Privacy policy

This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit our website, use the free AI visibility check, join the waitlist, request a demo, write to us, take part in the referral program or use the Looky app. We process only as much data as necessary and explain here for what purpose, on which legal basis and for how long.

At a glance

1. Controller

The controller for data processing on our website and in the Looky app is:

Melo Designer GmbH

Zum Wallgraben 50b, 49696 Molbergen,

Germany

Managing director: Guilherme Alexandre Gonçalves de Melo

Email: hallo@getlooky.ai

Phone: +49 4475 9296 293

Data protection contact

We are not required to appoint a data protection officer under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG). For every question about data protection and for all requests under this policy, write to hallo@getlooky.ai.

2. Overview and terms

Personal data is any information relating to an identified or identifiable person, for example your name, your email address or your IP address. Processing means any operation performed on such data, such as collecting, storing, transmitting or deleting it.

We distinguish two areas:

• Website, forms and your account: Here we are the controller for the data generated by your visit, our forms, your account and our contract with you.
• Workspace content in the Looky app: For the content that you and your team process in workspaces (for example brand knowledge, drafts, reviews by your customers, data of your connected accounts), we act as a processor on your behalf and on your instructions (Art. 28 GDPR, see section 12). You as the customer are then responsible for the lawfulness of that processing.

Tracking and analytics tools run only on our marketing website getlooky.ai, and only with your consent; today this is Google Analytics 4. The Looky app (app.getlooky.ai) and its admin area (admin.getlooky.ai) are separate applications: they load no analytics, advertising or marketing tools and set no tracking cookies. A consent you give on the website applies to the website only and does not carry over into the app (details in section 4).

Looky is offered exclusively to businesses. Even so, the data of the people who work with Looky is personal data, and we protect it accordingly.

3. Hosting, file storage and server log files

Server. The website, the Looky app and its admin area, the API, the database and the queue run on a dedicated server of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in a data centre in Germany. The provider processes the data only on our behalf under a data processing agreement in accordance with Art. 28 GDPR.

Backups. The database is backed up every day. The backups are kept on this server for up to 14 days and, as a copy away from the server, for up to 90 days in the object storage of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. Hetzner processes the backups only on our behalf under a data processing agreement in accordance with Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR (our interest in restoring the service and your data after a failure) and, for workspace content, your instructions as the controller.

File storage. Files in the Looky app, for example uploaded documents and images, voice recordings, generated images and designs, logos, business photos and reports, are stored in the object storage R2 of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We use storage with the EU jurisdiction, so Cloudflare keeps these files in data centres in the EU. The storage is private: a file can only be opened through a link that Looky signs for a short time. When you upload or open a file in the app, your browser connects directly to this storage, and Cloudflare receives your IP address and technical data of your browser to transfer the file. Cloudflare processes the files only on our behalf under its data processing addendum in accordance with Art. 28 GDPR; for workspace content, Cloudflare is a sub-processor under our data processing agreement. As Cloudflare, Inc. is a US company, access from the USA cannot be ruled out; section 20 describes the safeguards. The legal basis is Art. 6(1)(b) GDPR (providing the app) and Art. 6(1)(f) GDPR (our interest in reliable, durable storage away from the server), and for workspace content your instructions as the controller.

Domain names. The name servers of getlooky.ai are run by Cloudflare, Inc. (DNS). When you open one of our addresses, your device or your internet provider asks for the address of our server, and Cloudflare's name servers answer. Cloudflare processes the IP address the query comes from (as a rule that of your internet provider or another DNS service, not that of your device) and the name queried. All our DNS entries are set to “DNS only”: your connection to the website and the app goes straight to our server and does not pass through Cloudflare, so Cloudflare sees neither the pages you open nor what you enter. Only when you upload or open a file in the app does your browser connect to the file storage directly (see above). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is that our addresses can be found reliably. Cloudflare acts as our processor under its data processing addendum.

Server log files. Each time the website or the app is accessed, the server automatically processes the following data in log files:

• IP address of the requesting device
• date and time of access
• requested URL and HTTP status code
• referrer (the previously visited page, if transmitted)
• browser type and operating system (user agent)

We need this data to deliver the website and the app, to ensure their stability and security and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and error-free operation. Log files are deleted after 14 days unless they are needed longer to investigate a specific security incident.

