CVS, Walmart and Target stores | Print and hand you your prints, if you chose pickup | The print sheet, the name you gave for pickup, the store you chose |
| Inventfin Capital, LLC (our fulfillment center in Great Neck, NY) | Prints, packs and mails your prints, if you chose mailed prints | The print sheet, your name and shipping address |
| Slack Technologies, LLC | Our internal queue for pickup print orders and refund requests | The print sheet, the name for pickup, the store, the order number |
| Google LLC (Google Analytics 4, Google Workspace) | Website analytics; our support inbox | Technical data; the emails you send us |
| Trustpilot A/S | Review invitations after an order, and reviews you choose to leave | Name, email, order number |
| Functional Software, Inc. (Sentry) and Better Stack | Error and uptime monitoring | Technical data and error logs, which may include an order number but never a photo |
The measurements made on your phone during live guidance are made by open source software (Google MediaPipe) running inside your browser. Nothing from that step is sent to Google or to us until you tap Continue.
We will update this table when a provider changes. Old versions are available on request.
We do not sell your personal information. We do not share it with anyone for their own marketing. We may disclose it if the law requires, to protect our rights or someone's safety, or to a buyer if the business is sold, in which case this policy continues to apply to your data.
4. Biometric data: notice, consent and retention
Some state laws treat measurements of a person's face as biometric identifiers or biometric information. This section is the notice those laws require, and it applies to everyone who uses the service, wherever you live.
What we collect and why. When you take or upload a photo, our software measures the position of your facial features (eyes, chin, top of the head), whether your eyes are open and your mouth closed, whether glasses or a head covering are present, and your head's tilt and rotation. The only purpose is to produce the photo you ordered, including cropping and sizing it correctly and checking it against the rules for your document. Our support staff see the photo and those measurements only to answer a question you raise about your order. We do not use these measurements to identify you, to match you against any database, to recognize you in other photos, or for any other purpose.
How long we keep it. These measurements are kept only while your order is processed and are deleted with the rest of your order files no later than 30 days after delivery, or immediately when you press delete now. That is our written retention schedule. The measurements are destroyed when the purpose for collecting them, making your photo, is satisfied, and in every case within 30 days of delivery. This is well inside the outer limits set by the Illinois and Texas laws described below.
How we protect it. Photos and measurements are stored encrypted in transit and at rest, access is limited to the systems and people needed to make and deliver your photo, and they are handled with at least the same care as our other confidential information.
We never sell, lease, trade or profit from your biometric data. We disclose it only to the subprocessors listed in Section 3 that need it to make your photo, and only for that purpose.
Your consent. Before the camera opens or an upload begins, the screen tells you that facial measurements will be collected for the purpose above and kept for at most 30 days after delivery, and asks you to agree. Continuing without agreeing is not possible. That agreement is your written release for the purposes of the laws below. We keep a record of the time you agreed with your order.
Illinois residents (Biometric Information Privacy Act, 740 ILCS 14). This section, together with the consent screen, is the written notice that a biometric identifier or biometric information is being collected and stored, the specific purpose and length of time for which it is collected, stored and used, and your written release. Our retention schedule and destruction guidelines are stated above and are publicly available on this page.
Texas residents (Capture or Use of Biometric Identifier Act, Business and Commerce Code section 503.001). We inform you before capturing a biometric identifier and obtain your consent, as described above. We do not sell, lease or otherwise disclose your biometric identifier except as allowed by that law and described in Section 3, we store it with reasonable care, and we destroy it within a reasonable time after the purpose for collecting it expires, in every case within 30 days of delivery and well within one year.
Washington residents (RCW 19.375) and residents of other states with biometric or consumer privacy laws. The notice, consent, purpose limit and retention rules above apply to you in the same way.
Uploading someone else's photo. If you upload a photo of another person, you must have that person's permission to upload it and to have their facial measurements processed as described here. For a child, see Section 6.
