Privacy Policy | QikTools

1.Who is responsible for your data

QikTools is a trade name of Sarthak Daruka, an individual carrying on business in India as a sole proprietor. Sarthak Daruka decides how your personal data is used for QikTools: the “controller” under the GDPR, and the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023. Principal place of business: Asansol, Paschim Bardhaman, West Bengal, India.

Contact us at hello@qiktools.com. Our Grievance Officer is Sarthak Daruka (hello@qiktools.com), who handles privacy requests and complaints.

EU and UK representative. We are established in India and have no establishment in the European Union or the United Kingdom. We have not yet appointed a representative under Article 27 of the GDPR or of the UK GDPR. When we do, we will name them here. Until then, please contact us directly. You can always complain to your local data protection authority.

2.What this policy covers

This policy covers the QikTools website, apps and developer API, the emails we send, and reports made to us by anyone, including people without an account. It doesn’t cover other companies’ websites or services, even when we link to them.

If your organisation uses QikTools and uploads other people’s personal data (for example photos of a client’s staff), your organisation decides why that data is used and must have a lawful basis for it. We process that data on its behalf to provide the Service, under our Data Processing Agreement.

Under India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, this is our privacy policy for personal information and sensitive personal data. It is also written to meet the notice requirements of India’s DPDP Act and Rules, the GDPR, the UK GDPR and US state privacy laws.

3.The personal data we collect, and why

Each item below lists what we collect, why and on what legal basis. You don’t have to give us any of it, but without account details we can’t give you an account, and without the content a tool needs, that tool can’t run.

Account and sign-in
What
Your name, email address and password (stored only as a secure hash by our sign-in provider), sign-up date, the version of the terms you accepted and when, and your confirmation that you are 18 or older. If you sign in with Google, Microsoft or your organisation’s single sign-on, the name and email address that service shares with us. How your account started (your own sign-up, a team invitation, your organisation’s directory or single sign-on, or setting up an agency) and whether and when you activated a personal workspace. We also keep a record of each consent, confirmation and agreement you give in QikTools: the exact words you were shown, your choice, the date and time, the page, your IP address and browser, and a fingerprint of any file it refers to. If you pick a language in the language menu while signed in, we also keep that choice with your account.
Why
To create and secure your account, let you sign in and contact you about it. A saved language choice lets a browser or device you sign in on open in the language you picked, and lets us write our emails to you in it.
Legal basis
Performing our contract with you; keeping a record of your acceptance of the terms; proving what you agreed to (a legal obligation) and establishing and defending legal claims.
Plans, credits and purchases
What
Your plan, credit balances, credits charged and refunded, and purchase records: what you bought, the amount, currency, date and status, your country for tax, the currency you chose to see prices in (US dollars or Indian rupees), and the payment provider’s customer and transaction references (Dodo Payments for US dollars, Razorpay for rupees). Your card, UPI and bank details stay with the payment provider.
Why
To sell and renew plans, add credits, show prices in the currency you chose, handle refunds and disputes, and keep tax and accounting records.
Legal basis
Contract; legal obligation (tax and accounting).
Your content
What
Prompts, scripts, uploads (images, audio, video, documents, spreadsheets and ad-performance exports), recordings, links you paste, the results the tools create, projects, designs, library items, share links and scheduled posts.
Why
To run the tools you choose, save your work and share it with your team or the people you send a link to.
Legal basis
Contract.
Faces and voices
Sensitive
What
Photos and videos of people, voice recordings and samples, spoken consent recordings, the name of the person a face or voice belongs to, and the consent confirmations you give.
Why
To create the presenter, voice, dub, translation or custom model you ask for, and to keep evidence of consent.
Legal basis
Your explicit consent, and the written consent of the person shown or heard, which you confirm you hold. Consent evidence is kept to establish and defend legal claims.
Brand Vault and business details
What
Brand name, logo, colours, fonts, tone of voice, audience, products, website and social links, and the brand rules you set.
Why
To apply your brand to what you make and to review content against your own rules.
Legal basis
Contract.
Fonts you add to a Brand Kit
What
The font files you upload (TrueType, OpenType, WOFF or WOFF2), each font’s name, weights and styles, who added it and when, and your confirmation that you have the right to use it.
Why
To let you and your teammates use your brand’s own fonts wherever QikTools offers a font menu, such as in the Design Studio and the Brand Vault.
Who can see it
Only you or, for a team’s Brand Kit, the members of that team. The files are stored privately in that workspace: they are never public, and they are handed only to people who can use that Brand Kit.
Legal basis
Contract.
Teams and social planning
What
Team names, members’ names and email addresses, roles, permissions, spending limits, approval requests and comments, invitations (including the invited person’s email), verified domains, and your posts, captions, schedules and campaigns.
Why
To run teams, route approvals, and remind you when it’s time to post. If someone signs in with a company email address that a team has verified and the team has no free seat, we tell the team’s owner and the people who manage its members (in the app and by email) that someone from that company’s domain tried to join, naming the person (or a masked email address if we have no name), and we tell the person; to avoid repeating ourselves we keep a record of the team, the person and the day for 30 days, then delete it. If a seat opens within 3 days, we tell that person once, in the app and by email to the address on their account, with a button to join; the button opens a page that explains what joining means, and nobody is added without pressing it.
Several teams
If you’re on more than one team, each team sees only what you share in its own workspace, never your other teams, what you share there, or your personal workspace. The members of each team you are on can see that you belong to it (your name, email address and role), and QikTools support can see every team you are on. Design Studio designs you make in a team’s workspace, and the pictures inside them, can be opened by that team’s members and changed by those whose role allows it; a team design shows who saved it last. Designs in your personal workspace stay private to you, and when you leave a team its members can no longer open the designs you made there.
Legal basis
Contract; for people who are invited, our legitimate interest in letting teams invite them.
Usage and activity
What
Which tools you run and when, the model chosen, credits charged or refunded, errors, and what each run cost us at our providers.
Why
To show your usage report, bill accurately, fix problems, and improve QikTools from statistics that don’t identify you.
Legal basis
Contract; legitimate interests.
Device and security data
What
IP address, the approximate country it indicates, browser and device type, timestamps, sign-in and request logs, rate-limit counters, and bot-protection signals from Cloudflare Turnstile.
Why
To keep accounts and the Service secure, stop abuse, respect sanctions and our providers’ country rules, investigate incidents and keep required logs.
Legal basis
Legitimate interests; legal obligation (for example India’s CERT-In directions).
Safety and trust records
What
Results of automated checks on requests (the category and a one-way fingerprint of refused text, not the text itself), strikes, account restrictions and the reasons for them, fraud and abuse signals (sign-up patterns, refund loops, payment disputes, unusual spending), reports about content with our decisions, and provenance records of generated files.
Why
To prevent illegal content and abuse, enforce our policies, protect people shown in content, and let anyone verify AI content.
Legal basis
Legitimate interests; legal obligation (India’s IT Rules).
AI text records
What
For each finished piece of about 30 words or more that our writing tools generate: a one-way fingerprint of the text (a SHA-256 hash of its words and a sample of hashes of its word sequences), the tool, the AI model that wrote it, how AI was involved and the date. Never the text itself, and nothing that identifies you: no account, project, IP address or browser details are stored with it. Pieces that mostly repeat your own material, and small spelling or grammar fixes to your own writing, are not recorded.
Why
To make AI-generated text detectable, as the EU AI Act (Article 50(2)) requires of us as the provider, so that anyone can check a pasted text on our verification page.
Legal basis
Legitimate interests: ours, and the public’s, in AI-generated text being detectable as the EU AI Act (Article 50(2)) requires; the Act leaves the method to us, so we don’t call it a legal obligation. We weighed this against your interests: the records hold only one-way fingerprints of our output, never the text and nothing that identifies who made it, a match reveals only the day and the tool, and they are deleted automatically after 3 years. Because nothing identifies you, we can’t look them up by person, so they are not part of your data export or account deletion. You can object: send us the text and we will remove its fingerprint unless we need it to deal with a report of misuse. Under India’s DPDP Act the records are not linked to any person; if one ever relates to you (for example a text that names you), the same request removes it.
Messages and support
What
Support requests, feedback, your reasons for cancelling (if you tell us), emails you send us (including to our company mailbox), notifications we show you, a copy of each email we send you (who it went to, the subject, the message as you received it and whether it was delivered), and your email preferences.
Why
To help you, keep a record of what we told you, and improve the Service. We keep our copy of each email we send you for 90 days, so we can show you what we sent, answer a support question and fix delivery problems; then it is deleted automatically, and sooner if you delete your account. One-time sign-in codes and the private tokens inside links are never kept in these copies, and only people we have specifically authorised can read them.
Legal basis
Contract; legitimate interests.
Developer API
What
API keys (stored only as a secure hash, plus their first characters), the address your webhooks go to, and API job records.
Idempotency keys
When your integration sends an Idempotency-Key, we keep the key, a SHA-256 fingerprint of the request body (never the body) and the response we sent (for example the job id, result links and credits charged) for 24 hours, so a retry gets the same answer; then they’re deleted.
Why
To authenticate your apps and deliver results.
Legal basis
Contract.
Compliance center
What
Your data-retention setting and its previews and deletion rounds (counts only, never file names); the Compliance Reports you make (their ID, scope, counts and fingerprint, not the reports themselves); and a team’s acceptance of our Data Processing Agreement, with the name of the person who accepted it. That acceptance stays with the team as contract evidence after the person’s account is deleted, and is deleted with the team.
Why
To run the retention and reporting features you switch on, and to record a team’s acceptance of the agreement.
Legal basis
Contract; for the acceptance record, establishing and defending legal claims.
Reports from anyone
What
If you report content, even without an account: your email address, the category, the links or descriptions you give, any evidence you share, and our messages with you.
Why
To handle the report, protect the people affected and meet our legal duties.
Legal basis
Legitimate interests; legal obligation.
Help assistant (Munns)
What
The questions you type, the page you are on and, when you are signed in, your first name, plan and credit balance.
Why
To answer your question. Conversations aren’t stored on our servers; your browser keeps them until you close the tab.
Legal basis
Legitimate interests; contract.
Talk to Munns (live voice help)
What
While a conversation is open: your voice, anything you type into the panel, the words your voice is turned into (the captions), the page you are on and, as for the text chat, your first name, plan and credit balance. A record of each conversation: when it started and ended, how long it lasted, what it cost us, quality numbers (such as how quickly Munns answered) and which on-screen actions were used. Never the words.
Why
To hold the conversation you start. Your voice is streamed to our AI provider (OpenAI) so Munns can understand you and answer out loud; the captions are shown to you and checked by an automated safety screen (OpenAI’s moderation service), then discarded. We don’t record or keep your voice or the words of the conversation, except a request refused as child sexual abuse material, which is kept as evidence (see “Safety checks” under How AI processing works). Your browser keeps the captions until you close the panel or the tab, and adds them to your text chat if you choose “Continue in text”. The record of each conversation lets us apply the free minutes, keep costs fair and fix problems; it is deleted after 90 days.
Legal basis
Contract (the help you ask for); legitimate interests (fair-use limits, safety and security).

