The Master Service Agreement governs the terms under which HeadshotPro provides its services.
Version 1.1 — Enterprise Template | Last Updated: 24-06-2026
This Master Service Agreement (this “Agreement”) is entered into as of the Effective Date set forth in the applicable Order Form (the “Effective Date”) by and between Headshot Pro Photography Pte. Ltd., operating as HeadshotPro (“HeadshotPro,” “we,” “us,” or “our”), and the customer identified in the Order Form (“Customer”). This Agreement governs Customer’s access to and use of HeadshotPro’s AI headshot generation services, websites, and applications (collectively, the “Service”).
This Agreement incorporates the Exhibits expressly attached or named below. In the event of a conflict, the following order of precedence applies, except that Section 12 (Limitation of Liability) governs and controls each party’s monetary liability under this Agreement and all Exhibits notwithstanding anything to the contrary:
The Exhibits expressly named herein are the only exhibits or external terms that govern this Agreement. No other terms, including any consumer or online terms of service published by HeadshotPro, apply.
Definitions
Service; Access; Accounts
Ownership; Use of Data; No Training
Data Protection; Security; Deletion
Service Levels; Credits
Support
Acceptable Use; No Benchmarking
Fees; Taxes; Invoicing; Suspension
Confidentiality
Warranties; Disclaimers; Exclusive Remedies; AI Outputs
Indemnification
Limitation of Liability
Term; Termination; Data Return
Publicity
General
Exhibits — Exhibit A (Information Security) · Exhibit B (Data Processing Addendum) · Exhibit C (AI Terms of Use) · Exhibit D (Standard Support Offering) · Exhibit E (System Architecture Documentation)
“AI Headshots” means images generated by the Service from Customer’s uploaded photos and prompts.
“Customer Content” means photos, prompts, and other content or materials uploaded to or processed by the Service on behalf of Customer or its end users.
“Customer Data” means Customer Content and Customer Personal Data, collectively.
“Order Form” means a mutually executed document or electronically accepted ordering interface specifying the Service tier(s), quantities, pricing, term, and any additional terms.
“Confidential Information” has the meaning set forth in Section 9.
“Security Incident” means a confirmed breach of HeadshotPro’s security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Content or Customer Personal Data. The term “Security Incident” is used throughout this Agreement and the Exhibits in place of, and has the same meaning as, the terms “Data Breach” and “Personal Data Breach.”
“Sub-processor List” means the list of HeadshotPro sub-processors made available at https://www.headshotpro.com/legal/sub-processors, as updated from time to time per Section 4(b).
“Policies” means HeadshotPro’s publicly posted Privacy Policy, Security Policy, and Sub-processor List, each as referenced herein.
(a) Provision of Service. HeadshotPro will make the Service available to Customer in accordance with this Agreement and the Exhibits. HeadshotPro may make non-material modifications or improvements to the Service from time to time that do not materially degrade or remove core functionality, performance, or security. Customer acknowledges that artificial intelligence is the core technology underlying the Service, and that this Agreement constitutes Customer’s authorization for the use of AI in delivering the Service.
(b) Access Controls; SSO. The Service supports passwordless Magic-Link authentication for end users by default. Single Sign-On via SAML 2.0 or OIDC (e.g., Microsoft Entra ID, Okta) is available where elected in the Order Form. For designated administrators, multi-factor authentication is enforced via one-time codes sent to administrator email(s). Customer administrators may revoke user access at any time.
(c) Customer Responsibilities. Customer is responsible for: (i) the accuracy, quality, and lawful use of Customer Content; (ii) configuring allowed email domains and administrator recipients; (iii) the acts and omissions of users authorized by Customer under Customer’s accounts; and (iv) obtaining all necessary consents from individuals depicted in Customer Content.
(d) Opt-In Invitations to Customer Employees. Where Customer elects, HeadshotPro will provide Customer administrators a means to invite Customer’s employees via standard-form email invitations. Such invitations clearly identify the Service as opt-in, and end users may decline to participate without penalty.
(a) Outputs. Subject to Customer’s compliance with this Agreement, HeadshotPro hereby assigns to Customer any right, title, and interest HeadshotPro may have in and to AI Headshots generated from Customer Content. HeadshotPro retains all right, title, and interest in and to the Service, the underlying technology, and any improvements thereto (excluding Customer Content and AI Headshots).
