Privacy Policy

Quicklook Content is operated by Quicklook LLC (“we,” “us”). We are the controller of the personal data described here. For a privacy or data request, use our contact form and choose “Privacy or data request.” You do not need an account to use it. The Terms of Service are the contract for the product.

• Account details. Your email address and the mobile number we verify by SMS and link to that account through Firebase Authentication. The text message is a one-time verification code. We do not send marketing texts. Passwords are handled by Firebase and are never visible to us.
• Workspace details. Your workspace name, the roles you assign, the email addresses of teammates you invite, and workspace settings such as time zone, quiet hours, and whether AI disclosure labels stay on.
• Terms acceptance. When a workspace is created, we store the version of the Terms and this policy that the owner accepted, how they accepted (the signup checkbox), and the time. That record lives on the workspace.
• Your brand’s public website and photographs. When you add a domain, we read its publicly accessible pages and structured data to build a product catalog and learn how the brand writes. We read only what a visitor or a search engine could read. We also store photographs you upload or that we copy from that public catalog, and the images, videos, music, and captions generated from them.
• Connected social accounts. The account names, identifiers, and post metrics for networks you connect. The authorization tokens are held by our publishing provider, not by us. You can revoke them at the network at any time.
• Billing details. Stripe collects your card, name, billing address, phone number, and any tax identifier directly. We store your Stripe customer and subscription identifiers, your plan, and its status. When a trial starts or a payment succeeds, we read the name, email, phone, and billing address Stripe holds so we can send hashed versions to Meta, as section 5 describes. We never see or store card numbers.
• Messages you send us. The name, email, topic, and message from the contact form or from in-app support, plus the account id if you are signed in. We store the message and email a copy to ourselves so a request is not lost if mail delivery fails.
• Technical data. IP address, coarse browser and device characteristics, a first-party browser identifier described in section 4, and server logs. We use these for security, abuse prevention, and diagnosing faults.
• Advertising measurement. On the public site and inside the signed-in product, Meta’s pixel and our server send Meta the page you opened, browser and click identifiers, IP address, user agent, and — once you have an account or a checkout — a hashed email, phone number, name, and billing-address fields. We use that to see which of our ads led to a signup, a trial, or a payment, and to reach people who visited but did not subscribe. The browser identifier from the visit that started checkout is stored on that Stripe checkout so the later payment can be matched to the ad click. Card numbers, catalog contents, and generated media are never included. This is separate from the fraud-prevention hashes in section 8, which are not used for advertising.

• To provide the service — generating and publishing your content, maintaining the workspace, and supporting you. This is necessary to perform our contract with you.
• To take payment — billing, invoicing, tax, and managing the subscription. Also contractual necessity.
• To show examples of the product — using generated content and public brand identity in our own advertising, as the Terms describe. You agree to that license when you accept the Terms. Where that material contains personal data, we rely on the contract and on our legitimate interest in describing the service we actually operate.
• To prevent abuse — stopping repeated free trials and fraudulent signups. We rely on our legitimate interest in not giving away a trial that costs real money to serve.
• To keep the service secure and working — logging, monitoring, and debugging. Legitimate interest.
• To measure our own advertising — which campaigns lead to a signup or a paid subscription. We rely on our legitimate interest in advertising the service. Blocking third-party cookies in your browser stops the pixel. The product does not require it. Section 10 explains how to opt out of the sharing California law may regulate.

We do not sell personal information for money. We do not use customer content to train Quicklook’s own models. Providers process that content to perform the service under their own terms.

• __session — an httpOnly cookie that keeps you signed in. It lasts up to five days, which is the longest a Firebase session cookie can last.
• ae_sidebar — remembers whether the dashboard sidebar is collapsed.
• ae_did — a random first-party identifier, also kept in local storage and IndexedDB, used only as a free-trial abuse signal. We store a salted hash of it, not the raw value, in the fraud record described in section 8. It is not used to recognize you across other companies’ sites.
• Firebase Authentication keeps its own local session so the browser can stay signed in.
• Meta and reCAPTCHA may set their own cookies when those tools run. reCAPTCHA checks that a callable request comes from a real browser. Blocking third-party cookies stops the Meta pixel. The product still works.

The signup page also stores, in this browser only, the fact that you checked the terms box and which version you checked, so the later phone-verification step can send that acceptance with the workspace. It is not sent to advertisers.

These providers process data for us under contract. They are the third parties that touch customer data in the current product.

