Privacy Policy

This policy explains what personal data Lookio processes, why, who helps us do it, and what you can do about it. It is meant to be read, so it is short.

1. Who we are

Lookio is run by Guillaume Duvernay, a sole trader registered in Germany as Guillaume Duvernay – Unternehmensberatung für digitale Transformation, Richard-Sorge-Straße, 10249 Berlin, Germany. We are the controller of the data described here. Contact: hi@lookio.app.

If you use Lookio for your organisation and put other people’s data in it (documents, questions from your own visitors), you decide what is processed and why. In that case you are the controller and we process that content for you. If you need a data processing agreement, write to us.

2. What we process and why

Data	Why	Basis (GDPR)
Account: email, name, profile picture if you sign in with Google, workspace membership	To create and secure your account and send you sign-in codes and invitations	Contract
Your content: files, web pages, text you add, assistant instructions	To run your assistants: read, index and search it	Contract
Questions and answers: what is asked of an assistant (in the app, by API, CLI, MCP or a widget) and the answer	To answer, to show your history and to bill credits. Conversations are kept for 7 days (Free), 90 days (Starter) or 1 year (Pro)	Contract
Usage and security data: IP address, request logs, credits spent, rate-limit counters	To keep the service running, to stop abuse and to account for credits	Legitimate interest, contract
Billing: plan, subscription status, country, Stripe customer reference	To sell and manage your plan. We never see your card number	Contract, legal obligation
Emails: service emails (codes, invitations, billing and quota notices), onboarding and product emails, and our newsletter	To help you use Lookio and tell you what changes. You can turn off product emails in your profile settings, and every newsletter has an unsubscribe link	Contract, legitimate interest, consent for the newsletter
Support messages: what you send us and our replies	To help you	Contract, legitimate interest
Website analytics: pages viewed, referrer, country, browser. Without your consent they are counted anonymously and nothing is stored on your device	To know what works. See the Cookie Policy	Legitimate interest, consent for cookies

We do not sell personal data and we do not use it for advertising.

3. Your content and AI models

To answer a question, Lookio sends the relevant passages of your content and the question to AI models. To read a PDF or an image, it sends the file to an OCR service. To import a web page, it sends the address to a web reading service. We use the commercial APIs of these providers, which under their current terms do not use data sent through the API to train their models. We do not use your content to train models either. Models can still be wrong: see our Terms.

4. Who else processes your data

These companies process data on our behalf, only to provide the part of the service named here.

Provider	What for	Where
Cloudflare	Hosting, database, file storage (files are stored in the EU), email sending, AI gateway	Global network, files in the EU
Qdrant Cloud	The search index of your content	Germany (Frankfurt)
OpenRouter, with OpenAI and Google behind it	Models that read passages and write answers, and embeddings that make search possible	United States and other countries
Mistral AI	Reading PDFs, scans and images (OCR)	European Union
Linkup	Reading web pages you ask Lookio to import	Not specified by the provider
Stripe (Link)	Payments, taxes and invoices. Stripe is the seller of record for your purchase	United States and other countries
Plunk, sending through Amazon SES	Onboarding, product and newsletter emails	Not specified by the provider
Google	Sign-in with Google, if you choose it	United States and other countries
OVH, n8n (hosted on Railway), Slack	Our support mailbox, support replies and internal alerts. Alerts do not carry your content	Europe and United States
Crisp	Support chat on the website, loaded only if you accept it	European Union

Duv Analytics, our website analytics, is our own software running on Cloudflare: no third party receives that data.

When data goes outside the European Economic Area, we rely on the providers’ standard contractual clauses or on the EU–US Data Privacy Framework where they are certified. We may also share data when the law requires it.

5. How long we keep it

• Account and workspace: until you delete them.
• Resources: when you delete a resource, its index entries and original file are deleted. Deleting a workspace deletes everything in it.
• Conversations: for the period of your plan, listed above. Visitors of a public widget have the same period.
• Backups: our database can be restored for up to 30 days, so a deletion fully disappears from backups within that time.
• Billing records: as long as tax and commercial law require, up to 10 years.
• Request and security logs: only as long as needed to run and protect the service.

6. Your rights

You can ask us for access to your data, a copy of it, its correction or deletion, to restrict or object to its processing, and you can withdraw a consent at any time. Write to hi@lookio.app from your account email and we will answer within one month. Most things can also be done in the app: export and delete resources, delete a workspace or your account, change email preferences.

You also have the right to complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit; you can also contact the authority of your own country.

7. Security

Data is encrypted in transit, files and databases are encrypted at rest by our providers, and access to production is limited to the person who runs Lookio. No system is perfectly secure. If a breach affects your data, we tell you and the authorities as the law requires.

8. Children

Lookio is for people aged 18 and over.

9. Changes

When this policy changes in a way that matters, we tell you by email or in the app before it applies. The date at the top is the date of the last change.