Privacy Policy
Last updated: August 15, 2026
Who this policy covers
This policy explains how LookTwice handles personal data when you visit our website, create an account, use the API or dashboard, purchase a subscription, or contact support. LookTwice is the controller for website and account data. For privacy questions or requests, email privacy@looktwice.dev.
Data we collect
We may collect account details such as name, email address, authentication provider, workspace membership, and login history; billing identifiers and subscription status received from Paddle; API request metadata; masked validation inputs and salted request hashes; public URLs, watch settings, catalog records, webhook configuration, support messages, device information, security events, and consent preferences. Anonymous public-tool metrics contain only the tool name, successful status, non-input result counts, and a daily rotating salted visitor hash; CSV tool inputs and email addresses are not stored for this measurement. Paddle processes full payment-card data; LookTwice does not receive or store full card numbers.
How we use data
We use data to create and secure accounts, deliver requested API operations, operate watches and webhooks, measure allowances, prevent fraud and abuse, provide support, communicate service or billing changes, comply with law, and improve reliability. We do not sell personal data and do not use customer API inputs to train general-purpose AI models.
Legal bases
Where a legal basis is required, we process data to perform our contract with you, comply with legal obligations, protect legitimate interests such as security and service improvement, and obtain consent for optional analytics or marketing where required. You may withdraw consent without affecting earlier lawful processing.
Payments and Paddle
Paddle.com Market Limited or the applicable Paddle entity acts as Merchant of Record for purchases and processes transaction, tax, fraud-prevention, and payment information under Paddle’s own privacy notice. LookTwice receives only the identifiers and status needed to provision and support your plan. Paddle may be an independent controller for its payment and compliance activities.
Service providers and disclosure
We use service providers for hosting, databases, queues, object storage, authentication, transactional email, AI-assisted extraction, error monitoring, analytics, customer support, and payments. They may process data only to provide their contracted service. We may also disclose information when required by law, to protect users or the Service, or as part of a business transaction subject to appropriate safeguards.
Minimal logging and sensitive inputs
Raw email addresses, full IBANs, API keys, webhook secrets, and payment credentials are excluded from ordinary application logs. Usage records keep the endpoint, outcome, timing, charged allowance, and a salted request hash. You should not submit sensitive personal data unless an endpoint expressly requires it.
International transfers
LookTwice and its providers may process data in the United States and other countries. Where required, transfers use contractual or other lawful safeguards. By using a global online service, you understand that privacy protections may differ between locations.
Retention
Account and subscription records are retained while an account is active and afterward as reasonably necessary for security, tax, fraud prevention, and disputes. Raw Knowledge Watch snapshots and anonymous public-tool event records are retained for up to 90 days. Structured change history remains until the watch is deleted. Expired idempotency response bodies are removed after 24 hours. Backup copies expire on their normal rotation schedule.
Your choices and rights
Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, and may appeal or complain to a privacy authority. Email privacy@looktwice.dev from your account address. We may verify your identity before fulfilling a request. You can manage service emails in your account where available; essential security, billing, and transaction messages cannot be disabled while the account remains active.
Cookies and similar technology
LookTwice uses essential cookies for authentication, security, theme preferences, and session continuity. Optional analytics or support tools are enabled only when configured and, where required, after consent. You can control non-essential cookies through the consent control when available or through your browser.
Security
We use reasonable technical and organizational controls, including TLS, hashed secrets, least-privilege access, log redaction, backups, and incident-response procedures. No online service can guarantee absolute security. Report a suspected security issue to support@looktwice.dev.
Children
The Service is intended for business users and developers and is not directed to children. We do not knowingly collect personal data from children below the minimum age permitted in their location.
Policy changes
We may update this policy as the Service or law changes. We will publish the updated date and provide additional notice for material changes where required.