Your product photographs are sent to Google to plan the edit, write copy, and generate social images, and to Fal.ai to generate video. A written music brief is sent to SunoAPI. The finished video file is sent to Fal.ai only if you buy the optional 60-frames-per-second pass, or to Google if you use a video-editing tool we offer. Post text and media that you approve are sent to Zernio so the networks you connected can publish them.

We also disclose information where the law, a subpoena, or a court order requires it, and where we believe disclosure is needed to protect the rights, property, or safety of Quicklook, our customers, or someone else. If the business is sold, this policy travels with it and the buyer processes the information for the same purposes.

Generation is automatic. Output can be wrong. On networks whose policies cover realistic AI-generated media, posts carry that network’s disclosure label by default. You can change this in workspace settings. If you turn it off, you are responsible for meeting each network’s rules. We do not use your content to train a Quicklook model.

The Terms give us a license to use Output, your public brand name, and product imagery you provide in our own marketing and advertising. That can include a business name and photographs of products you sell. It does not include your password, payment details, or other private account data.

You can ask us to stop using a specific example in new materials through the contact form. We will stop using it in new materials within a reasonable time. An ad that is already placed may finish its placement. Deleting the workspace removes the assets from the product. It does not require us to pull an advertisement that already used an example under that license.

Our free trial includes 1 video + 5 images, which cost us real money to produce. To stop the same person taking it more than once, we keep a fraud record that is not part of the workspace.

• Only irreversible hashes are stored. When an account is created, and again when someone signs in from another browser, we store a salted hash of the email address, the SMS-verified phone number, and a first-party browser identifier. When a card is added, we store a salted hash of the fingerprint Stripe assigns it. The stored values cannot be turned back into an email, a phone number, or card details. We check those hashes when a workspace is created, before a free trial can start.
• The first account is the one that may start a trial. A later account that presents the same email, phone, or browser starts on a paid plan. A card can only be checked after Stripe has collected it. If that card already belongs to another account, the trial ends and billing starts immediately. The original account can still start its one trial.
• These records outlive your account. Deleting your workspace removes your data, but it does not restore eligibility for a free trial. This is the one category we deliberately retain, and we retain it indefinitely.
• They are never used for marketing, profiling, advertising, or any purpose other than deciding whether a free trial may start.

You can always subscribe to a paid plan regardless of these records.

• Account, workspace, catalog, and generated content — for as long as the account exists, then deleted within 30 days of your request. Copies that already appear in our advertising may remain there, as section 7 describes.
• The terms-acceptance record — for as long as the workspace exists, then deleted with it.
• Billing records — for as long as tax and accounting law requires, typically seven years. Stripe keeps its own records under its policy.
• Contact and support messages — while we need them to respond, and long enough to keep a record of a legal or privacy request.
• Server logs — a rolling window of no more than 90 days.
• Fraud-prevention hashes — indefinitely, as described in section 8.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing based on legitimate interest, and to complain to a data-protection authority. Send the request through our contact form — choose “Privacy or data request” — and we will respond within 30 days. You do not need an account to use it. We may need to confirm that the request comes from you.

You can also delete the workspace yourself from Settings → Delete workspace inside the app. That cancels the subscription and removes the account, brands, catalogs, connected accounts, and generated assets stored in the product, without waiting on us.

A deletion request does not remove the fraud-prevention hashes in section 8, billing records we must keep, or advertising that already used an example under the Terms. The hashes contain no readable personal data. We retain them on the basis of our legitimate interest in preventing repeated free trials.

If you are a California resident, you may request that we disclose, correct, or delete personal information, and you may appeal a denial through the same contact form. We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16. We do share identifiers and site-activity data with Meta to measure and target our own advertising, which California law may treat as sharing or as a sale. To opt out, block third-party cookies and send a “Privacy or data request” asking us to stop advertising measurement for your account. We will stop future server-side advertising events we can tie to that account. We will not discriminate against you for exercising these rights. We do not offer financial incentives for personal information.

We are based in the United States, and the providers in section 5 process information in the United States. If you access the service from somewhere else, you understand that your information will be processed in the United States, where the privacy laws may differ from the laws where you live.

Data is encrypted in transit and at rest. Access to production systems is restricted and authenticated. Card numbers never touch our servers. No system is perfectly secure, and we do not claim otherwise. You are responsible for the security of your password and of the social accounts you connect.

Quicklook Content is a business tool and is not directed at anyone under 18. We do not knowingly collect their personal information. If you believe we have, send a privacy request and we will delete it.

We will update the effective date above when this policy changes, and we will email the account before a change that materially reduces your rights.