4. Cookies, local storage and Google Analytics

Website and app are separate. Tracking and analytics tools run only on our marketing website getlooky.ai, and only with your consent; today this is Google Analytics 4. The Looky app (app.getlooky.ai) and its admin area (admin.getlooky.ai) are separate applications: they load no analytics, advertising or marketing tools and set no tracking cookies. A consent you give in the cookie banner of the website applies to the website only and does not carry over into the app.

Necessary storage. Without your consent we only store what is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG): on the website your language choice, whether you have closed a notice and your choice in the cookie banner; in the Looky app a session cookie for signing in and a few entries for your settings (for example light or dark mode and the last workspace). We base the subsequent processing on Art. 6(1)(b) GDPR (signing in) and Art. 6(1)(f) GDPR (presentation in your language and with your settings). When you open the website without a saved language choice, our server shows you the language version that matches the language setting of your browser; nothing is stored on your device for this.

Google Analytics 4, only with your consent. If you agree in the cookie banner, we measure on our website which pages are visited and how visitors find us, using Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then sets cookies and processes pseudonymous identifiers, the pages you view, your device and browser and your approximate location derived from the IP address; Google Analytics 4 does not store IP addresses. We use the statistics only in aggregated form and keep the event data for 2 months. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (see section 20). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, Google Analytics is not loaded. You can withdraw or change your consent at any time in the cookie settings with effect for the future.

The cookie page lists every cookie and storage entry of the website and the app with purpose and storage period. We use no advertising cookies, no advertising pixels and no social media plugins.

5. Bot protection with Cloudflare Turnstile

To protect the sign-up, the sign-in code and the password reset in the app as well as the free AI visibility check, the public cancel page and the agency and Enterprise request forms on the website against automated abuse, we use Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When such a form is shown, your browser loads the check from challenges.cloudflare.com and connects to Cloudflare. Turnstile evaluates signals such as your IP address, the TLS fingerprint and user agent of your browser and the site key and address of the page the check runs on, and creates a token. When you submit the form, we send this token together with your IP address to Cloudflare for verification. We do not store the IP address for this. We use Turnstile only for this check, not to identify or track you; according to Cloudflare, it cannot directly identify anyone from these signals.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest is to keep bots from creating accounts, sending sign-in emails, sending requests or running costly checks. Accessing your device for this is strictly necessary for the security of the service you requested and therefore needs no consent (Section 25(2) no. 2 TDDDG). In our setup, Turnstile sets no cookie on getlooky.ai and stores nothing in the storage of our pages (details on the cookie page). Cloudflare processes the signals for the bot check on our behalf under its data processing addendum (Art. 28 GDPR) and, according to its own information, also uses them as an independent controller to improve its bot detection. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (section 20). More information is available in Cloudflare's Turnstile privacy addendum.

6. Free AI visibility check

When the free AI visibility check is offered on our website, you enter the address of a website and, optionally, what the business does and a city. No account and no email address are needed. We process:

• The entered data: website domain, optional category and city. The result (score, AI answers, sources, the domain, category and city) is kept for 7 days under a key derived from these entries, so that a repeated check is answered from the cache. We do not link the result to you as a person. A website address can still be personal data, for example when it belongs to a sole trader or contains a name, so we treat it as personal data.
• Your IP address: we store it only as a salted hash inside counters that limit checks per IP address and day. The counters are deleted after 48 hours, as are the counters per domain, which contain the domain.
• Bot protection: Cloudflare Turnstile checks the request (section 5). Your full IP address goes to Cloudflare for this and is not stored by us.
• AI providers: we put four questions, built from the category, the city and, for questions about the brand, the brand name derived from the domain, to ChatGPT with web search from OpenAI and have the answers analysed by an AI model (section 16). If you do not enter a category, we send the domain to an AI model to infer the line of business. Answers to the general questions (without your brand) are kept for 7 days and reused for other checks with the same question. Your name or other details about you are never sent.

The legal basis is Art. 6(1)(b) GDPR (providing the check you request) and Art. 6(1)(f) GDPR (protection against abuse and cost control). You can object at any time (section 22). The check is a snapshot of one AI engine; we do not promise any ranking or mention.