(b) No Model Training. HeadshotPro does not, and will not, use Customer Content or AI Headshots to train, retrain, fine-tune, or otherwise improve HeadshotPro’s or any third party’s generative models. This is an absolute commitment; no opt-in or other exception applies.
(c) Operational Use Only. HeadshotPro processes Customer Content and AI Headshots solely to provide, maintain, secure, and support the Service, and to comply with law and the Policies.
(d) Aggregated/Anonymous Usage Data. HeadshotPro may collect and use technical, operational, and aggregated usage data that does not identify Customer or any individual (“Usage Data”) to operate, analyze, secure, and improve HeadshotPro’s products and services.
(a) Security. HeadshotPro maintains administrative, technical, and organizational measures as described in Exhibit A (Information Security), including encryption in transit and at rest, and operates a program audited under SOC 2 Type II for relevant processes.
(b) Sub-processors; Subscription Notice. Processing is described in the Privacy Policy and Exhibit B (Data Processing Addendum). Customer consents to HeadshotPro’s use of the sub-processors identified on the Sub-processor List. HeadshotPro will provide notice of additions or replacements of sub-processors by (i) updating the Sub-processor List, and (ii) sending email notice to each Customer administrator who has enabled sub-processor change notifications in HeadshotPro’s admin settings (the “Subscription List”). Customer administrators may enable, disable, or update sub-processor notification recipients at any time via the admin settings; HeadshotPro has no obligation to provide individualized notice to contacts not enrolled in the Subscription List. Normal additions or replacements will be noticed at least ten (10) days before taking effect. If Customer reasonably objects in writing within fifteen (15) days after notice on documented privacy or security grounds, the parties will confer in good faith; if unresolved within thirty (30) days, Customer may terminate the affected Service upon written notice and receive a pro-rata refund of prepaid, unused fees for the terminated portion. HeadshotPro may implement sub-processor changes immediately, with notice posted promptly thereafter, where required to (A) maintain Service availability, security, or legal compliance; (B) respond to a sub-processor’s failure, withdrawal, deprecation, or material change in terms; or (C) adopt a sub-processor that offers a meaningful improvement in the security, performance, or quality of the Service.
(c) Retention & Deletion. Input photos are automatically deleted thirty (30) days after gallery generation by default. Customer and individual end users may request earlier deletion at any time. AI Headshots are retained as described in Exhibit E.
(d) Security Incident Notice. HeadshotPro will notify Customer without undue delay, and in any event within seventy-two (72) hours after confirming a Security Incident affecting Customer Personal Data. Such notice will include, to the extent then known, a description of the incident, categories of data affected, and remedial measures taken or proposed. HeadshotPro will provide reasonable cooperation and updates as information becomes available.
(e) Data Location. Customer Data is stored at rest in the European Union, and is passively replicated in encrypted form to United States locations solely for backup and disaster-recovery purposes. Processing of Customer Data may occur in the United States or other locations where HeadshotPro’s sub-processors (identified on the Sub-processor List) perform the AI generation, enhancement, and related functions. Customer Data may transit and be transiently cached by HeadshotPro’s global content-delivery and edge network in encrypted form solely to deliver the Service. HeadshotPro personnel operating outside the European Union storage location may securely and remotely access Customer Data, but will not download, copy, transfer, mirror, or replicate Customer Data to locations other than the European Union primary storage location and the United States backup location described above.
(a) Uptime Commitment. HeadshotPro will use commercially reasonable efforts to achieve 99.9% Monthly Uptime Percentage for the core Service (excluding Maintenance Windows and SLA Exclusions set forth below).
(b) Service Credits. If Monthly Uptime Percentage falls below 99.9% in a calendar month, Customer may request a credit applied to Customer’s account balance for that month, as follows:
| Monthly Uptime | Credit |
|---|---|
| 99.0% – 99.89% | 5% of monthly fees (or equivalent credits) |
| 95.0% – 98.99% | 10% of monthly fees (or equivalent credits) |
| < 95.0% | 25% of monthly fees (or equivalent credits) |
Claim Process. To receive a credit, Customer must email billing or support within thirty (30) days after month-end, include reasonable supporting details (timestamps, affected org/workspace), and be in good standing on invoices. Service Credits are Customer’s sole and exclusive remedy for uptime issues under this Agreement.
