Privacy Policy

At a glance

• We do not sell personal information, and this product has no advertising or analytics trackers.
• When a business installs the chat widget, we process its visitors’ messages on that business’s behalf to answer them. The business decides what its assistant says and where leads go.
• Answers are generated with Google’s Gemini API. Under Google’s paid terms, as published on the date of this policy, Google does not use that content to improve its products. See How AI is used.
• Anonymous visitor chats are deleted after 30 days without activity.
• You can ask us for a copy of your information, a correction, or deletion. See Your choices and requests.

1. Who this policy covers

This policy covers Quicklook Chat on this website and in the chat widget a customer installs on its own website. It applies to two groups of people, and we treat them differently:

• Customers and their teams. Businesses that sign up, and the people they invite into the portal. For account, billing, and security information, Quicklook decides why the information is collected and how it is used.
• Visitors. People who chat with a customer’s assistant on the customer’s website. The customer chooses to install the widget, what the assistant may say, and where leads are sent. Quicklook processes visitor information to provide that service, and the customer is responsible for its own privacy notice to its visitors.

This policy does not cover:

• The customer’s own website, apart from the widget and the public pages we read to answer questions about that business.
• Systems a customer runs, including a CRM or inbox after we deliver a lead there.
• quicklook.dev, which has its own privacy policy.
• Payment card numbers. Stripe processes card payments, and we do not store full card numbers.

Please do not use Quicklook Chat to collect government identifiers, payment card numbers, or health information. This product is not a HIPAA service. The Terms of Service are part of the agreement for this product.

2. Information we collect

Customers and their teams

When someone creates an account or is invited into one, we collect:

• Email address, and a password, which is held by Firebase Authentication. We do not store the password ourselves.
• A mobile number in the United States or Canada, used to text a sign-in code. Message and data rates may apply. We do not send marketing texts.
• The date and version of the Terms of Service and this policy accepted at signup.
• Business details: the business name, locations, teammate invitations, roles, widget settings, and the website address you connect.
• Short notes about your public website that the assistant writes (we call them site skills), and any edits you make to them. We do not archive your site or store your catalog.
• Billing status from Stripe: customer id, plan, and subscription state. Stripe holds the card.

To refuse passwords that have appeared in known breaches, your browser sends the first five characters of a one-way fingerprint (a SHA-1 hash) of the password to Have I Been Pwned (api.pwnedpasswords.com). The password itself is never sent. If that check is unavailable, signup continues.

Visitors on a customer’s website

When a visitor opens the chat widget, we collect:

• An anonymous sign-in id. It is not the visitor’s name.
• The messages the visitor and the assistant send, and any replies a person at the business sends after taking over.
• The page the chat was opened from, when the widget can see it.
• Short memories from the visitor’s chat, such as what they said they were shopping for, stored with an embedding (a numeric form used to find relevant memories) only under that business and that visitor.
• A session credential that lets the visitor return to the same conversation. See Cookies and similar storage.
• A lead, only when the visitor agrees to be contacted: name, email, phone, what they need, and the page it came from. The in-chat form records a checkbox that the business may contact them, and agreement stated in the chat can be recorded the same way.

Your public website

After a customer connects a website, we read its public pages: the homepage and a limited set of other pages (at most 22 in a study), plus pages read live to answer a visitor’s question. If a page shows nothing on a plain read, we may load it in an isolated browser we operate. If a listing still cannot be read, a Google-operated agent, limited to that site and its www address, may look for a data feed on that site. We keep a feed only when our own read of it returns items on that site. We follow robots.txt Disallow rules. We do not log in to sites, bypass access controls, or read sites a customer did not connect.

Technical data

We use IP addresses to limit abuse and to secure the service, and security logs may include them. Rate-limit records store a one-way hash of the requester. The portal uses Firebase App Check and, at the phone step, Google reCAPTCHA to detect abuse. We do not use this technical data to build advertising profiles.

3. How we use information

• Create and secure accounts, including email verification and sign-in codes.
• Study the connected website, answer visitors, and show the business its conversations, leads, and settings.
• Send leads to the email address or CRM the customer sets up. Account email is sent from support@quicklook.dev. Lead email and ADF messages are sent from aichatleads@quicklook.dev.
• Measure use against the plan the customer paid for, and stop work that would go past those limits.
• Keep a short playbook for a business’s own assistant, learned from that business’s own conversations. It is not shared with other customers.
• Bill, prevent fraud, fix problems, and meet legal obligations.
• Record the agreement accepted at signup.

4. How AI is used

Replies, website study, memory search, and the limited feed lookup run on Google’s Gemini API through a billed Google Cloud project. To do that work we send Google the text it needs, including chat messages and text from the public pages being read. Quicklook does not use customer content to train its own models, and this product does not offer custom model training.

Under Google’s Gemini API terms for paid services, as published on the effective date of this policy, Google does not use paid-service prompts or responses to improve Google’s products. Google logs prompts and responses for a limited time to detect abuse and to meet legal requirements, and that data may be stored in any country where Google or its agents operate. Google’s terms control if they differ. Search and Maps grounding are off unless Quicklook enables them for a business. When they are on, Google’s terms for that feature allow Google to store the related prompt and output for about 30 days.

AI answers can be wrong, incomplete, or out of date, and they are not professional advice. The Terms of Service state what customers and visitors should rely on.

5. Who we share it with

We share personal information only with the parties below, for the reasons given.