We don’t use advertising trackers, we don’t buy data about you, and we don’t ask for health, financial account, religious or similar sensitive data. Please don’t upload it unless a tool genuinely needs it.

Fonts on QikTools’ own pages come from our own servers too: your browser never contacts Google Fonts or any other font service for them. When you pick a font from the font library, our server fetches it from Google Fonts for you and sends nothing about you, only the font’s name. When a document has text in scripts like Chinese, Japanese or Korean, your browser asks our server for a font file containing just those characters; the text is used only to build that file and is not stored, logged or shared.

4.Faces, voices and consent

Photos of people and voice recordings can reveal who someone is. We treat them as sensitive personal data, and we use them only with explicit consent:

Before you upload or use a real person’s face or voice, QikTools asks you to confirm that it is yours, or that you hold that person’s written consent. For a voice saved in the Voice Rights Vault, the voice’s owner also records a short spoken consent that we check.
We use faces and voices only to create what you ask for. We don’t build face or voice recognition templates to identify people, and we don’t use them to train AI models, other than a custom model you choose to train for yourself. The AI provider that makes the result receives them for that job; see How AI providers handle your content.
A child’s face or voice is never used for realistic images, video or audio. Where a tool offers it, a parent or guardian, or someone with the guardian’s permission, can turn a child’s photo into an illustration (for example a storybook character); they confirm this each time, and the photo is used only to make what they ask for.
You can decline: every tool that uses a real face or voice offers an AI presenter or a stock voice instead. You can withdraw consent at any time by pausing or deleting a voice or model, or by deleting the content. That stops future use but doesn’t undo lawful use before then.
The samples themselves are deleted with the voice, model or account. The consent record (who confirmed what and when, the consent wording’s version, the person’s name, fingerprints of the files, and technical details such as a hashed IP address and your browser type) is kept as evidence for 6 years after the later of the last use and your account’s closure. Any written release you upload is kept as part of that evidence.

Face tracking in the Video Clipper runs on your own device, in your browser; those frames are not sent to us. If your browser closes while a Video Clipper analysis is running, we keep the finished analysis for up to 2 days so you don’t pay twice; it is deleted as soon as your browser confirms it has it. For talking-head videos, your photo creates a temporary presenter at our video provider, which we delete as soon as the video is ready (Runway’s terms still let it use inputs, including presenter photos, to train its models).

5.How AI processing works

When you run a tool, we send the content that job needs, such as your prompt and a reference image, to the AI provider that performs it, and we store or return the result. Each provider and what it receives is listed on the Third-Party Processors page, and each model on the AI Models & Providers page. Providers process content to return results under their API terms. Some keep it for a limited period (for some, up to 30 days) to detect abuse.

