Privacy Policy

Lookful (lookful.us and the app at app.lookful.us) is provided by Cannon Studio, LLC, Belden, Mississippi (“Lookful”, “we”, “us”). This policy covers the website, the app, the API behind them, the emails we send and LookfulBot, our scanner.

What we collect

Your account

• Your first and last name, email address and the name of your organization.
• Your password, stored only as a one-way hash. We can’t read it.
• Your role on the account and when you last signed in.

Your sites and scans

• The websites and pages you add, their names, your notes and settings, and your confirmation that you may scan them.
• What LookfulBot records on those pages: screenshots, page structure, accessibility results, and the cookies, trackers and network requests the page makes (names and destinations, not cookie values).
• The reports, scores, fix plans and statements made from those results.

Screenshots and page content can include whatever the scanned page shows publicly, which may include personal information that the site itself publishes. Scan only sites you own or are authorized to scan; ourTerms of Use require it.

Billing

Payments go through Stripe. Stripe collects your card or bank details, billing address and tax ID on its own pages; we never see or store card numbers. We keep your Stripe customer and subscription references, your plan, the number of sites and your billing status.

Messages you send us

When you use the contact form we keep your name, email address, topic, website (if you give one), your message, the page you sent it from, your browser’s user agent, and a keyed hash of your IP address. The hash lets us limit abuse without keeping the address itself.

Security records

Password reset requests record a hash of the reset link and a keyed hash of the requesting IP address, to limit repeated requests. Our servers keep error logs for 30 days to find and fix problems.

How we use it

• To run your account and the scans, reports and alerts you ask for.
• To bill you, collect sales tax where it applies, and keep the records the law requires.
• To send the emails the service needs: welcome, scan finished, password reset and billing notices.
• To answer your messages and support requests.
• To keep Lookful secure, prevent abuse and fix problems.

We don’t sell or rent your personal information, use it for advertising, or share it for cross-context behavioral advertising. We don’t use analytics or tracking tools.

Cookies and browser storage

Lookful doesn’t use cookies, on this website or in the app. Nothing here tracks you or measures your visits.

• The app keeps you signed in by saving your session in your browser’s local storage. It’s removed when you sign out.
• The cookie notice on this site and in the app remembers that you closed it, in the same local storage.
• Stripe pages (checkout and the billing portal) are on Stripe’s own website, which sets its own cookies for payments and fraud prevention. SeeStripe’s privacy policy.

Both uses of local storage are needed for what you asked for, so we don’t ask for consent. Clearing your browser’s site data removes them.

Who helps us run Lookful

These companies process data for us, only to provide their part of the service:

• Amazon Web Services: hosting, file storage and scanning (United States).
• Neon: the database (United States).
• Stripe: payments, invoices and sales tax.
• Mailgun: sending email. Open and click tracking are turned off.
• OpenAI and DeepInfra: AI analysis of the pages we scan (page text, structure and screenshots of the scanned sites). We send them the scanned page’s content, not your account details.
• DataImpulse: the network LookfulBot browses through when it visits your sites.

We may also share information when the law requires it, to protect people or Lookful from harm, or as part of a sale or merger of the business, in which case this policy continues to apply to it.

How long we keep it

• Account, site and scan data: while your account is open. Deleting a site removes its pages, scans and results from your account; the stored screenshots and page files from those scans are deleted when you ask us to, or when your account closes.
• When you ask us to close your account, we delete its data, stored files included, within 30 days, except what we must keep.
• Billing records: as long as tax and accounting law requires (usually seven years).
• Contact messages: until we’ve dealt with them and no longer need them, or sooner if you ask.
• Password reset records: they expire after 30 minutes and are deleted with the account.
• Error logs: 30 days.
• Scan usage records (an account reference, the website address scanned and when; nothing about a person): kept after a site is deleted or an account closes, so plan and free-trial limits can be applied.

Your choices and rights

You can see and correct your account details in the app. To get a copy of your data, have it corrected or deleted, or ask anything about this policy, send us a privacy request. We answer within 30 days. We may need to confirm it’s you first, and we won’t treat you differently for asking.

If someone found their information in a scan of a site that uses Lookful, contact that site’s owner; they decide what the site publishes. We’ll help where we can.

Security

Connections are encrypted (HTTPS). Data is encrypted at rest, file storage is private, passwords are hashed, and resetting your password signs you out everywhere. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

Children

Lookful is a service for businesses and organizations, for people 18 and over. It isn’t meant for children and we don’t knowingly collect their information.

Where data is kept

Lookful is run from the United States and stores data there. If you use it from elsewhere, your information is transferred to and processed in the United States.

Changes to this policy

We’ll post any change here with a new effective date. If a change matters to how we use your information, we’ll also email account holders before it takes effect.

Contact

Cannon Studio, LLC, Belden, Mississippi. Use the contact form and choose “Privacy request”.