Privacy Policy

1. Introduction

Quicklook LLC (“Company,” “we,” “our,” or “us”), a Washington limited liability company with mailing address at 9450 SW Gemini Dr PMB 506439, Beaverton, Oregon 97008, operates the Quicklook Studio web application and services (collectively, the “Service”).

This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of your Personal Information and other data when you access or use our Service.

This Privacy Policy applies to all users of the Service, including free tier users and paid subscribers, regardless of geographic location.

2. Definitions

• “Personal Information” means any information that identifies, relates to, describes, or could reasonably be linked with you.
• “Device Fingerprint” means a unique identifier derived from your device and browser characteristics.
• “Content” means any text, prompts, lyrics, audio, images, or other materials you submit to or generate through the Service.
• “AI Services” means third-party artificial intelligence services we use to process your Content, including OpenAI, Suno, and Fal.ai.
• “Generated Content” means music, lyrics, audio, artwork, or other materials created by the Service's AI systems based on your prompts.
• “Usage Data” means data about how you use the Service, including tokens consumed and features accessed.

3. Information We Collect

3.1 Information You Provide Directly

Account Information:

• Email address (required for account creation)
• Display name (required)
• Password (encrypted using industry-standard hashing)
• Phone number (required for verification and fraud prevention)
• Email verification status
• Phone verification status

Payment Information:

• Payment card information (collected and stored exclusively by Stripe, Inc., not by us)
• Billing address
• Stripe Customer ID (assigned by Stripe)
• Subscription tier and status
• Billing history and transaction records

Content and Creative Direction:

• Song generation prompts and creative instructions
• Lyrics you write or submit for enhancement
• Genre, mood, and style preferences
• Vocal gender selections (male, female, instrumental)
• Generated song metadata (title, genre, mood)
• Communications with our support team

3.2 Information Collected Automatically

Usage Data:

• Number of songs generated
• Token consumption per generation (varies by output format)
• Total tokens used per billing period
• Generation mode selected (AI Assisted, Manual)
• Output format selected (mastered WAV, mastered MP3, raw MP3)
• Timestamps of all actions
• Billing period start and end dates
• Subscription usage metrics

Technical and Device Information:

• IP address
• Browser type and version
• Operating system
• Device type and model
• Screen resolution and color depth
• Timezone and language settings
• Platform and hardware specifications
• User agent string
• Referrer URL
• Pages visited and features used
• Session duration and interaction patterns

3.3 Device Fingerprinting and Fraud Prevention

Phone Number Hashing:

We create an irreversible cryptographic hash (SHA-256) of your phone number (required for account creation) for fraud prevention purposes. This hash cannot be used to determine your phone number but allows us to detect if the same phone number is used across multiple accounts. Phone number hashes are retained permanently, even after account deletion.

3.4 Cookies and Tracking Technologies

Cookies are small text files stored on your device that help websites remember information about your visit. We and our third-party service providers use cookies and similar tracking technologies (pixels, web beacons, local storage) to provide, improve, protect, and analyze the Service.

Cookies We Use:

Managing Cookies:

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies. However, disabling cookies may prevent you from using essential features of the Service, including authentication and payment processing.

Do Not Track (DNT):

Some browsers include a “Do Not Track” (DNT) feature. We do not currently respond to DNT signals because there is no industry standard for how to interpret or honor DNT requests. We will continue to monitor developments in this area.

3.5 Information from Third Parties

• Stripe: Payment confirmation, subscription status updates, billing events, dispute information
• Google (Firebase): Authentication events, account creation confirmations, security alerts
• Google Analytics: Aggregated analytics data, user behavior insights, traffic sources

4. How We Use Your Information

4.1 Service Provision and Operation

• Create and maintain your account
• Authenticate your identity and manage login sessions
• Process your prompts and generate AI-powered music, lyrics, and audio
• Enhance your prompts using multi-agent AI systems to optimize generation quality
• Apply professional audio mastering to generated songs using adaptive processing
• Generate album artwork based on song genre, mood, and theme
• Store generated songs, mastered audio, lyrics, and artwork for your future access
• Track token usage against subscription tier limits
• Provide customer support and respond to inquiries

4.2 Billing and Subscription Management

• Process subscription payments via Stripe
• Manage subscription upgrades, downgrades, and cancellations
• Enforce token limits based on subscription tier
• Send billing-related notifications and receipts
• Calculate and reset token counters at billing period boundaries
• Handle payment disputes and chargebacks