We don’t use your content to train AI models, and we don’t sell it or share it for advertising. Custom brand models you choose to train are the only exception, and they are private to you. Some AI providers’ own terms are different: see the next section.
Safety checks. Before a request runs, automated tools check its text and images, frames from uploaded videos, and a transcript of the first 60 seconds of uploaded speech (made by OpenAI, or ElevenLabs Scribe through Fal) for prohibited content, including against a list of public figures’ names. (The AI Video Translator checks a video’s frames before anything is charged, and its whole transcript before any of it is translated or voiced; a language that is stopped is refunded.) When a request is refused, we log the category and a one-way fingerprint of the text, not the text itself — except a request refused as child sexual abuse material or intimate imagery of a real person, which we keep in full for 180 days as evidence and may report to the police where the law requires.
AI labels. To decide whether an image or video looks like a real person or a real event and so needs a visible AI label, we may send a small, low-resolution copy to an AI model for an automated check. Generated files carry a generation ID and content credentials that name QikTools and the model, never your name or email address. Anyone can check a file on the verification page, which never reveals who made it.
Checking and signing text. When you check a text on the verification page, your browser works out a one-way fingerprint of it and sends only that to us, never the text. We compare it with the AI text records, return the answer and keep nothing about the check. (If you send a text to the free checking API instead, we fingerprint it in memory and don’t store or log it.) When you download AI-generated text while signed in, your browser sends the same kind of fingerprint so that we can sign the file’s AI mark if we recognise the text; we keep nothing about that request either. We count requests per account and network address for a short time to prevent abuse.
Signing documents and ZIP packs. When you download a PDF, a Word, PowerPoint or Excel file or a ZIP pack made by our tools while signed in, your browser works out a one-way SHA-256 fingerprint of the file and sends only that to us, never the file. For a ZIP pack it also sends the names, sizes and fingerprints of the files inside, so the signed list can name them. We sign the AI mark with them, send it back and keep nothing about the request. The mark never contains your name, email address or account details, or the title or file name of a document (a pack’s list names the files inside the pack). When you check a Word, PowerPoint or Excel file, a ZIP pack or a PDF that carries our signed mark on the verification page, your browser reads it on your device and sends only the mark it finds and the fingerprints to compare with it. We count requests per account and network address for a short time to prevent abuse. Our legal basis is performing our contract with you (the download you asked for) and our legitimate interest in AI content being recognisable, as the EU AI Act (Article 50(2)) requires.
Your library. To make your asset library searchable, we may create short descriptions and search indexes of your files with an AI model. They are stored with your account and deleted with it.
Files you save to your Library. Our AI and media providers delete the files they make after a period (some after about 7 days). When you choose “Save to Library”, we copy the file into your private storage, held for us by Supabase (see Third-Party Processors), so it stays until you delete it. Unless you switch it off in your Library, we also make that copy for you when you export (download) a result, share it by link, or finish a campaign with it. Only you can open your saved files; the members of a team, and visitors, see one only if you share it with that team or by link. Files you upload to your Library are kept the same way. How much you can keep depends on your plan, and a team on a paid team plan shares one allowance: when it is nearly full we pause automatic copies, when it is full we stop adding, and we never delete a saved file because your storage is full or your plan changed. We check what a file really is before we keep it, and we don’t keep a file our safety team has removed after a report. Saved files are listed in your data download, with private links to the files, and are deleted when you remove them or delete your account; a copy that never finished saving is removed by our daily clean-up once it is a day old.
Your Brand Vault is added to prompts only for your own (or your team’s) runs, and you can switch it off for any run.
Auto (best value) model selection. When Auto selects a model, your request goes to the provider of the model selected, which is named before you run it. You can set Auto to use only providers whose published terms say they don’t train their models on content sent to them (“Only providers that don’t train on my content”); we treat a provider as not training only where its own terms say so, and the setting is remembered in your browser. Auto’s selection uses only the request itself, with no profiling of you, and no additional data is collected for it.
AI Content Repurposer. Your browser extracts and compresses the audio of a recording and only the audio is uploaded; the video stays on your device, where clips are cut. We delete the uploaded audio as soon as transcription starts (an upload whose pack never started is removed by our daily clean-up once it is over 24 hours old). A copy cut at the length you paid for goes to our transcription processor (ElevenLabs Scribe, through Fal), and the transcript or your text goes to our language-model processor (OpenAI) to write the pieces. Your packs (transcript, pieces, edits and settings) stay in your account until you delete them; deleting a pack erases its content, keeping only the minimal charge and refund record for accounting. They’re included in your data export and erased when you delete your account. If you connect a podcast feed, we store its address, the show’s title, the owner address in masked form, a fingerprint of the verification code (never the code) and the episodes already seen; we read the feed every few hours and download a new episode’s audio only to transcribe it. Quote cards and carousel slides you export carry Content Credentials and metadata saying they were made with QikTools. If you leave “Add the posts to my Social Library” on, a pack’s social, LinkedIn and X posts are copied into your Social Library when the pack is ready (Autopilot’s packs only when you add them); they stay there until you delete them, even if you delete the pack. Projects you made with the former Social Content Multiplier stay in your account, can be opened read-only from the Repurposer, and are included in your data export and deleted with your account.
Personal Brand Engine. Only your recording’s audio is uploaded (a video stays on your device, where clips are cut). It goes to your private folder and is deleted as soon as transcription starts (or, if a session never starts, by our daily clean-up once it is over 24 hours old); a copy cut at the length you paid for goes to our transcription processor (ElevenLabs Scribe, through fal.ai). Your transcript or text, your profile (setup, voice samples and style profile) and the preferences learned from your edits go to our language-model processor (OpenAI) to analyse your voice and to plan and write your pieces. Your profile, Engine Months and sessions (source text or transcript, plan, pieces, edits, approvals, reminders and numbers) stay in your account until you delete them (a session, your profile from Setup, or your account; for a deleted session we keep only the minimal charge and refund record for accounting), and they’re included in your data export. When you approve an edited piece we keep only short words and phrases you swapped or cut and counts of habits (length, emoji, hashtags, line breaks), never the drafts themselves outside your sessions, and you can switch any learned rule off. Setting a reminder creates a text item and a scheduled post in your Social Library, with the reminder emails described for the Social Library. An analytics file you import is read in your browser; only the numbers matched to your pieces are saved. Carousels and quote cards you export carry Content Credentials saying they were made with QikTools, as designed (edited) content.
Course Factory. Your browser extracts and compresses the audio of each recording and only the audio is uploaded; the video stays on your device. We delete the uploaded audio as soon as transcription starts (an upload never transcribed is removed by our daily clean-up once it is over 24 hours old). A copy cut at the length you paid for goes to our transcription processor (ElevenLabs Scribe, through Fal); transcripts, documents, web pages and notes you add go to our language-model processor (OpenAI) to plan and write the course, its assessment, audio descriptions and launch kit. Documents are read in your browser, except PDFs, which our server reads without keeping them. Your material, transcripts and results are kept in your course projects (shared with your team when you make them in your team’s workspace) until you delete them, and a record of your rights confirmation (its wording, the project, the material’s names and sizes, hashed email and IP address and your browser) is kept for evidence. Both are included in your data export and erased when you delete your account. Learners who take a course you export through your own LMS or course platform send their progress and answers to that system, not to us.
Global Launch Kit. When you ask us to read your product page, our servers fetch that one page (no other pages, and never private or local network addresses) and use its text, structured data and photos to suggest product details; we don’t keep the page itself. Photos you add are re-encoded before storage (upright, at most 2,048 px) with camera and location metadata removed. Your product facts, listings, findings and approvals are saved in your project. To recover a result if your browser closes and to avoid charging twice, each finished step’s result, and the confirmation you gave for it, is kept with your account until you delete your account. Text is processed by OpenAI (listing writing, claims review, reading your page and photos); pictures by OpenAI (lifestyle photos edited from your photo) and fal.ai (background removal, file hosting). If you switch on your Brand Vault for the kit, its details are included in those requests.
Real Estate Listing Studio. Listing photos and property details you upload are processed to provide the studio; photo metadata (including GPS) is removed when a photo is uploaded, and faces, plates or items you mark are blurred on your device before upload. AI edits are made by our AI providers. Property pages (/homes/…) are public to anyone with the link; the pictures and video on a page are copied from our AI provider to our own storage (held for us by Supabase, see Third-Party Processors) when you publish or update it, can be opened by anyone who has a file’s address while the page is online, and are deleted when you take the page offline, when the page expires (12 months after it is published or last renewed), when you delete it or when you delete your account; while an account is suspended or closed by us they are moved out of public view into private storage and kept until the suspension ends or the page or account is deleted; they’re hidden from search engines unless the agent allows indexing, and show only what the agent chose (the street address and contact details are off unless ticked). Visitors who send an enquiry give their name, email, optional phone, the message and an optional, separate opt-in to hear about other properties; we also keep a one-way hash of the IP address and run a spam check by Cloudflare Turnstile. With each enquiry we also keep a record of what the visitor agreed to: the exact words of the box they ticked to send their details to the agent, of the separate optional box and of the notice beside the form, each with its wording version, whether the optional box was ticked, and when. We add no other details about the visitor. The agent can see this record with the enquiry, in their enquiries spreadsheet and in their data download, and it is deleted together with the enquiry (after 90 days, or sooner if the agent deletes it); it is not part of our consent records. We pass the enquiry to the agent who published the page by email (from our address, reply-to the visitor) and keep it in the agent’s account for 90 days, after which it’s deleted automatically; the agent can delete it sooner. For enquiries the agent is the controller and QikTools the processor (GDPR Article 28; UK GDPR; India’s DPDP Act section 8; UAE PDPL); the lawful basis for passing it on is the visitor’s request before a contract and legitimate interests. Visitors can exercise their rights with the agent, or with us and we’ll pass the request on. Page views are counted once per visitor per hour using the hashed IP, not linked to accounts.
