Privacy Policy

Last updated: October 19, 2026

Fotoya is operated by SIA Billy, registered at Ulbrokas iela 23, Rīga, LV-1021, Latvia (reg. 40203676674). We are the data controller (GDPR) and personal information handling business operator (個人情報取扱事業者, APPI) for information collected through fotoya.tokyo.

Legal basis for processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): Processing your photo, at your request, to create your headshots, show you the preview and deliver them after purchase (including steps taken before entering into the contract).
• Legitimate interest (Art. 6(1)(f)): Security measures, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c)): Transaction records required by law are kept by our payment providers (Stripe and KOMOJU). We do not keep purchase records ourselves.

What we collect

fotoya.tokyo has no accounts or sign-up. We do not create order records linked to your name or email address.

• Order data: A random order number (part of your private link), the style you chose, the order status, the amount paid and the payment session ID. No name, address or card details (payments are handled by Komoju or Stripe).
• Generated headshots: The AI-generated result images, stored encrypted with a key derived from your order number.
• Technical data: To prevent rapid repeated uploads, we use your IP address briefly in server memory. We do not store IP addresses, user agents or ad IDs with your order.
• Email address (optional): Only if you ask us to email your download link. Used for that one send and never stored.

What we do NOT collect or store

• Source photos: Your uploaded selfie is never stored. It is held in server memory only while your photos are generated, then discarded.
• Biometric data: We do not extract, store, or process biometric identifiers.
• Training data: Your photos are never used to train AI models.
• Analytics data: We use self-hosted Umami analytics (hosted on our own server in Tokyo, Japan) to understand page visits and usage patterns. Umami does not use cookies, does not collect personal data, and does not track users across websites. No analytics data is shared with or sold to third parties.

How we use your data

We use your data solely to:

• Generate and deliver your headshots
• Process payments
• Email your download link when you ask for it
• Measure advertising effectiveness (only with your marketing cookie consent; see “Marketing and ad measurement” below)

Marketing and ad measurement

To measure the effectiveness of our ads on platforms such as Meta (Facebook/Instagram), X and TikTok, we use the following tools only with your explicit consent. You can withdraw consent at any time from the cookie settings at the bottom of the site.

If you consent to marketing cookies: the Meta Pixel, X Pixel and TikTok Pixel are loaded, and events such as page views and completed purchases (amount only — no photos, names or email addresses) are sent to each provider.

If you do not consent: these tags are not loaded and nothing is sent. We do not send any data from our servers to advertising platforms (no conversion APIs).

AI provider data sharing

Your uploaded photo is first checked with AWS Rekognition in the Tokyo region: face detection and screening for explicit content. This processing is transient, no data is stored, and the photo does not leave Japan at this stage.

Only a photo that passes this check is sent to OpenAI (United States) to generate your headshots, together with a fixed preset prompt.

Your photo is used solely for this generation request and is not used to train AI models. OpenAI does keep the data it receives for up to 30 days to monitor for abuse of its API, after which it is deleted under OpenAI’s terms. We operate under OpenAI’s API terms:

• OpenAI Usage Policies

Cross-border data transfers

GDPR (Art. 44–49)

SIA Billy is established in the EU (Latvia). When your uploaded photo is sent to OpenAI for generation, the photo data is transferred to servers in the United States. This transfer is protected by the following safeguard:

• OpenAI: Transfer governed by Standard Contractual Clauses (SCCs) incorporated in OpenAI’s Data Processing Agreement for API users.

In both cases, the transferred data is limited to a single photo per request. The photo is not used for training; OpenAI keeps it for up to 30 days for abuse monitoring and then deletes it. No biometric data is extracted. The transfer is strictly necessary to create and deliver the headshots you requested.

APPI Art. 28 (cross-border provision to third parties in foreign countries)

When you upload a photo, we give you the following information and obtain your consent to the provision of your data to third parties in a foreign country (APPI Art. 28(1)). Without that consent, your photo is not sent.

• Recipient and purpose: OpenAI, Inc. (United States) — AI generation of your headshots.
• Country: United States of America.
• Personal data protection system in that country: The US has no comprehensive federal personal data protection law equivalent to Japan’s APPI. Personal data is protected by state laws such as the California Consumer Privacy Act (CCPA/CPRA) and by Federal Trade Commission (FTC) enforcement, among others.
• Measures taken by the recipient: Under OpenAI’s API terms and Data Processing Agreement, the data is not used to train AI models and is kept for up to 30 days for abuse monitoring, then deleted.
• Meta Platforms, Inc. (United States) / X Corp. (United States) / TikTok Pte. Ltd. (Singapore): For ad measurement (only with marketing cookie consent; sent directly from your browser). No photos are included.

You can ask us about any of this at support@fotoya.tokyo.

Data storage and security

Generated headshots are stored in AWS S3 (Tokyo) with server-side encryption (SSE-C) using a per-order key. Only people who have your private link (order number) can view them, so share it with care. All data is transmitted over HTTPS. We follow security best practices including CSP headers, rate limiting, and regular security audits.

Your rights

GDPR (EU residents)

As an EU-based company, we comply with GDPR. You have the right to:

• Access: Request a copy of your data by emailing support@fotoya.tokyo.
• Erasure: Delete your order and photos at any time with the delete button on the result page, or send us your private link and we will delete them.
• Portability: Request an export of your data.

APPI (Japan residents)

Customers in Japan have the following rights under the Act on the Protection of Personal Information (個人情報保護法):

• Notification of purpose of use: You may request notification of the purpose for which your personal information is used.
• Disclosure: You may request disclosure of your retained personal data held by us.
• Correction, addition, or deletion: You may request correction if your personal data is inaccurate.
• Suspension of use or erasure: You may request suspension of use or erasure if your personal data is being used beyond the stated purpose.
• Cessation of third-party provision: You may request that we cease providing your personal data to third parties.

For rights requests, contact support@fotoya.tokyo. Because we keep nothing that links an order to a person, we need your private link to find your order.

Cookies

We use the following two categories of cookies. You can give or withdraw consent at any time from the cookie settings at the bottom of the site.

• Essential cookies (cannot be disabled): Cookies required for the site’s basic functions, such as the cookie that keeps track of your order in progress (fty_booth), including security-related cookies set by Cloudflare. Our analytics (Umami) does not use cookies.
• Marketing cookies (opt-in): Ad measurement by Meta (Facebook/Instagram), X and TikTok. See “Marketing and ad measurement” for details.

Third-party processors

Data retention

• Source photos: Never stored (held in memory during generation only, then discarded).
• Generated headshots and order records: Permanently deleted 30 days after purchase, or as soon as you delete them from the result page.
• Unpaid orders: Deleted automatically after 24 hours, including the generated (encrypted) photos and previews (3 days while a konbini or Pay-easy payment is pending).
• Technical data (IP address etc.): Not stored.
• Email address: Never stored.
• Transaction records: Records required by law are kept by our payment providers (Stripe and KOMOJU).

Supervisory authority

Our lead supervisory authority under GDPR is the Data State Inspectorate of Latvia (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, Latvia — www.dvi.gov.lv. You have the right to lodge a complaint with this authority or with the supervisory authority in your country of residence.

Customers in Japan may also consult or lodge complaints with the Personal Information Protection Commission (個人情報保護委員会).

Contact

For privacy inquiries: support@fotoya.tokyo

Personal information handling business operator: SIA Billy, Ulbrokas iela 23, Rīga, LV-1021, Latvia (reg. 40203676674)