(c) Maintenance Windows. Scheduled maintenance (on reasonable prior notice via status page or Changelog) and emergency maintenance are excluded; HeadshotPro endeavors to schedule during low-usage hours.
(d) SLA Exclusions. Downtime resulting from Customer systems or networks, third-party networks outside HeadshotPro’s reasonable control, denial-of-service attacks, force majeure, misuse, or use contrary to documentation is excluded.
Standard support is provided as described in Exhibit D (Standard Support Offering). Any priority or enhanced support offering will be specified in the applicable Order Form.
(a) Acceptable Use. Customer and its users will not, and will not permit any third party to: (i) use the Service for unlawful, infringing, harassing, or fraudulent purposes; (ii) upload Customer Content for which Customer lacks necessary rights or consents; (iii) attempt to circumvent security, rate limits, or access controls; or (iv) generate content that depicts non-consensual likenesses, minors in inappropriate contexts, or that violates applicable law. HeadshotPro’s consumer Terms of Service do not govern this Agreement, and the acceptable-use obligations set forth in this Section 7 apply in their place.
(b) No Competitive Use. Customer will not use the Service, AI Headshots, or any output, performance data, or other information derived from the Service to (i) develop, train, or improve a competing AI image-generation or AI headshot product; or (ii) publish public benchmarks or comparative performance studies without HeadshotPro’s prior written consent.
(c) Suspension for Misuse. HeadshotPro may suspend access to the Service in whole or in part on reasonable notice (which may be immediate where required for security, legal, or platform-integrity reasons) where Customer or a user is engaged in a material violation of this Section.
(a) Fees. Fees, billing frequency, credits packages, and payment terms are set forth in the Order Form. Unless expressly stated otherwise, fees are non-cancellable and non-refundable, and exclusive of taxes (other than those imposed on HeadshotPro’s net income), which are Customer’s responsibility.
(b) Late Payment; Suspension. Invoices not disputed in good faith within fifteen (15) days of receipt are deemed accepted. Undisputed invoices not paid within thirty (30) days of the due date accrue interest at 1.5% per month (or the maximum legal rate, whichever is lower). HeadshotPro may suspend access to the Service on ten (10) days’ written notice if any undisputed amount is more than thirty (30) days past due, without prejudice to its other rights.
(c) Renewal and Pricing Adjustments. Order Forms renew for successive one-year terms unless either party provides written notice of non-renewal at least thirty (30) days prior to the end of the then-current term. HeadshotPro may increase fees at each renewal by providing at least sixty (60) days’ written notice, with any increase capped at the greater of (i) 7% or (ii) the percentage change in CPI (US, all urban consumers) over the preceding 12 months.
Each party (the “Receiving Party”) will protect the other party’s Confidential Information using measures at least as protective as those it uses for its own similar information (and no less than reasonable care) and will use such information solely to perform under this Agreement. Confidential Information excludes information that (i) is or becomes public through no fault of the Receiving Party; (ii) was rightfully known or received from a third party without duty of confidentiality; or (iii) is independently developed without use of the disclosing party’s Confidential Information. Each party may disclose Confidential Information as required by law or legal process, provided that (where legally permitted) the Receiving Party gives prompt notice to allow the disclosing party to seek a protective order. The obligations in this Section 9 continue for three (3) years after termination or expiration of this Agreement, except that Confidential Information that constitutes a trade secret remains protected for as long as it qualifies as a trade secret under applicable law.
(a) By HeadshotPro. HeadshotPro warrants that it will provide the Service in a professional and workmanlike manner and maintain the safeguards described in Exhibit A (Information Security).
(b) Mutual. Each party represents and warrants that it has the power and authority to enter into this Agreement and will comply with all laws applicable to its performance hereunder.
(c) Disclaimers. Except as expressly provided in Section 10(a), the Service and AI Headshots are provided “AS IS” and “AS AVAILABLE,” and HeadshotPro disclaims all other warranties, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, or error-free or uninterrupted operation.
(d) AI Outputs. Customer acknowledges that AI Headshots are probabilistic outputs of a generative model and may contain artifacts, inaccuracies, biases, hallucinations, or imperfect renderings of likeness. HeadshotPro makes no warranty as to the accuracy, fitness, suitability, or non-infringement of any specific AI Headshot. Customer is solely responsible for human review and selection of AI Headshots prior to publication or use.