Film pages (Movie Director). The words, cast and credit names, pictures and video you put on a film page (/films/…) are public to anyone with the link while the page is online, and are shown to search engines only if you allow indexing. When you publish or update a page, its pictures are copied from our AI provider to our own public storage and its trailer and film to our private storage (held for us by Supabase, see Third-Party Processors); they are deleted when you take the page offline, when you delete the page or your account, or 30 days after the page’s 12 months end without a renewal, and while an account is suspended or closed by us the pictures are moved out of public view into private storage. Visitors need no account: a film page sets no cookies and loads no trackers or third-party scripts. We count page views and plays (a video starting) as totals the page’s owner can see: a view once per visitor per hour and a play once per visitor per ten minutes, using a keyed one-way hash of the visitor’s network address that is used only to apply those limits and is not stored with the counts or linked to any account. If you add a YouTube or Vimeo link, the page shows its own picture and loads nothing from that service until the visitor presses play. If a page is reported we keep the report and, if we take the page down, copies of its files for 180 days (never child sexual abuse material). The Release kit’s steps (the writer, posters, stills, trailer cuts and posts) are processed like the Movie Director’s other steps by our AI providers (see Third-Party Processors); their finished results are kept with your account until you delete it. The press kit is made on your device and is not sent to us.
Accessibility Autopilot. We store the address of each website you add, its verification code and record, your settings (languages, brand names, a line about your business), your monitoring choices with the confirmation you gave, the statement you draft, the results of each scan (page addresses, titles and languages, picture and video addresses, their existing alt text, short nearby text such as headings and captions, with e-mail addresses and phone numbers masked, and the issues found), the AI drafts and your reviews, and a change log. Your confirmations (that you may have the website checked, that you reviewed an audio-description script, your alt-text approvals and monitoring authorisations) are also kept in our consent records. We don’t collect other content or personal data from the pages. To write alt text, the picture and its short page context go to our AI processor (OpenAI) after our safety screen. To caption a video, its sound goes to our transcription processor (ElevenLabs Scribe, through fal.ai); for audio description, frames go to OpenAI and the narration is spoken by our voice processors (ElevenLabs or xAI, through fal.ai). Copies of videos we take from your website are kept privately and deleted as soon as the job that uses them ends (any left over are removed by our daily clean-up once they are over 24 hours old). Each website keeps its 15 most recent scans in full; older scans keep only their scores and counts. Removing a website deletes its scans, drafts and settings (we keep the record of credits charged and refunded). Everything is included in your data export and erased when you delete your account. Website operators can recognise our crawler by its User-Agent (QikToolsAccessibilityBot), block it in robots.txt, or contact us.
Marketplace Listing Engine. Your photos are re-encoded on upload (camera and location metadata removed) and stored on our media storage. To read your photos and label we send them to our language-model processor (OpenAI); to remove a photo’s background, to our image processor (Bria RMBG 2.0, through fal.ai); for AI pictures, to the image model shown before you run it (for example Seedream 5 Pro through Runway, or GPT Image 2.5 through OpenAI); your facts and listings go to OpenAI to write and review them. Your listing kits (facts, listings, picture links, your confirmations) stay in your account, and your team’s when you share them, until you delete them or they’re purged as unused (saved projects not revisited within 15 days on free accounts). Each paid step’s result and your rights confirmation are kept with the step’s billing record and included in your data export; they’re erased when you delete your account. Each photo-rights confirmation and each listing approval (or its withdrawal) is also kept in our consent records (the exact wording, its version, the time, a fingerprint of the approved listing, your account email, IP address and browser) as evidence of what you confirmed, for the period under “Consent and agreement records” in How long we keep it. Videos, upload packs and typed designs are made in your browser; when you export or share them, they are signed with Content Credentials on our server (uploaded to your private folder for that, then deleted). Personal data in your declarations (for example a consumer-care phone number or email address) is printed into your listings because the law asks for it, so only enter contact details you’re happy for shoppers to see.
Winning Ads Loop. Ad exports are read in your browser and only ad-level results are saved with your loop; see Winning Ads Loop: ad results and ad-account connections.
Ad scripts in other languages. When an ad script in Creator Ads, Ad Templates, the Launch Kit or Ad Loop is written in a language other than English, we send its words (spoken lines, on-screen text and post copy), and your product facts if they are not in English, to OpenAI to translate them into English, only so our claim check can read them before anything is rendered or charged. We keep the translation only in our server’s working memory, never in our database or files, and it isn’t used for anything else.
AI Video Translator. Your browser reads the video, plans cuts at natural pauses and, for a long video, re-encodes it in pieces of about a minute; a short, small clip uploads as it is. It also looks for faces on your device, to decide where lip-sync applies (for that it loads the detector from jsDelivr and Google, and only a number for each piece, the share of sampled frames with a face, is sent to us). The pieces go to your private folder. Sampled frames go through our safety checks before anything is charged, and the whole transcript is checked before any of it is translated or voiced. After your first payment we make working copies of each piece’s sound, and of its picture without sound, on our media provider’s storage (fal.ai), where anyone holding a file’s link can open it until it expires. The sound is separated into voice and background by Demucs and transcribed, with word timings and speaker labels, by ElevenLabs Scribe v2 (both through fal.ai); your glossary’s names are sent to the transcriber so they are spelled right, and our server measures the pitch of each speaker’s voice and guesses from it whether a higher or lower stock voice fits (both are kept with the transcript); no voice template is made. The transcript is translated by our language-model processor (OpenAI) together with your glossary and, if its switch is on, the brand and product names in your Brand Vault. The translated lines are spoken by xAI Text to Speech or by ElevenLabs voices (Eleven v4 Turbo for languages xAI doesn’t speak, with Turbo v2.5 as its backup, or Eleven v3 where you pick the Expressive voice in Review mode), all through fal.ai; only the text is sent. If you choose a speaker’s own voice or a Voice Vault voice, a short sample of that voice (cut from the separated voice in your video, which the media provider removes an hour later, or your vault recording, shared through a link that works for 10 minutes) goes to Chatterbox, run by fal.ai, to speak the lines in that voice (several lines go in one request); OpenAI’s transcription then checks each spoken line word for word, and a line that doesn’t match is made again. No voice is added to your Voice Vault, and using a Voice Vault voice is entered in that voice’s usage log. With the Voice Vault option “A voice like yours”, a stock voice speaks the lines instead (only the text is sent) and Chatterbox, run by fal.ai, turns that recording toward your Voice Vault voice. The terms of fal.ai and OpenAI don’t let them use your voice or your content to train their models. The new voice is mixed over the original background on our servers. Where lip-sync applies, the picture without sound and the new soundtrack go to the lip-sync model for the quality and length you chose: VEED Lipsync (VEED, through fal.ai), Creatify Lipsync (run by fal.ai on its own servers) or Sync Labs’ lipsync-2 (through fal.ai). The label and Content Credentials are added on our servers, and a long video’s pieces are joined by fal.ai’s FFmpeg compose. If you download a copy with the subtitles burned in, it is made in your browser and uploaded to your private folder only so our server can add Content Credentials; that upload is deleted straight afterwards. Your uploaded video is deleted from our storage when everything you started from it has finished, or after 24 hours if you start nothing; our daily clean-up removes anything left over once it is over 24 hours old. The transcript and translated scripts stay with the upload for about 7 days so you can add languages (or until you delete the upload); working copies stay at the media provider for 7 days and the files made on the way for 3. Each finished translation, with its subtitles, its translated text and a link to the video (which stops working when the media provider removes the file), stays in your translation history, and in your data export, until you delete it or your account. The Delete button on a translation removes its link, subtitles and text at once and keeps only the record of credits charged and refunded, for accounting; the video file is hosted by our media provider like other generated files, and we can’t always delete it there. The confirmation you give about whose face and voice it is goes to our consent records. Each provider’s stance on training is listed on the AI Models & Providers page.
Video Dubbing Autopilot. Video files you add are dubbed by the AI Video Translator, as described for that tool; connected channels and caption dubs are covered in Video Dubbing Autopilot and connected channels.
Free voice samples. Before you pay, in the AI Video Translator and Video Dubbing Autopilot, you can hear a short free sample of each Voice Vault option: one fixed sentence in your own Voice Vault voice. Only the voice’s owner can make one, and the number of samples is limited. It uses your voice exactly as a dub does (the same consent check and providers, and the sample is entered in that voice’s usage log) and starts with a spoken note that it was made with AI.
AI Explainer Video Maker. The topic, script or notes you give it, the text of any document, web page or caption track you add, and any pictures you add go to our language-model processor (OpenAI) to write the script and the scene plan; pictures you add are screened first, and a picture with a person in it is refused. OpenAI’s image model draws the scene pictures from the plan’s picture ideas, and its language model looks at each finished picture to place the labels. The narration is spoken by ElevenLabs or xAI voices (only the text is sent) and, where the voice doesn’t time its own words, timed by ElevenLabs Scribe v2, and the music is made by CassetteAI, all through fal.ai. If you choose AI motion for a scene, that scene’s own drawn picture and a short description of the movement go to Google (Veo 3.1 Lite) or Alibaba (Wan 3) through fal.ai. The video is drawn and exported in your browser; an export small enough to be signed is uploaded to your private folder only so our server can add Content Credentials, then deleted. Your project stays in your account until you delete it, and the result of each paid step is also kept on our servers for 30 days after it finishes, so a lost connection never charges you twice. When you open an explainer in the video editor, its scenes are drawn in your browser, kept briefly in your private storage, checked (three frames of each scene go through our safety checks, and a small AI model from OpenAI looks at them to make sure no real-looking person is in them) and copied to our media host so the editor can play them; the temporary copies are then deleted. Narrating in your Voice Vault voice. When an AI Explainer Video is narrated in your Voice Vault voice, each scene is first spoken by a stock voice (ElevenLabs, through fal.ai) only to time its words; no recording of your voice goes to ElevenLabs. Then either Chatterbox, run by fal.ai, speaks the scene in your voice (“Your own voice”; OpenAI’s transcription checks its words) or turns the stock recording toward your voice (“A voice like yours”). Your voice’s recording is shared with fal.ai through a link that works for 10 minutes, and the terms of fal.ai and OpenAI don’t let them use your voice or your content to train their models. Our servers time the words, keep every scene at one pitch and add the spoken AI notice, and each scene is entered in your voice’s usage log.