7. Fonts and external content

The Manrope font is stored on our own server. No connection to Google Fonts or other font providers is established when you visit the website. We do not embed third-party content when a page loads (no videos, maps, social media plugins or advertising networks).

8. Waitlist

When you join the waitlist, we process:

• your email address (required)
• optionally your first name and whether you are a business, a personal brand or an agency
• the page from which you signed up, the name of the button or page section and the plan you came from (only fixed labels, never free text), and your language
• proof of your consent: time, a hash of your IP address and the version of the consent text

We use the double opt-in procedure: after submitting the form you receive an email with a confirmation link. Only after you confirm are you added to the waitlist, and only confirmed addresses ever receive our emails. If you do not confirm, we delete the sign-up after 30 days. This ensures that nobody signs up with someone else's address. Every later sign-up with the same address adds a new proof of consent; earlier proof is never overwritten.

We write to you about the launch of Looky, early access and important product news.

The legal basis is your consent under Art. 6(1)(a) and Art. 7 GDPR and Section 7(2) no. 2 UWG. We store the proof of consent on the basis of Art. 6(1)(c) and (f) GDPR (accountability under Art. 7(1) GDPR). You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by writing to hallo@getlooky.ai. When you withdraw, we delete your name and your audience at once and stop all emails; we keep your email address with the proof of consent for 3 years to be able to demonstrate the lawfulness of the earlier processing and to respect your withdrawal, and then delete both.

9. Demo request

When you request a demo, we process your name, your email address, optionally your company, your audience selection, optionally your team size and your message, as well as the source page, the name of the button or page section and the plan you came from, and language. We use the data to contact you and to prepare the demo. If you give us the address of your website, we look at it to prepare.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) and, where you make the request on behalf of a company, Art. 6(1)(f) GDPR (our interest in answering requests). We delete the data 12 months after the request is closed, unless a contract results from it or statutory retention obligations apply.

10. Contact form and email

When you write to us via the contact form or by email, we process your name, your email address, optionally your company, your message as well as the source page, the name of the button or page section you came from, and language in order to answer your request. These two forms have no consent checkbox because we need the data to answer you; we do not store your IP address or browser details with the request. Emails to us arrive in our mailbox at IONOS (section 14).

The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR (our interest in answering requests). We delete a request 12 months after it is closed, and a contact form message at the latest 12 months after you sent it, unless retention obligations prevent this.

All forms contain a field that is invisible to humans to protect against spam bots, as well as a limit on requests per time period. For the request limit your IP address is processed only for the length of the limit window and is not stored with your request. For the waitlist only a hash of the IP address is kept, as proof of consent (section 8).

11. Sign-up, account and email code

When you create an account, we process your name, your email address, your password (only as a hash), your language, the confirmation that you use Looky as a business (text version and time) and, if you came through a referral link, the referral code (section 15). To confirm your email address, we send you a 6-digit code by email. Only after you enter it can you use the app; the code is valid for a short time and only once. For every sign-in session we store the IP address and the browser (user agent) to protect your account; a session is deleted when you sign out and otherwise with your account.

The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual steps) and Art. 6(1)(f) GDPR (security of accounts). If you never enter the code, we delete the sign-up 7 days after it was made.

You can also start with only your website address: before you have an account, we read the public pages of that website (and its imprint) and show you a preview. The address, the preview and your answers are held as a pending sign-up under a random reference in your browser; with your name and email address it becomes your account once you enter the code. Signing in works the same way, by a code sent to your email address. If you leave before you finish, we send at most two reminder emails, each with a link to stop them, and none once you have ordered. The pending sign-up is deleted 7 days after it was made, or when you claim it. If you tell us how you heard about Looky, we store that answer with your account to see which channels work.

If you cancel a plan through the public cancel page, we process the company, the email address you enter and your declaration for the proof of the cancellation (kept 3 years). If you ask for Enterprise or agency terms, we process your name, email address, company, website, number of companies and your message to answer you. The code forms, the cancel page and these requests are protected by Cloudflare Turnstile (section 5).