(e) Warranty Remedy. If the Service materially fails to conform to the warranty in Section 10(a) and Customer provides reasonably detailed written notice, HeadshotPro will use commercially reasonable efforts to cure within thirty (30) days. If not cured within that period, Customer may terminate the affected Service and receive a pro-rata refund of prepaid, unused fees for the terminated portion. This Section 10(e) is Customer’s sole and exclusive remedy for breach of the warranty in Section 10(a).
(a) By HeadshotPro. HeadshotPro will defend Customer against any third-party claim alleging that the Service, as provided by HeadshotPro and used by Customer in accordance with this Agreement, directly infringes a third party’s intellectual property rights, and will pay finally awarded damages and approved settlements. HeadshotPro’s obligations do not apply to claims arising from: (i) Customer Content; (ii) combinations with items not provided by HeadshotPro; (iii) modifications not made by HeadshotPro; (iv) use of the Service not in accordance with this Agreement or documentation; or (v) any AI Headshot used in a manner not reviewed and approved by Customer.
If the Service becomes, or in HeadshotPro’s reasonable opinion is likely to become, the subject of an infringement claim, HeadshotPro may, at its option: (1) procure for Customer the right to continue using the Service; (2) modify the Service to be non-infringing while retaining substantially equivalent functionality; or (3) terminate the affected Service and refund prepaid, unused fees. The remedies in this Section 11(a) are Customer’s sole and exclusive remedies, and HeadshotPro’s entire liability, for any third-party infringement claim.
(b) By Customer. Customer will defend HeadshotPro against any third-party claim arising from: (i) Customer Content (including allegations that Customer Content infringes any right of a third party or violates any law); (ii) Customer’s or its end users’ use of the Service in violation of this Agreement or applicable law; (iii) Customer’s failure to obtain necessary consents from individuals depicted in Customer Content; or (iv) Customer’s breach of Section 7(b) (No Competitive Use / Benchmarking).
(c) Conditions. The indemnified party must promptly notify the indemnifying party of the claim, provide reasonable cooperation, and grant sole control of the defense and settlement (provided any settlement unconditionally releases the indemnified party and imposes no admission, payment obligation, or material affirmative obligation on the indemnified party).
Sections 11(a) and 11(b) state each party’s sole and exclusive obligations, and the other party’s sole and exclusive remedy, for the types of third-party claims described therein.
(a) Exclusion of Indirect Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, ANTICIPATED SAVINGS, OR DATA, IN EACH CASE EVEN IF ADVISED OF THE POSSIBILITY AND REGARDLESS OF THE THEORY OF LIABILITY (WHETHER IN CONTRACT, TORT, STATUTE, OR OTHERWISE).
(b) General Cap. SUBJECT TO SECTION 12(a) AND EXCEPT AS PROVIDED IN SECTION 12(d), EACH PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT (INCLUDING ALL EXHIBITS AND ORDER FORMS) WILL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY CUSTOMER TO HEADSHOTPRO UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY (THE “GENERAL CAP”). SERVICE CREDITS ARE NOT “DAMAGES” AND DO NOT COUNT AGAINST THE GENERAL CAP.
(c) Enhanced Cap for Specified Claims. Subject to Section 12(a), the General Cap in Section 12(b) does not apply to: (i) either party’s indemnification obligations under Section 11; (ii) HeadshotPro’s breach of its data-security, data-privacy, or Section 9 (Confidentiality) obligations; (iii) Customer’s breach of Section 7(b) (Acceptable Use; No Benchmarking / No Competitive Use); or (iv) liability arising from a party’s gross negligence, willful misconduct, or willful infringement of the other party’s intellectual property, in each case to the extent a cap on such liability is permitted by applicable law. For the claims described in clauses (i)–(iv), each party’s aggregate liability shall not exceed one (1) times the total amounts paid or payable by Customer to HeadshotPro under the applicable Order Form during the twelve (12) months immediately preceding the event giving rise to liability (the “Enhanced Cap”), it being expressly acknowledged that the Enhanced Cap equals the General Cap in amount but applies to the categories enumerated in this Section 12(c) so that such categories are subject to a cap rather than uncapped.
(d) Carve-Outs from All Caps. No cap in Sections 12(b) or 12(c) applies to: (i) Customer’s outstanding payment obligations to HeadshotPro under any Order Form; or (ii) liability that, as a matter of applicable law, cannot be limited or excluded by agreement (for example, liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation). To the extent applicable law would otherwise permit a higher limitation, the parties intend the General Cap and Enhanced Cap to apply to the fullest extent so permitted.