5. How long we keep things
| Data | Kept for |
|---|---|
| Uploaded photos, finished photos, working files, facial measurements | 30 days after delivery, or until you press delete now, whichever is first |
| Order records (name, email, what you bought, delivery choice, refunds) | 7 years, for tax and accounting |
| Order notes | Deleted with the photo files |
| Rejection documents sent to claim the guarantee | 90 days after the claim is settled |
| Support emails | 2 years |
| Technical logs | 30 days |
Delete now. Every order page has a delete now link. Pressing it deletes your uploaded photo, the finished files and the facial measurements at once. It also ends your ability to download the photo again, so save a copy first. Deleting the photos does not delete the order record, which we keep for accounting.
6. Children
The service is for adults. We do not knowingly allow anyone under 18 to buy from us, and we do not knowingly collect personal information directly from a child under 13.
Parents and legal guardians do use the service to make passport and visa photos of their children, including babies. When you do, you are uploading your child's photo as their parent or guardian, you consent on their behalf to the collection and processing described in Section 4, and the retention and deletion rules apply to the child's photo exactly as they would to yours. Only a parent or legal guardian may upload a photo of a minor. If you believe a child's photo has been uploaded without a parent's consent, email hello@passportphotos.ai and we will delete it.
7. Your rights
Everyone can do the following, and we do not need a legal reason to help you:
- Delete your photos now. The delete now link on your order page, or email us.
- Get a copy of what we hold about you. Email us and we will send it within 30 days.
- Correct something. Email us.
- Stop marketing emails. We send very few. Every one has an unsubscribe link. Order emails are not marketing and continue while you have an open order.
California residents. Under the California Consumer Privacy Act as amended, you have the right to know what personal information we collect, use, disclose and sell or share, and to access it; the right to delete it; the right to correct it; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising any of these. Biometric information is sensitive personal information; we use it only to provide the service you asked for, which is a permitted use, so there is no additional use to limit. We do not sell personal information and we do not share it for cross context behavioral advertising, and we have not done so in the past 12 months, so there is no opt out to exercise. The categories of personal information we collect, the purposes and the recipients are set out in Sections 1 to 3. To exercise a right, email hello@passportphotos.ai or call 516-231-9449. We will verify your identity by matching your email to the order, and we will respond within 45 days. You may use an authorized agent; we will ask for proof of the agent's authority. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing.
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with consumer privacy laws. You have similar rights to access, correct, delete and obtain a copy of your data, and to opt out of targeted advertising, sale and profiling. We do none of those three. Email us to exercise a right. If we refuse a request, you can appeal by replying to our answer, and we will respond to the appeal within 45 days.
Everyone else. The same rights, by email, whether or not a law requires it.
8. Security
Photos are sent to us over an encrypted connection and stored encrypted. Access is limited to the systems and people needed to make, deliver and support your photo. Support and print queue staff see only what their step needs and are bound by confidentiality terms. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
9. Where the data lives
We are a United States business and the service runs on servers in the United States. Some subprocessors in Section 3 are based outside the United States (Photoroom is in France, Trustpilot is in Denmark). Support and print queue staff may work from outside the United States and see the photo only through our internal tools. If you use the service from outside the United States, your data is processed in the United States.
10. Cookies and analytics
The storefront uses cookies that Shopify needs for the cart and checkout, and analytics cookies from Shopify and Google Analytics 4 to understand how the site is used. The photo service uses a session token to keep your upload attached to your order. We do not allow third party advertising trackers to receive your photo. If we run advertising conversion tags, they receive order events, never images. Your browser lets you block cookies; the cart may not work if you block Shopify's.
11. Changes to this policy
When we change this policy we update the date at the top and, for a change that affects how your photos or biometric data are used, we post a notice on the site for 30 days. The version in force when you placed an order is the one that applies to that order.
12. Contact
Biometric Photos LLC
11 East 86th Street, 20th Floor, New York, NY 10028
hello@passportphotos.ai
516-231-9449
We answer privacy questions and requests from that inbox. Put "Privacy" in the subject line and we will get to it faster.