6.How AI providers handle your content

The providers that run each tool receive the inputs that job needs, such as your prompt, a reference picture or a recording, and return the output.
Some providers’ standard terms let them use content they receive to train or improve their models. For example, Runway’s terms (updated 15 September 2026) say inputs and outputs may be used to train its models.
Where a provider lets us switch training off, we do.
Where it doesn’t, that provider’s own terms govern how it uses your content, and we have no control over it.

Only submit what you’re comfortable with

Don’t submit anything you aren’t comfortable being processed this way, such as confidential business information or other people’s personal data you aren’t allowed to share. Tools that let you choose a model show which one will run, and every screen that uses a Runway-served model shows “Powered by Runway”, so you can choose another model where one is offered.

Each provider’s stance on training is below, as its own published terms state it. Select a provider to read its own words and its terms on the AI Models & Providers page. We only describe a provider as not training on your content when its own terms say so.

May train on content7Runway, ElevenLabs, Kuaishou (Kling AI), Black Forest Labs, Sync Labs (sync.), Creatify, Hyper3D (Deemos)Its terms let it use content it receives to train or improve its models.
No training by default10OpenAI, Google, fal, Alibaba Cloud, SpaceXAI (xAI), VEED, Stability AI, Ideogram, Recraft, Bria AIIt says it doesn’t train its models on content sent through its API by default.
Not stated4ByteDance, MiniMax, Tripo AI, CassetteAIIts published terms don’t say clearly, so we make no claim either way.

Runway also runs some other companies’ models for us (for example Seedance, Seedream and ElevenLabs’ voice tools), and makes Nano Banana pictures only as an automatic backup when Fal can’t. What we send through Runway is covered by Runway’s terms as well, whichever company made the model. A request made with “Only providers that don’t train on my content” never goes to Runway.

7.Safety, fraud prevention and automated decisions

To keep QikTools safe and lawful, we use bot protection at sign-up, a one-trial-per-person check, rate limits, automated content checks, records of refused requests and strikes, and signals that point to fraud or abuse, such as many sign-ups from one place, repeated refunds, payment disputes or unusual spending. We use your approximate country to apply sanctions and our providers’ country rules.

Free first ad. If you make the free first ad, we record that you had it (its status and dates, and how many of its free tries you used), a one-way fingerprint of your email address, and keyed fingerprints (never the IP address itself) of the network you signed up from and the one you claimed it from. We use them only to keep the offer to one per person and per connection. Network fingerprints are deleted after 1 year; the record and its email fingerprint 3 years after your account is closed. We also count, as daily totals with no personal details, how many people see, start and finish the free ad. It uses the same AI providers as the AI UGC Ad Generator (OpenAI writes the script; Runway renders the presenter; see “How AI processing works”).

Automated checks can refuse a single request, and a report of intimate imagery or child sexual abuse material automatically disables the reported file until a person reviews it (unless the report itself needs checking first, when a person decides within 2 hours). An attempt to create sexual content involving a child, or sexual or intimate imagery of a real person, pauses the account automatically until a person reviews it; several refused requests in a short time can put an account under review, and an open payment dispute can limit an account automatically until it is resolved. Every other suspension, and every closure, is decided by a person. You can ask for a human review of any automated decision by writing to the Grievance Officer.