(e) Acknowledgment; Allocation of Risk. The parties acknowledge that the limitations and exclusions in this Section 12 reflect the agreed allocation of risk between them, are an essential basis of the bargain, and will apply even if any limited remedy is found to have failed of its essential purpose.
(f) Controlling Provision. Notwithstanding anything to the contrary in any Exhibit, Schedule, Addendum, or Order Form, this Section 12 governs and controls each party’s monetary liability arising out of or related to this Agreement and all Exhibits.
(a) Term. This Agreement commences on the Effective Date and continues for so long as any Order Form remains in effect.
(b) Termination for Cause. Either party may terminate this Agreement or an affected Order Form for material breach not cured within thirty (30) days after written notice. Either party may terminate immediately on written notice if the other party becomes insolvent, makes an assignment for the benefit of creditors, or is subject to bankruptcy or similar proceedings not dismissed within sixty (60) days.
(c) Effect of Termination. Upon termination or expiry: (i) Customer’s access to the Service ceases; (ii) Customer retains its AI Headshots subject to Section 13(d); (iii) HeadshotPro will delete Customer Content in accordance with Section 4(c) and Exhibit B; and (iv) any prepaid, unused fees for the terminated portion will be refunded only if termination is by Customer under Section 10(e), Section 11(a)(3), or Section 13(b) due to HeadshotPro’s uncured material breach.
(d) Data Return. Upon termination or expiry, and upon Customer’s written request within thirty (30) days, HeadshotPro will provide a one-time export of AI Headshots and reasonably available related metadata in a commonly used, machine-readable format.
(e) Survival. Sections 1, 3 (provided that Section 3(b) (No Model Training) and Section 3(d) survive in full; HeadshotPro’s right to continue processing Customer Content under Section 3(c) ends on deletion per Section 4(c)), 8, 9, 10(c)–(e), 11, 12, 13(c)–(e), 14, and 15 survive termination.
HeadshotPro may identify Customer by name and logo as a customer on its website, customer lists, and pitch decks, in each case in a manner consistent with Customer’s brand guidelines provided to HeadshotPro. Customer may opt out of such use by notice in the Order Form or by written request to legal@headshotpro.com (effective within thirty (30) days). Any press release, joint case study, or other public statement that quotes or characterizes Customer requires Customer’s prior written consent. Customer may identify HeadshotPro as a vendor in Customer’s internal communications.
(a) Governing Law; Venue. This Agreement is governed by the laws of the State of New York, USA (or, if so designated in the Order Form, Singapore), in each case excluding its conflict-of-laws principles. The parties submit to the exclusive jurisdiction of the courts located in the corresponding forum.
(b) Force Majeure. Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including acts of God, war, terrorism, civil disturbance, pandemic, government action, labor disruption, internet or telecommunications failures, or third-party provider outages. The affected party will use commercially reasonable efforts to mitigate and resume performance.
(c) Assignment. Neither party may assign this Agreement, in whole or in part, without the other party’s prior written consent (not to be unreasonably withheld), except to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations hereunder. Any purported assignment in violation of this Section is void.
(d) Notices. Legal notices must be sent to the addresses set forth in the Order Form, with a copy to legal@headshotpro.com (for HeadshotPro) and the address designated by Customer in the Order Form (for Customer). Notices are deemed given upon receipt (or, for email notices to legal@headshotpro.com, upon written confirmation of receipt).
(e) Independent Contractors. The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, fiduciary, or employment relationship.
(f) Compliance with Laws. Each party will comply with all laws applicable to its performance under this Agreement, including export control, sanctions (OFAC, EU, UK), anti-corruption (FCPA, UK Bribery Act), and data protection laws. Customer represents that neither it nor any of its authorized users is located in, or a national or resident of, a country subject to comprehensive US, EU, or UK sanctions, or is on any restricted-party list.
(g) No Third-Party Beneficiaries. This Agreement is for the sole benefit of the parties and their permitted successors and assigns.
(h) Severability; Waiver. If any provision is held invalid or unenforceable, the remaining provisions will continue in full force. A party’s failure to enforce any provision is not a waiver of its right to do so later.