4.3 Fraud Prevention and Security

• Detect and prevent creation of multiple accounts to exploit free trials
• Identify patterns of abuse or suspicious activity
• Block devices or phone numbers associated with fraudulent behavior
• Enforce account creation and usage policies
• Protect against unauthorized access to accounts
• Investigate violations of our Terms of Service
• Comply with legal obligations and law enforcement requests

4.4 Communications

• Send email verification messages (required for account activation)
• Send SMS/text message verification codes to your phone number (required for account activation and continued use of the Service)
• Notify you of subscription status changes, renewals, or expirations
• Alert you when approaching token limits
• Send service-related announcements and updates
• Respond to support requests and provide technical assistance

SMS Communications: By providing your phone number, you consent to receive transactional SMS messages for verification and security purposes. These messages are essential for the operation of the Service and cannot be opted out of while maintaining an active account. Message frequency varies. Message and data rates may apply.

4.5 Service Improvement and Analytics

• Analyze usage patterns to improve AI generation quality
• Monitor system performance and uptime
• Debug technical issues and fix bugs
• Understand which features are most valuable to users
• Plan infrastructure capacity and scalability
• Optimize mastering preset performance across genres

5. Third-Party Data Sharing and Processing

5.1 OpenAI (GPT-5.2)

Purpose: Multi-agent prompt engineering, lyric generation, genre detection, mastering preset selection, and artwork prompt generation

Data Shared:

• Your song generation prompts and creative instructions
• Lyrics you provide for enhancement
• Genre, mood, and style preferences
• Metadata for prompt optimization (no personal identifiers)

Privacy Policy: openai.com/privacy

Note: OpenAI may retain data for up to 30 days for abuse and misuse monitoring, then delete it. Your data is not used to train OpenAI models unless you explicitly opt in.

5.2 Suno (Music Generation)

Purpose: AI music generation engine producing MP3 and WAV audio

Data Shared:

• Enhanced music style prompts (generated by our AI agents, not your raw prompt)
• Lyrics (if applicable)
• Vocal gender preference
• Negative tags (to avoid unwanted audio characteristics)
• Generation parameters (style weight, weirdness constraint)

Privacy Policy: suno.com/privacy

5.3 Fal.ai (Image Generation)

Purpose: AI album artwork generation

Data Shared:

• Artwork generation prompts (based on song genre, mood, and theme)
• Image specifications (dimensions, style parameters)

Privacy Policy: fal.ai/privacy

5.4 Google (Firebase)

Purpose: Authentication, database, file storage, and cloud functions (backend processing)

Data Shared:

• Account credentials (email, encrypted password)
• User profile data (display name, verification status)
• Generated songs and mastered audio (stored in Cloud Storage)
• Album artwork (stored in Cloud Storage)
• Usage metrics and subscription data (stored in Firestore)
• Song metadata, pipeline status, and generation logs

Privacy Policy: policies.google.com/privacy

5.5 Stripe

Purpose: Payment processing and subscription management

Data Shared:

• Name and email address
• Payment card information (collected directly by Stripe, never touches our servers)
• Billing address
• Subscription tier and pricing
• Transaction history

Privacy Policy: stripe.com/privacy

Note: Stripe is PCI-DSS Level 1 certified, the highest level of payment security.

5.6 Other Third Parties

We may also share information with:

• Service Providers: Hosting, monitoring, analytics, and customer support tools
• Legal and Regulatory Authorities: When required by law, subpoena, court order, or to protect our rights
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets
• With Your Consent: When you explicitly authorize sharing with additional parties

6. Data Retention and Deletion

6.1 Active Account Data Retention

While your account is active, we retain all Personal Information, Content, and Usage Data necessary to provide the Service. This includes:

• Account information: Retained until account deletion
• Generated songs (MP3 and WAV): Retained based on your subscription tier's storage duration (7 days to permanent)
• Mastered audio: Retained for the same duration as the source song
• Album artwork: Retained until you delete the associated song or delete your account
• Lyrics and prompt data: Retained until you delete the associated song or delete your account
• Usage metrics: Retained for current billing period, then archived for fraud prevention
• Billing history: Retained for 7 years for tax and accounting compliance

6.2 Account Deletion

You may delete your account at any time through your account settings. Upon deletion, we will:

Immediately Delete:

• Email address, display name, and login credentials
• All generated songs (MP3, WAV, mastered audio)
• All album artwork
• All lyrics and prompt data
• Phone number (if provided)
• Current period usage counters

6.3 Legal Retention Requirements

Certain data must be retained longer to comply with legal obligations:

• Financial records: 7 years (IRS and tax law requirements)
• Dispute and chargeback data: Until fully resolved, plus applicable statute of limitations
• Legal hold data: Retained if subject to litigation, investigation, or subpoena

7. Your Rights and Choices

7.1 Access and Correction

You have the right to:

• Access your Personal Information through your account settings
• Update your display name, email address, and phone number
• Request a copy of all Personal Information we hold about you
• Correct inaccurate or incomplete information

To exercise these rights, contact us at info@quicklookstudio.com. We will respond within 30 days.

7.2 Data Portability

You may request an export of your data in a machine-readable format (JSON). This includes your account information, generated song metadata, usage history, and billing records (excluding payment card details, which are held by Stripe).

7.3 Deletion and Right to Be Forgotten

You may delete your account at any time. Most Personal Information will be deleted immediately, EXCEPT device fingerprints, phone number hashes, and anonymized usage metrics, which are retained for fraud prevention as described in Section 6.2.

GDPR (EU) Users: Our retention of fraud prevention data is based on legitimate interest (Article 6(1)(f) GDPR). If you believe this interest is outweighed by your privacy rights, you may object by contacting us. We will assess your objection and respond within 30 days.

7.4 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to Know: Request disclosure of Personal Information collected, used, or shared
• Right to Delete: Request deletion of Personal Information (subject to fraud prevention exceptions)
• Right to Opt-Out of Sale: We do NOT sell your Personal Information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights
• Sensitive Personal Information: We do not collect or process sensitive Personal Information as defined by CPRA

To exercise CCPA rights, email info@quicklookstudio.com with subject line “CCPA Request.”

7.5 Marketing Communications

We currently do not send marketing emails. If we introduce marketing communications in the future, you will be able to opt out via an unsubscribe link in each email. You cannot opt out of transactional emails (account verification, billing notifications, security alerts) as they are necessary for the Service.

8. Data Security

We implement industry-standard security measures to protect your Personal Information:

• Encryption in Transit: All data transmitted between your browser and our servers uses TLS 1.2+ encryption
• Encryption at Rest: Passwords are hashed using industry-standard algorithms; Firebase Storage uses Google's encryption at rest
• Access Controls: Firestore security rules enforce strict user isolation; only you can access your data
• Authentication: Firebase Authentication with email verification and phone verification
• Server-Side Processing: All audio mastering and AI processing occurs on secure server infrastructure (Firebase Cloud Functions), not on your device
• Regular Updates: We keep all dependencies and infrastructure up to date with security patches
• Monitoring: Automated monitoring for suspicious activity and unauthorized access attempts

NO GUARANTEE: While we strive to protect your Personal Information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. You use the Service at your own risk.

9. International Data Transfers

The Service is operated in the United States. If you access the Service from outside the United States, your Personal Information will be transferred to, stored in, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your country.

For EU/EEA Users: By using the Service, you consent to the transfer of your Personal Information to the United States and other countries. We rely on:

• Standard Contractual Clauses with our service providers (Google, Stripe)
• Your explicit consent to international data transfers
• Necessity of transfer for performance of our contract with you

10. Cookies and Your Consent

11. Children's Privacy

The Service is NOT intended for individuals under the age of 18. We do not knowingly collect Personal Information from children under 18. If we discover that we have collected Personal Information from a child under 18, we will delete it immediately.

If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us at info@quicklookstudio.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Updating the “Last Updated” date at the top of this Policy
• Posting a notice on the Service homepage
• Sending an email notification to your registered email address (for significant changes)

Your continued use of the Service after changes become effective constitutes your acceptance of the revised Privacy Policy.

13. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

We will respond to all inquiries within 30 days (or sooner as required by applicable law).

14. Legal Basis for Processing (GDPR)

If you are in the EU/EEA, our legal bases for processing your Personal Information are:

• Contractual Necessity: Processing necessary to provide the Service you requested (Article 6(1)(b))
• Legitimate Interests: Fraud prevention, security, and service improvement (Article 6(1)(f))
• Consent: Where you have explicitly consented to processing (Article 6(1)(a))
• Legal Obligations: Compliance with tax, accounting, and legal requirements (Article 6(1)(c))