Checking re-voiced lines. When the AI Movie Director re-voices a spoken line (“Same voice in every shot”), OpenAI transcribes the new take and the original line so we can check the words match what you wrote; the heard-back words are kept with that shot in your project so the editor can show you what was heard, and are used for nothing else.

Re-voicing a line in a Voice Vault voice. When you choose a Voice Vault voice for a character in the AI Movie Director, the shot’s separated speech and the vault recording (shared through a link that works for 10 minutes) go to Chatterbox, run by fal.ai, which turns the speech into that voice; no voice is added to your Voice Vault, and each use is entered in that voice’s usage log. Our servers then match the line’s pitch to the character’s other lines and add the spoken AI notice. A film with such a line also starts with a short spoken notice that it uses AI-generated voices; its recording ships with QikTools and is read by a stock voice, never by the cloned voice.

Safety identifiers. When we send a request to OpenAI for you — text, or a picture to read or describe — we include a pseudonymous safety identifier — a one-way, salted hash of your account ID, never your name or email — so OpenAI can act on misuse by one account instead of the whole service.

Provider refusals. When a provider’s safety system turns down one of your requests we record your account, the tool, the provider’s code and the time (never the content) to apply the pauses in our Terms (“Provider safety refusals”); these records are kept for one year as security records.

8.Client workspaces and review portals

Teams can keep several brands and set up a workspace for each client they make content for. Agencies can send their clients private review links, where the client looks at files, approves them or asks for changes, and comments, with no QikTools account needed.

Who is responsible. For the content and personal data an agency puts into its client workspaces, and for what we collect on its review pages, the agency is the controller and QikTools processes that data on the agency’s behalf under our Data Processing Agreement (the agency may itself act for its client). The review page shows the agency’s name and links to the agency’s own privacy notice where it has given one. If you reviewed work through an agency’s link, please contact that agency about your data first; we pass on to the agency any request we receive about its portal and help it answer. For people who use QikTools in a team, we remain the controller of their own account data, as the rest of this policy explains.

What a review page collects. The name you type (needed to approve, ask for changes or comment), your email address if you choose to give it, your decisions and comments with the time you made them, and how many times the link was opened. To pace requests and stop abuse we keep a keyed hash of your network address (never the address itself). If the link has a password, a cookie remembers for 12 hours that you unlocked it. Your browser remembers the name and email you typed on that device so you needn’t type them again; they reach us only with a comment or decision. We don’t use advertising or tracking cookies on review pages. Comments are checked by our automated safety systems for clear breaches of our rules, and every file is checked before it is shown, as for any shared link.

Client sign-in (optional). An agency on an Agency plan can let people at its client sign in to its review portal instead of opening each link. The agency adds the person’s email address (and, if it chooses, their name); when that person asks for a code on the portal, we email that address a six-digit code on the agency’s behalf. We store only a keyed hash of the code; it works once, for 10 minutes, and stops working after five wrong tries. When the code is right, we set an essential cookie on the portal’s own address that keeps the person signed in for up to 7 days or until they sign out; we store only a hash of that cookie’s value, with the email address, the client it is for and when it was last used. A signed-in person sees only the review links for that client, and their decisions and comments carry the email address they signed in with. We also keep when each person last signed in. To stop abuse, sign-in requests are paced by a keyed hash of the network address and of the email address (never the addresses themselves). As for the rest of its portal, the agency is the controller of these details and we process them on its behalf.

Emails. When an agency emails a review link, or when a client responds, we send the email on the agency’s behalf from “the agency’s name via QikTools”; replies go to the agency’s support address.

Client usage records. While a team member works on a client using the team’s credits, the credits used (the member, tool and time) are recorded against that client so the team can see budgets and usage reports. The team’s owner and members with reporting or brand-management rights can see them.

Custom portal domains. If an agency connects its own domain, we look up that domain’s DNS records to check the agency controls it, and our hosting provider serves the review portal on it and issues its security certificate. We store the domain name with the agency’s team.

How long we keep it. A review link that was turned off or expired is deleted, with its comments and decisions, one year later; deleting a client workspace (or the team) deletes its review links at once. The network-address hashes are deleted after 90 days, client usage records after 25 months and budget-alert records after 13 months. If a team member deletes their QikTools account, replies they wrote to a team’s clients stay on that team’s record without their name (“Former team member”), and a team they owned alone is deleted with its brand files. Sign-in codes are deleted about a day after they stop working, and a client’s sign-in when it ends (at most 7 days, or at once when they sign out, when the agency removes them, or when the client workspace or the team is deleted). The list of people who may sign in is kept until the agency removes them or deletes the client workspace or the team.

9.Winning Ads Loop: ad results and ad-account connections

What we process. When you import an ad export or connect an ad account to the Winning Ads Loop, we process the ad-level performance data you choose to provide: campaign, ad set and ad names and IDs, dates, amount spent, impressions, reach, clicks, conversions, conversion value, video plays, attribution settings and any ad text in your export, plus the product facts and the winning ad’s words you type in. Exports are read in your browser; we save this ad-level data with your loop, never the file itself. Ad-platform exports don’t contain, and we don’t import, information about the individual people who saw or clicked your ads.

Why. To show you statistical results, test plans and your loop’s history and, when you ask, to write an AI read or new hooks. Legal basis where the GDPR applies: performance of our contract with you (Article 6(1)(b)).

AI processing. For an AI round read we send a summary (ad names, the first line of each ad’s text and the computed statistics), and for new hooks the winning ad’s words; with either, the product facts you enter. They go to OpenAI, our AI processor, under our data processing agreement. Your exports and any ad-account access tokens are never sent to an AI provider.

Records of your confirmations. When you confirm your ads’ claims and rights, or connect or disconnect an ad account, we keep a record of that event (the words shown, the time, your account and the request details) in our consent records, kept as described under “Consent and agreement records” in How long we keep it.

How long we keep it. Loop data stays with your loop until you delete it or your account. Projects on free accounts that aren’t opened or changed for 15 days are deleted automatically (paid accounts are exempt). Ad-account connections are kept until you disconnect, delete your account or the platform revokes the access.

Ad-account connections (when available). With your authorisation we receive an access token from Meta (the read-only ads_read permission), TikTok (its read-only reporting permissions) or Google (the Google Ads API scope; Google offers no narrower one, so for Google the limit to reading is ours: we run only reports). Tokens are encrypted (AES-256-GCM) with a key held only in our server environment, are used only to read the ad results you ask for, and are never shared, sold or used for advertising. Meta, TikTok and Google are independent of us and not our processors: what they receive and keep is governed by their own terms and privacy policies. Disconnecting deletes the token and asks the platform to revoke it; deleting your account does the same for every connection. Your data download lists which accounts you connected (never the tokens).

Google API Services: Limited Use. QikTools’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta data deletion. You can have data we received from Meta deleted at any time by disconnecting in the tool or deleting your account; requests Meta sends us on your behalf (its data-deletion callback) delete your Meta connections automatically.

10.Video Dubbing Autopilot and connected channels

What we access. With your permission (Google sign-in, YouTube scope youtube.force-ssl), we access your channel’s name, ID, picture and uploads list, your uploads’ titles and lengths, and the caption tracks you choose to dub. We add a subtitle track only when you approve that upload. We never download your videos. Video Dubbing Autopilot uses YouTube API Services, so Google’s Privacy Policy also applies.