(i) Entire Agreement. This Agreement, the applicable Order Form(s), and the Exhibits expressly named herein constitute the entire agreement between the parties and supersede all prior or contemporaneous agreements on the subject matter. No other terms, including any consumer or online terms of service published by HeadshotPro and any “click-through” terms encountered by end users, apply. No waiver or modification is effective unless in writing and signed by both parties (or, for Order Forms, accepted through the designated electronic process).
| HeadshotPro | Customer |
|---|---|
| Name: Danny Postma | Name: __________________ |
| Title: CEO | Title: __________________ |
| Date: __________________ | Date: __________________ |
Questions? — legal@headshotpro.com
This Exhibit describes the administrative, technical, and organizational measures HeadshotPro maintains to protect Customer Content and Customer Confidential Information. In the event of a conflict between this Exhibit and the main body of the Agreement, the main body governs. Section 12 (Limitation of Liability) of the Agreement controls over any conflicting provision of this Exhibit with respect to monetary liability.
HeadshotPro maintains a written, comprehensive information security program that includes commercially reasonable administrative, organizational, and technical safeguards commensurate with the sensitivity of Customer Content. The program is reviewed at least annually and updated as appropriate.
4.1 SOC 2 Type II. HeadshotPro operates a SOC 2 Type II program for relevant processes and will provide its then-current SOC 2 Type II report (and, if applicable, bridge letter) under NDA upon Customer’s reasonable written request, no more than once per year.
4.2 Audit by Report. Delivery of HeadshotPro’s then-current SOC 2 Type II report (and any applicable bridge letter) satisfies Customer’s audit rights under this Agreement. Customer may conduct a direct audit only (i) following a confirmed Security Incident affecting Customer Content, or (ii) where required by Customer’s regulator. In either case, such audit is limited to documentation reviews, questionnaires, and interviews conducted under reasonable scheduling, on at least thirty (30) days’ notice, no more than once per twelve (12) months, subject to confidentiality and at Customer’s expense.
4.3 Audit Exclusions. No audit shall extend to: (i) HeadshotPro source code; (ii) data or information of HeadshotPro’s other customers; (iii) HeadshotPro’s internal financial, pricing, or commercial information; or (iv) any electronic, penetration, or social-engineering testing of HeadshotPro’s systems, except with HeadshotPro’s prior written authorization.
5.1 Notification. HeadshotPro will notify Customer without undue delay, and in any event within seventy-two (72) hours after confirming a Security Incident affecting Customer Content or Customer Personal Data. Notification will include, to the extent then known, the nature of the incident, categories of data affected, and remedial actions taken or proposed.
5.2 Cooperation. HeadshotPro will cooperate reasonably with Customer’s investigation of a Security Incident attributable to HeadshotPro and will share status updates as information becomes available.
5.3 Remediation. HeadshotPro will remediate the underlying cause of a confirmed Security Incident in accordance with the severity and risk, and at HeadshotPro’s expense where the Security Incident is attributable to HeadshotPro’s acts or omissions.
HeadshotPro will not knowingly introduce malware into the Service and uses commercially reasonable measures (signature- and behavior-based detection, dependency scanning) to prevent introduction of malware. If malware is identified within HeadshotPro’s systems that affects Customer Content, HeadshotPro will treat it as a Security Incident and respond under Section 5.
Upon termination of the Agreement or upon Customer’s written request, HeadshotPro will delete Customer Content from active systems within ninety (90) days, except (i) Customer Content that HeadshotPro is required to retain by law, and (ii) Customer Content residing on backup media that does not permit selective deletion (which will expire on the standard backup-rotation schedule, not to exceed twelve (12) months). The confidentiality protections of the Agreement continue to apply to any such retained Customer Content.
HeadshotPro personnel with access to Customer Content are subject to written confidentiality obligations and receive security and privacy training appropriate to their role.
This Exhibit B applies where HeadshotPro processes personal data on behalf of Customer in connection with the Service. For purposes of applicable data-protection laws (including the EU/UK General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act / California Privacy Rights Act (“CCPA”), and other state, federal, or foreign privacy laws of substantially similar effect, collectively “Data Protection Laws”), Customer is the controller (or business) and HeadshotPro is the processor (or service provider) of Customer Personal Data.
“Customer Personal Data” means personal data within Customer Content.
“Personal Data” has the meaning given under applicable Data Protection Laws (and includes “Personal Information” under the CCPA).