12. Using the Looky app

When you use Looky, we process:

• Account data: name, email address, role, organization and workspaces, language and notification settings
• Usage and log data: sign-ins, approvals, rejections, publications and automatic decisions in the audit log, technical error logs, AI usage per task for cost control
• Workspace content: brand knowledge (for example content of your website, uploaded documents, tone of voice, audiences, topics), drafts, comments, voice recordings and their transcripts, reviews and reply drafts, business data for directory listings, monitored public content of competitors, search and AI visibility measurements and, if you install the Looky snippet or plugin on your website, visit statistics without cookies and without storing IP addresses

The legal basis for account, usage and log data is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (security, cost control and traceability of approvals). Where workspace content contains personal data of third parties (for example names of reviewers, team members or visitors of your website), we process it as a processor on your instructions in accordance with Art. 28 GDPR.

Internal notifications. When something happens in a customer account (for example an account is created, an order is placed or a contract is cancelled), the Looky team receives an internal notification. Names, email addresses, survey answers and messages in it are removed 30 days after the account, organization or request they belong to has been deleted, and every such notification is deleted after 24 months at the latest. We send these notifications from our own mailbox at IONOS (section 14), not through Brevo. The legal basis is Art. 6(1)(b) and (f) GDPR (looking after our customers and contracts).

Deletion. We store your data for the term of the contract. When the contract ends, also when a free trial ends without a paid plan, we delete the organization with all its workspaces, content and stored files 30 days after the end; you can export your content until then. We email the owners 14 days before; choosing a plan until then keeps everything. Organizations without a plan that nobody has signed in to for 12 months, and confirmed accounts without any organization and without a sign-in for 12 months, are deleted as well; we warn you by email 30 days before, and signing in keeps them. Invoices and payment records are kept for the statutory period (section 13). Deleted data disappears from our backups in the regular backup rotation, at the latest after 90 days; until then backups are protected and used for nothing else.

13. Payments and invoices

If you book a paid plan, we process the payment through payment service providers, which act under their own responsibility:

• Card and SEPA direct debit: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. Mollie processes the data required for the payment (for example name, email address, payment method such as IBAN or card details, amount, time). Card details are entered in Mollie's checkout, not in Looky. If you pay by SEPA direct debit, you type your IBAN and the account holder's name into a form in the Looky app; Looky passes them to Mollie to set up the SEPA mandate and does not keep the full IBAN. We store only the account holder's name, the last four digits of the IBAN, the mandate reference and status, and the payment status and references. More information is available in Mollie's privacy policy.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. You log in at PayPal; we receive the payment status, references and the PayPal account name or email address shown to you. More information is available in PayPal's privacy statement.

For the invoice we process your company name, billing address, VAT identification number and billing email. If you enter a VAT identification number from another EU country, we verify it with the VIES service of the European Commission. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). We keep invoices, credit notes and payment records for 8 years after the end of the calendar year in which they were issued (Section 147 AO, Section 257 HGB, Section 14b UStG) and then delete them automatically.

When you place an order in the app, we keep proof of the order: time, plan, price, the accepted versions of the terms and the data processing agreement, your confirmation that you act as a business, your IP address and your browser. For SEPA direct debit we also keep proof of the mandate: account holder, last four digits of the IBAN, mandate reference, version of the mandate text, time, IP address and browser. We need both to prove the contract and the mandate (Art. 6(1)(b), (c) and (f) GDPR). We keep this proof as long as your organization exists, and at least for 8 years after the end of the calendar year of the order or the mandate; a daily job deletes it once both have passed. Our books of account and annual financial statements are kept by our accounting outside Looky; they contain your company name and the amounts invoiced and are kept for 10 years (Section 147 AO, Section 257 HGB).

14. Sending email with Brevo, mailboxes at IONOS

Sending: Brevo. Since 8 November 2026 we send all emails of Looky to you (the email code, confirmation emails, waitlist emails, confirmations of your requests, invoices and notifications from the Looky app) through Brevo, a service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes your email address, where applicable your name, the content of the email and delivery information (for example delivered, bounced, unsubscribed) on our behalf under a data processing agreement in accordance with Art. 28 GDPR. Brevo stores the data on servers in France and Belgium and uses Cloudflare, Inc. (USA, certified under the EU-US Data Privacy Framework) for its network protection.