Service providers

• Google (Firebase, Google Cloud, Gemini API, reCAPTCHA, and Gmail) hosts the service, stores data, authenticates users, sends email, checks for abuse, and generates model output. Google’s Privacy Policy and Terms of Service apply to those services, along with the Gemini API terms linked above.
• Stripe processes subscriptions. See Stripe’s privacy policy.
• Have I Been Pwned receives only the partial password fingerprint described above.

The customer

People a customer authorizes can read that business’s conversations, leads, and settings in the portal. Leads go to the email address or CRM the customer names. If no destination is set, the lead is not sent, but it can still appear in the portal. What the customer does with a lead after it arrives is up to the customer.

Legal requirements and business transfers

We may share information when the law requires it, or to protect the rights, property, or safety of Quicklook, our customers, visitors, or others. If Quicklook is involved in a merger, acquisition, or sale of assets, information covered by this policy may transfer with that transaction. Quicklook staff may access information to operate, secure, and support the service.

6. We do not sell your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. This product loads no advertising or analytics tags. Because of that, a browser’s Global Privacy Control signal changes nothing here: there is nothing for it to turn off.

For visitor information we process on a customer’s behalf, we do not keep it for our own advertising, and we do not combine one customer’s visitors with another’s to build a marketing profile.

7. Cookies and similar storage

We use cookies and browser storage only to run the service, not for advertising.

• session: keeps you signed in to the portal, for about 5 days. A password alone does not create it; a texted code is also required.
• activeLocation: remembers which of your locations you selected in the portal, for about 5 days. It is a location id, not a GPS position.
• visitor: lets a visitor return to the same chat, for about 14 days. Scripts on the page cannot read it, and on secure connections it is partitioned so that it is not a general third-party cookie.
• ai-chats-visitor:<installation id> in the host page’s local storage: the same chat session, kept for up to 13 days so a returning visitor can be recognized, including after the browser is closed on some phones. Scripts on the host page can read this value.
• Google reCAPTCHA cookies, only when a sign-in code is sent.

We do not set analytics cookies such as _ga, and we do not set advertising cookies. We do not use session replay or software that records what you type outside a message or form you choose to send. Blocking cookies in your browser can stop sign-in or the chat session. The marketing pages still load.

8. How long we keep information

• Anonymous visitor chats, memories, and the leads tied to that visitor are deleted after 30 days without activity, unless we are legally required to keep them.
• Google may delete an unused anonymous sign-in on its own inactivity schedule.
• Account, agreement, audit, and billing records are kept for the life of the account, and afterward as needed for tax, accounting, security, fraud prevention, and legal claims.
• Daily backups are kept for 14 days. Deleted information can remain in a backup, and in point-in-time recovery, until that copy expires.
• Sessions expire on their own: the portal session after about 5 days, the visitor cookie after about 14 days, and the copy in the host page’s storage after 13 days or when that site’s storage is cleared.

There is no button in the product that deletes an entire account. To ask us to delete one, see Your choices and requests.

9. Your choices and requests

You can ask Quicklook to:

• Provide a copy of personal information you submitted.
• Correct account information you cannot change yourself.
• Delete personal information, subject to records we must keep and to the backup window above.
• Reconsider a denied request. Reply to our response to appeal.

Visitors on a customer’s website should contact that business first. The business decides the purposes of that chat and holds any lead we already delivered. If you contact us, name the business and the website. We may need to confirm that you control the email address or account. We may deny a request where the law allows, including when it would expose someone else or when a legal hold applies. We will not discriminate against you for making a request the law gives you, and we respond within the time the applicable law requires. An authorized agent may make a request on someone else’s behalf, and we may ask that person to confirm it.

We do not sell personal information or share it for cross-context advertising, so there is nothing to opt out of. We do not use sensitive personal information to infer characteristics about you: phone numbers and sign-in data are used to authenticate the account, and chat text is used to provide the chat. California residents may use the contact details below.

10. Security

We use reasonable safeguards appropriate to this service: access limited by business, HTTPS, and the controls of our cloud providers, which encrypt stored data. This is not end-to-end encryption. The business can read its chats in the portal, and Quicklook can access them to run the service. No method of transmission or storage is completely secure.

11. Children

Quicklook Chat is not directed to children, and it is not for anyone under 18. We do not knowingly collect personal information from children under 13. Customers must not use the widget to knowingly collect information from children. If we learn that we have, we will delete it.

12. Where information is processed

Quicklook LLC is a Washington company and runs this service from the United States. Information is processed in the United States, except that Google may process model prompts in other countries as its terms describe. We do not have a representative in the European Economic Area, the United Kingdom, or Switzerland. A customer that collects personal information from people in those places is responsible for its own notices, lawful basis, and transfer steps.

13. Changes to this policy

We may update this policy by posting a new version on this page with a new effective date. The date at the top is the version that applies. If you have an account and do not agree to a change, cancel before you keep using the service. Continued use after a later effective date means you accept that later version. The version stored on your account is the one you accepted at signup.

What changed on October 29, 2026: we rewrote and reorganized this policy in plainer language. We did not change what we collect or how we share it.

14. Contact us

Questions and privacy requests about Quicklook Chat:

support@quicklook.dev
(503) 451-3279

Quicklook LLC is a Washington company. The Beaverton, Oregon address is its mailing address. Company-site requests stay on the quicklook.dev privacy policy. Paid custom work is covered by its own agreement and by the quicklook.dev terms.