“Process” and “Processing” have the meanings given under applicable Data Protection Laws.
“Sub-processor” means any third party engaged by HeadshotPro to Process Customer Personal Data in connection with the Service.
HeadshotPro will Process Customer Personal Data only on Customer’s documented instructions (which include this Agreement, the Order Form, and Customer’s reasonable use of the Service) and solely to provide, maintain, secure, and support the Service. HeadshotPro will not:
HeadshotPro certifies that it understands and will comply with the foregoing.
Customer provides general written authorization for HeadshotPro to engage Sub-processors to Process Customer Personal Data, subject to (i) the Sub-processor List and the notice, objection, and termination mechanics set forth in Section 4(b) of the Agreement (which Customer agrees satisfy any “prior written authorization” requirement under applicable Data Protection Laws), and (ii) HeadshotPro entering into a written agreement with each Sub-processor imposing data-protection obligations no less protective than those in this Exhibit. Notice and effective-date mechanics, including the broadened circumstances under which HeadshotPro may implement Sub-processor changes immediately, are governed exclusively by Section 4(b) of the Agreement.
HeadshotPro will, taking into account the nature of the Processing, provide reasonable assistance through appropriate technical and organizational measures to enable Customer to respond to verifiable requests from data subjects to exercise their rights under Data Protection Laws (access, deletion, correction, opt-out of Sale/Share, data portability). HeadshotPro will promptly notify Customer if it receives a data-subject request directly relating to Customer Personal Data.
Upon expiration or termination of the Agreement, or earlier upon Customer’s written request, HeadshotPro will delete or return Customer Personal Data in accordance with Section 4(c) of the Agreement and Exhibit A, Section 7, except where retention is required by law. Upon request, HeadshotPro will provide written confirmation of deletion.
Where Customer Personal Data is transferred from the European Economic Area, United Kingdom, or Switzerland to a third country lacking an adequacy decision, the parties incorporate by reference the applicable Standard Contractual Clauses (and UK addendum, as applicable) issued by the European Commission and UK ICO, with HeadshotPro acting as data importer.
HeadshotPro will implement and maintain the security measures described in Exhibit A. In the event of a Security Incident affecting Customer Personal Data, HeadshotPro will notify Customer in accordance with Section 4(d) of the Agreement and Section 5 of Exhibit A.
Customer’s audit rights under Data Protection Laws are satisfied as described in Section 4 of Exhibit A.
To the extent the CCPA applies, HeadshotPro is a “service provider” and not a “third party.” HeadshotPro will (a) comply with applicable obligations under the CCPA; (b) notify Customer if it determines it can no longer meet its obligations under the CCPA; and (c) permit Customer to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information.
In the event of any conflict between this Exhibit B and the main body of the Agreement with respect to data-protection matters, this Exhibit B controls, except that Section 12 (Limitation of Liability) of the Agreement controls with respect to monetary liability.
“AI” means artificial-intelligence systems, including machine-learning and generative models, used by HeadshotPro to provide the Service.
“Inputs” means Customer Content provided to the AI to generate AI Headshots.
“Outputs” means AI Headshots and any other content generated by the AI from Inputs.
Customer authorizes HeadshotPro to use AI to deliver the Service. AI is the core technology underlying the Service.
HeadshotPro does not, and will not, use Inputs, Outputs, or any other Customer Content to train, fine-tune, or otherwise improve any AI model — whether HeadshotPro’s own or a third party’s. This commitment is absolute; no opt-in or other exception applies.
Subject to Customer’s compliance with the Agreement, HeadshotPro assigns to Customer all right, title, and interest HeadshotPro may have in Outputs generated from Customer’s Inputs. HeadshotPro retains all rights in the underlying AI systems, models, and HeadshotPro Confidential Information. Customer does not, by virtue of this Agreement, acquire any rights in HeadshotPro’s AI.
Customer will not use the Service to:
Customer acknowledges that Outputs are probabilistic and may contain inaccuracies, biases, hallucinations, artifacts, or imperfect likeness rendering. HeadshotPro applies automated quality controls and, where reasonably necessary to address potential biases, hallucinations, or other indicia of unreliability, human review. HeadshotPro makes no warranty as to the accuracy, fitness, or non-infringement of any specific Output. Customer is solely responsible for human review and selection of Outputs prior to publication or use.