Mailboxes: IONOS. The mailboxes of our getlooky.ai addresses are hosted at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Replies, messages to these addresses and notices about undeliverable emails therefore arrive at IONOS, and emails we write to you personally, for example answers to your requests, we send from these mailboxes, as do the internal notifications to the Looky team (section 12). IONOS processes your email address, where applicable your name, and the content of the emails on our behalf under a data processing agreement in accordance with Art. 28 GDPR.

Opens and clicks. We do not measure whether you open our emails or click the links in them. Brevo does not let accounts like ours switch off the counting of opens and clicks completely, so we have set it to anonymous: emails sent through Brevo contain a tiny image and links that lead through a Brevo server, and Brevo counts opens and clicks only as totals, without linking them to your email address or to you as a person. When your email program loads the image or you click such a link, your device connects to Brevo's server, which technically receives your IP address and browser details for this. Looky receives no open or click events: our connection to Brevo subscribes to none of them, and should such an event still arrive, we discard it.

We only send newsletters and marketing emails with your consent using the double opt-in procedure. We keep delivery information (delivered, bounced, spam complaint) for 90 days to deliver emails reliably and to stop sending to addresses that cannot receive them; addresses that bounced or complained stay on a block list as long as needed for that. The legal basis is Art. 6(1)(f) GDPR (our interest in reliable delivery). You can switch off notification emails from the app in every such email or in the notification settings.

15. Referral program

Every customer can recommend Looky with a personal referral link. If you sign up through such a link, the referral code from the link is stored with your new account at sign-up. We use no cookies and no tracking for this. We record which account referred which and, for the first 12 months, the net payments of the referred customer, so that we can credit 20 % of them to the referrer as a discount on the referrer's next Looky invoices. A customer is either an agency client or a referral, never both. The referrer only sees what is needed to understand the referral and the credit, for example its status and the credit amount, never the content of the referred customer's workspaces.

The legal basis is Art. 6(1)(b) GDPR towards the referrer (the referral program) and Art. 6(1)(f) GDPR towards the referred customer (our interest in rewarding recommendations correctly). We delete the referral code, the referrals and the credit records together with the referring organization. A credit taken off one of your invoices remains on that invoice and is kept with it for 8 years (section 13). If the referred organization is deleted, the referrer keeps only its business name at the time of the referral and the credit already earned.

16. AI service providers

Looky uses AI models from external providers to create and revise texts, classify content, transcribe voice recordings, generate images, find relevant passages in your brand knowledge (embeddings) and answer questions with web search for the visibility measurements. We call each task by its role, not by a fixed model, and send only the content the task needs, for example your request, relevant excerpts from your brand knowledge or a voice recording.

All providers act as processors under a data processing agreement in accordance with Art. 28 GDPR, and we send data to a provider only once that agreement is concluded. Under their business terms for the API services we use (for Google the paid Gemini API service), none of these providers uses the content we send to train its AI models. Providers may keep inputs and outputs for a limited time to detect abuse (OpenAI for up to 30 days) and delete them afterwards.

AI-generated content consists of suggestions. You decide what is published through the approval settings in your workspace. The legal basis is Art. 6(1)(b) GDPR or, for workspace content, your instructions as the controller.

17. Search data and visibility measurements

For the website, search and AI visibility analysis in the app we use further services as processors, each only after you set up the respective feature:

• DataForSEO OÜ, Tallinn, Estonia: search results, keyword volumes and AI Overviews for the keywords, domains and brand names you track.
• Google LLC, USA: the Google Places API to find and read the business listings you manage, PageSpeed Insights and the Chrome UX Report for speed data of your website (the website address is sent), and, after you connect your Google account, read-only access to Google Search Console and the Google Analytics Data API for the search performance and AI referral traffic of your property.
• AI providers (section 16): the questions of your visibility tracking are answered by AI engines with web search, and the answers are analysed for mentions of your brand and your competitors.

The legal basis is Art. 6(1)(b) GDPR and, for personal data in your workspace, your instructions as the controller.