HeadshotPro represents that its use of AI in delivering the Service complies in all material respects with applicable laws and industry standards governing data protection, algorithmic accountability, information security, and AI transparency.
AI-related claims are addressed under Section 11 (Indemnification) of the Agreement; this Exhibit does not create any separate indemnification obligation.
In the event of conflict between this Exhibit C and the main body of the Agreement, the main body governs. Section 12 (Limitation of Liability) of the Agreement controls over any conflicting provision of this Exhibit with respect to monetary liability.
Applies to Enterprise customers on the Standard Support tier per the Order Form. Priority and Enhanced Support tiers are described separately and elected in the Order Form.
HeadshotPro provides Standard Support to assist Enterprise customers with account access, product usage, billing, and incident reporting. This Exhibit supplements Section 6 (Support) and Section 5 (Service Levels; Credits) of the Agreement.
| Channel | Address | Use for |
|---|---|---|
| support@headshotpro.com | All issues, including account, billing, and incidents | |
| In-product chat | In application | Usage and feature questions |
Phone support is not included in the Standard tier.
| Severity | Definition | Target First Response (business hours) |
|---|---|---|
| Sev 1 — Critical | Service unavailable for all users | Within 2 business hours |
| Sev 2 — High | Major feature unavailable; significant impact | Within 1 business day |
| Sev 3 — Normal | Partial impact; workaround available | Within 2 business days |
| Sev 4 — Low | Questions, minor cosmetic issues | Within 3 business days |
Response time is measured from ticket receipt during business hours. Response time is time-to-first-human-response, not time-to-resolution. Resolution time depends on issue complexity.
The above are available under Priority / Enhanced Support tiers — see the Order Form.
Per Section 5 of the Agreement, Customer is responsible for monitoring uptime and submitting credit requests. Customer designates in the Order Form:
A typical arrangement is for the Customer’s IT function (e.g., internal IT Help Desk) to:
HeadshotPro will validate the reported downtime against internal monitoring and confirm the credit in writing.
Consistent with Section 5 of the Agreement, downtime does not include:
If a ticket has not received a response within the target window, the Authorized Contact may escalate by replying to the original thread with “ESCALATION” in the subject line. Escalations are reviewed by the Support Lead the same business day.
HeadshotPro may update this Standard Support Offering from time to time. Material changes that reduce service levels will be communicated to the Authorized Contact at least thirty (30) days in advance.
Contact for questions about this document: support@headshotpro.com
This Exhibit describes the architecture and data flows of the HeadshotPro Service as deployed for Customer’s enterprise users. It is provided to support Customer’s security and privacy review and to satisfy the AI implementation documentation referenced in the Agreement.
This document describes system components by function. The specific third-party providers performing each function are identified, and kept current, on HeadshotPro’s Sub-processor List referenced in Section 4(b) of the Agreement, which HeadshotPro may update in accordance with that Section. Where the Agreement and this Exhibit conflict, the Agreement governs.
Scope is limited to the enterprise (SSO- or Magic-Link-authenticated, opt-in) deployment. Public marketing-site analytics and consumer self-service billing flows are outside the scope of the Service provided to Customer and are not described here.
Functional components include: identity / SSO broker, application database, object storage, image quality-validation, image generation, image enhancement, transactional email, status page, and in-product support chat. Specific providers are listed on the Sub-processor List.
3.1 Authentication and Access
3.2 Photo Upload and Quality Validation
3.3 Headshot Generation
3.4 Delivery, Notifications, and Support
Retention periods stated above are maximums; deletion may occur earlier. Customer Content is processed solely to provide, maintain, secure, and support the Service, consistent with Section 3(c) of the Agreement and Exhibit B (Data Processing Addendum). Customer Content is not used to train HeadshotPro’s or any third party’s models.
The third-party providers performing the functions described in Section 2 are listed, and maintained current, on HeadshotPro’s Sub-processor List referenced in Section 4(b) of the Agreement. HeadshotPro may update providers in accordance with Section 4(b) without amendment to this Exhibit, provided the functional architecture described here is materially maintained.
Administrative, technical, and organizational safeguards — including encryption in transit and at rest — are described in Exhibit A (Information Security). Data in transit between components and sub-processors is encrypted, and access to stored Customer Content is restricted to the operations described above.
— End of Master Service Agreement and Exhibits — HeadshotPro v1.1 Enterprise Template —