18. Connected social media and publishing accounts

In Looky you can connect accounts on the following platforms to publish posts, read and reply to reviews and comments or maintain business data:

• Google Business Profile and YouTube (Google Ireland Limited, Dublin, Ireland)
• Instagram and Facebook (Meta Platforms Ireland Ltd., Dublin, Ireland)
• LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, Ireland)
• TikTok (TikTok Technology Limited, Dublin, Ireland)
• X (X Internet Unlimited Company, Dublin, Ireland)
• WordPress (your own website or your hosting provider)

The connection is made via the authorization procedure of the respective platform (OAuth) or via credentials that you enter yourself (for example a WordPress application password). We store the access tokens in encrypted form and only retrieve the data necessary for the functions you use: profile or page name and identifier, publishing status of your posts and, depending on the platform, reviews, comments and their replies. The platforms act under their own responsibility; their privacy policies additionally apply to posts published via Looky.

The legal basis is Art. 6(1)(b) GDPR; for third-party data (for example reviewers) we act as a processor on your instructions. You can disconnect an account in Looky at any time or revoke access in the platform's settings. After disconnecting, we delete the access tokens immediately.

Deleting data from connected platforms

You can request at any time that we delete all data we have received via a connected platform (for example Facebook, Instagram or LinkedIn). Here is how:

1. In the app: Disconnect the account under Settings, Channels. Access tokens are deleted immediately. To remove the other data as well, delete the workspace under Settings, Danger zone (owners and admins; deleted with all content and files after 30 days, restorable until then), the organization in the organization settings (owner; deleted after 30 days, cancelable until then) or your account under Settings, Account (deleted at once, together with organizations that have no other members).
2. By email: Write to hallo@getlooky.ai with the subject “Data deletion connected platform” and state the email address of your Looky account and the platform concerned. We confirm receipt and delete the data without undue delay, at the latest within one month (Art. 12(3) GDPR). You then receive a confirmation.

Data that we are legally required to retain (for example invoices) is restricted instead of deleted.

19. Recipients and sub-processors

We only pass on personal data if this is necessary for the purposes described, a legal basis exists or you have consented. We do not sell personal data. Recipients:

20. Transfers to third countries

Some service providers are located in the USA or belong to groups headquartered there. We transfer personal data to the USA only on one of these bases:

• EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR) for recipients certified under it. On 8 November 2026 this applied to Cloudflare, Inc. and Google LLC. Cloudflare's data processing addendum also contains the standard contractual clauses (modules 2 and 3), which apply should its certification lapse.
• Standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR), which are part of the data processing agreements, for OpenAI, Anthropic, TypeSafe and Perplexity. None of them was certified under the Data Privacy Framework on 8 November 2026.

Cloudflare keeps the files of the Looky app in data centres in the EU (section 3); the safeguards above also apply to any access from the USA.

The platforms you connect (section 18) contract with you through their companies in Ireland and are responsible for their own transfers. You can obtain a copy of our safeguards on request.

21. Retention periods

We only store personal data for as long as necessary for the respective purpose or as required by statutory retention obligations. Daily jobs of the Looky app delete the data when the period ends. Server log files are not deleted by these jobs but by the log rotation of our server, after 14 days; backups are deleted by the backup rotation, after 90 days at the latest.

22. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until then remains unaffected

Right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons (Art. 21(2) GDPR).

For all requests, a message to hallo@getlooky.ai is sufficient. We answer without undue delay, at the latest within one month.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is: The State Commissioner for Data Protection of Lower Saxony (Der Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, https://www.lfd.niedersachsen.de.

23. Obligation to provide data and automated decisions

You can use the website without providing personal data (apart from the technically necessary log data). For the waitlist, requests and the Looky app we need the details marked as required; without them we cannot provide the respective service. There is no statutory obligation to provide the data.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Automatic publishing in the Looky app follows the rules you set yourself.

24. Data security

We transmit all data encrypted via TLS (recognizable by “https” in the address bar). We store access tokens of connected accounts in encrypted form and passwords only as a hash. Workspaces are separated by tenant, and access is limited to the staff who need it. Sign-up, sign-in codes and password resets are protected against bots. We continuously adapt our technical and organizational measures to the state of the art.

25. Changes to this privacy policy

We update this privacy policy when our processing or the legal situation changes, for example when we introduce a new service. The version published here applies. For material changes that affect your Looky account, we will also inform you by email.