How we use it. Only to provide the dubbing you ask for. Caption text goes to our processors for translation (OpenAI) and voicing (xAI voices and your Voice Vault voice, through fal.ai; when your Voice Vault voice speaks the lines itself, OpenAI’s transcription also checks each spoken line word for word). It is not sold, not used for advertising or to train AI models, and not read by people except for security, abuse or legal reasons, or with your consent.

Google API Services: Limited Use. QikTools’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage. Access keys are stored encrypted. The captions we read are kept only while a dub waits for your approval (7 days at most) or while it runs. A finished dub keeps a link to its voice track in your history, and its translated subtitles and transcript (text made from the video’s YouTube captions) for up to 30 days after the dub finishes; our daily clean-up then deletes them. Titles and lengths in your history are refreshed from YouTube or deleted within 30 days.

Deleting a dub. Deleting an item in your dubbing history removes everything it made: its voice track links, subtitles and transcript, the address and file name of a video you added by link, and the AI Video Translator translations made from it. Only the record of credits charged and refunded stays, for accounting; your rights confirmations are kept separately, as consent records. The voice and video files are hosted by our media provider like other generated files, and we can’t always delete them there.

Direct links. If you paste a link to a video file (never a page of YouTube or another video or social platform), our server fetches that one file, only if the website’s robots.txt allows it (we identify ourselves as QikTools-Dubbing), checks that it is a video and prepares it in parts in your private folder as an AI Video Translator upload, as described for that tool. A Dropbox file you pick is fetched from the temporary link Dropbox gives us, and handled the same way afterwards. We keep the link’s address and the file’s name with your dubbing history until you delete that item.

Revoking access. Disconnect in the tool (we revoke access at Google and delete what we kept about the channel at once), or remove QikTools at your Google Account’s permissions page (we notice within 7 days and delete it then). Deleting your account revokes every connection.

Google Drive and Dropbox. The Google Drive picker uses the drive.file permission: only the file you pick is read, in your browser, and the permission is given back right after. With Dropbox we get a temporary link to the one file you pick and fetch it once.

Questions. Contact our Grievance Officer at the address under “Contact and Grievance Officer” below.

12.International transfers

QikTools is run from India. Our providers work mainly in the United States; some model developers reached through Fal and Runway are based elsewhere, including China and Singapore (see the processors page). Your data may therefore be processed outside the country where you live. Where the GDPR or UK GDPR applies, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK Addendum and our providers’ data processing terms. Under India’s DPDP Act, we will not transfer personal data to any country the Government of India restricts.

13.How long we keep it

We keep personal data only as long as we need it for the purposes above, or as the law requires. In detail:

Account and profile
How long
While your account is open.
Then
Deleted from our live systems when you delete your account. Backups cycle out within 30 days.
Registration details after an account is closed
How long
180 days after the account is closed.
Then
Your name, email address and the dates of sign-up and closure are kept in a restricted record, because India’s IT Rules require it, and then deleted.
Free-trial fingerprint
How long
3 years after your account is closed, then deleted.
What
A one-way fingerprint (hash) of your email address, with no name or account attached, so the free trial can’t be claimed twice.
Sign-up checks
A keyed fingerprint of the network you signed up from, and your email’s domain, for 1 year, to stop free-trial abuse.
Free first ad record
How long
3 years after your account is closed, then deleted.
What
That you had the free first ad (status, dates, how many free tries you used), with a one-way fingerprint of your email address.
Network checks
Keyed fingerprints of the network you signed up and claimed from, for 1 year, to keep the offer to one per connection.
Projects, designs and saved files
How long
Until you delete them or your account.
Free plan
Projects not edited for 15 days are deleted automatically. Paid plans, active teams and accounts with scheduled posts are exempt.
Fonts you add to a Brand Kit
How long
Until you delete the font, delete the team it belongs to, or delete your account.
Then
The font files are removed from our file storage with it; a daily check also clears any file left behind.
Generated files
How long
Hosted by our AI and media providers, which remove many files after a period (some after about 7 days).
Then
We don’t keep our own copy unless you save the file to your Library, or we copy it for you when you export it, share it or use it in a campaign (see “Files saved to your Library” below). Download anything you want to keep. Anyone with a file’s link can open it until the provider removes it, and we can’t always delete a provider’s copy on request.
Files saved to your Library
How long
Until you delete them, the Library entry they belong to, or your account.
What
Our own copy of a result in your private QikTools storage, so it doesn’t disappear when the AI provider’s copy does (about 7 days). You make one with “Save to Library”. Unless you switch it off in your Library, we also make one when you export (download) a result, share it by link, or finish a campaign with it. Files you upload to your Library are kept the same way.
Allowance
How much you can keep depends on your plan, and a team on a paid team plan shares one allowance. When it is nearly full we pause automatic copies; when it is full we stop adding. We never delete a saved file because your storage is full or your plan changes.
Then
Deleted when you remove them or delete your account, and listed, with private download links, when you download your data. If you delete a team, its own files go with it and each member’s saved files stay with them. A copy that never finished saving, and so belongs to no Library entry, is removed by our daily clean-up once it is a day old. An automatic-deletion period you set in Compliance for your own files leaves your saved copies alone; a team’s period applies to the files the team shares, their saved copies included.
Videos and recordings uploaded to the Accessibility Studio
How long
Deleted from our storage as soon as the job that uses them ends; a video sent for the free check is deleted as soon as the check ends.
Then
An upload that is never used is removed the next time you use the studio, or by our daily clean-up once it is over 24 hours old. Captions, transcripts and description scripts stay in your project until you delete it; finished files are hosted like other generated files.
Videos uploaded to the AI Video Translator
How long
Deleted from our storage when everything you started from the upload has finished, or after 24 hours if you start nothing. Anything left over is removed by our daily clean-up once it is over 24 hours old.
Then
Working copies of its sound and picture at our media provider are removed automatically after 7 days (you can add languages until then), files made on the way, such as voices and lip-synced pieces, after 3 days, and a voice sample cut to match a speaker’s voice after an hour. The transcript and translated scripts stay with the upload for about 7 days, or until you delete the upload. Each finished translation (its subtitles, translated text and a link to the video) stays in your translation history until you delete it or your account. The Delete button on a translation removes its link, subtitles and text at once and keeps only the record of credits charged and refunded, for accounting; the video file is hosted by our media provider like other generated files, and we can’t always delete it there.
Packs and sessions (AI Content Repurposer, Personal Brand Engine)
How long
Until you delete them or your account.
Then
Deleting a pack or session erases its content and keeps only the charge and refund record, for accounting. The recording you upload is deleted as soon as transcription starts; one that is never started is removed by our daily clean-up once it is over 24 hours old.
Video Dubbing Autopilot history and channel connections
How long
The captions we read are deleted when a dub ends, or after 7 days if it is still waiting for your approval. Titles and lengths of YouTube videos in your history are refreshed from YouTube or removed within 30 days, and the subtitles and transcript of a finished dub from captions (text made from the video’s YouTube captions) are deleted within 30 days after the dub finishes. A channel connection (its encrypted access keys) lasts until you disconnect it, remove QikTools in your Google account (we notice within 7 days), or delete your account.
Then
Disconnecting removes the connection and the YouTube details in your history at once, and asks Google to revoke the access. The rest of the history (what was dubbed, prices and credits) stays until you delete the item or your account, and each finished dub’s voice track link stays until then too. Deleting a history item removes everything it made, namely its voice track links, subtitles and transcript, the address and file name of a video added by link, and the AI Video Translator translations made from it, and keeps only the record of credits charged and refunded, for accounting. Your rights confirmations are kept separately (see “Consent and agreement records”). The voice and video files are hosted by our media provider like other generated files, and we can’t always delete them there.
Accessibility Autopilot websites and scans
How long
Until you remove the website or delete your account. Each website keeps its 15 most recent scans in full; older scans keep only their scores and counts.
Then
Removing a website deletes its scans, drafts and settings; we keep the record of credits charged and refunded. Copies of videos taken from a website are deleted as soon as the job that uses them ends, and any left over once they are over 24 hours old.
Winning Ads Loop data and ad-account connections
How long
The ad-level results you import or read stay in your loop until you delete it or your account; on the free plan a loop not opened or changed for 15 days is deleted automatically (paid plans, active teams and accounts with scheduled posts are exempt). An ad-account connection lasts until you disconnect it, delete your account or the ad platform revokes the access.
Then
Disconnecting deletes the stored access token and asks the platform to revoke it. Your exports are read in your browser and never kept.
Global Launch Kit and Marketplace Listing Engine step results
How long
Each paid step’s result and the confirmation you gave for it are kept with the step’s billing record until you delete your account (so a result can be recovered if your browser closes, and to avoid charging you twice for it).
Then
Your kits themselves are projects: until you delete them, or on the free plan after 15 days without being opened or changed. Photos you add are re-encoded with camera and location data removed.
Property pages and enquiries (Real Estate Listing Studio)
How long
An enquiry sent through a property page is deleted automatically 90 days after it arrives, or sooner if the agent deletes it. A page stays online for 12 months after it is published or last renewed (updates don’t extend it), then goes offline; the agent can take it offline or delete it at any time. The pictures and video on a page are copied to our own storage when the page is published or updated (our AI provider deletes its own copies after about 7 days), and removed again when the page goes offline, expires or is deleted. A suspended or closed account’s page files are kept privately, not public, until the suspension ends or the page or account is deleted.
Then
The record of the wording the visitor agreed to, and the one-way hash of their network address, are deleted with the enquiry. An offline page stays in the agent’s account, as its text and settings only, until the agent deletes it; its pictures and video are no longer stored once it is offline, and publishing it again copies them afresh from the project.
Client review links and usage records (agency workspaces)
How long
A review link that was turned off or has expired is deleted, with its comments and decisions, one year later; deleting a client workspace (or the team) deletes its review links at once. Network-address hashes: 90 days. Client usage records: 25 months. Budget-alert records: 13 months.
Files you choose to delete automatically (optional)
How long
30, 90, 180 or 365 days after a file was made — only if you (or your team’s owner or an admin, for files shared with the team) switch it on in Compliance → Data retention.
Then
Each round is announced 7 days ahead. Files in QikTools storage are deleted; results hosted by our AI provider are removed from your library and our records; the generation record (no file) stays for six years so /verify keeps working. Files you saved to your Library or put in a collection are left out of your own setting.
Face photos, voice samples and training images
Sensitive
How long
Voice samples and consent recordings: until you delete the voice or your account. Presenter photos: the single-use presenter made at our video provider is deleted as soon as the video is ready. Training images: not kept once training ends. Custom models: until you delete them or your account; models of a person also stop after their one-year consent term.
Then
Deleted, including a custom model's trained files at our AI provider. We keep at most a fingerprint of those files and the text of a spoken consent, as part of the consent evidence below.
Consent evidence
How long
6 years after the later of the last use of that face or voice and the closure of your account.
Why
It lets us show that a face or voice was used with consent if that is ever questioned. The legal basis is establishing and defending legal claims (section 17(1)(a) of India’s DPDP Act; Article 17(3)(e) GDPR).
Consent and agreement records
How long
While your account is open and for 6 years after it is closed, or longer only while a legal claim, investigation or dispute that needs them is open.
What
Each consent, confirmation and agreement you give (accepting the Terms, reminder-email choices, the withdrawal waiver and renewal terms at checkout, face and voice confirmations, rights confirmations, the automations and connections you authorise, team and agency agreements, and your data downloads), with the exact words shown, your choice, the time, the page, your IP address and browser.
Then
Your email address, IP address and browser details are deleted from these records. What remains is a tamper-evident entry of codes and fingerprints, without your contact or network details.
Why
So we can show you, a regulator or a court what was agreed and when. The law asks us to be able to prove consent (Article 7(1) GDPR; section 6(10) of India’s DPDP Act), and we keep these records to establish and defend legal claims (Article 17(3)(e) GDPR; section 17(1)(a) of the DPDP Act).
Provenance records
How long
6 years from when the file was created, including after your account is closed.
What
The generation ID, date, tool, model, a fingerprint of the file and whether it was labelled, so files can still be verified and legal claims answered.
AI text records
How long
3 years from the day the text was generated, then deleted automatically (a weekly job).
What
A one-way fingerprint of the generated text (never the text), the tool, the AI model, how AI was involved and the date — nothing that identifies you.
Removed content and reports
How long
Records of removed content — what it was, where it was, which account made it and our decision — with a copy of the content where we hold one (never child sexual abuse material, which we report instead): at least 180 days, or longer if a court or authority requires. Report case files: 6 years after the report is resolved, or 7 years after it was made if it is never resolved.
Why
India’s IT Rules require preservation for investigations, and case files help us answer legal claims.
Safety records
How long
Records of refused requests: 1 year. Strikes and restrictions: up to 3 years after the event.
Exception
A request refused as child sexual abuse material or intimate imagery of a real person is kept in full for 180 days as evidence, and may be reported to the police where the law requires.
Longer
While an appeal, investigation or legal claim is open.
Purchase and tax records
How long
Up to 8 years, as tax and accounting laws require.
Security logs
How long
Sign-up checks and refused-request records: 1 year. Server and sign-in logs: kept by our hosting and database providers for the period their plans allow.
Messages, feedback and emails
How long
Support messages, feedback and cancellation reasons: up to 3 years. The record of which emails we sent you: 90 days (2 years for the rules reminders the law requires). Our copy of each email we send you, including its text: 90 days. Emails you send to our company mailbox: up to 3 years.
Talk to Munns (live voice help) conversation records
How long
90 days after the conversation starts, then deleted automatically (sooner if you delete your account). The record holds when it started and ended, how long it lasted, what it cost us, quality numbers and which on-screen actions were used. The voice and the words of a conversation are not kept, except a request refused as child sexual abuse material (see Safety records).
Other operational records
How long
Changes we make to your account (for example a credit adjustment): 2 years. Notifications: 60 days after you read them, and 180 days at most. Rate-limit counters: about 2 days. Library activity records (when a file was approved, shared, renamed or restored): 2 years. A share link you turn off is deleted 90 days later, and one that has expired 180 days after it expired. Compliance Report records: 3 years. Records that let a paid run that didn’t finish be refunded: 90 days after they close. Developer API idempotency records (key, body fingerprint, first response): 24 hours, deleted daily. Finished background jobs: the record of a Developer API job, a Movie Director scene render or voice track, or a paid step of an AI Explainer Video is deleted 30 days after it finishes, and a cloud film render’s record after 90 days; a job whose credits were kept after an AI provider’s safety refusal stays with the account, and nothing is deleted while a report about the account is open, the account is suspended or banned, or evidence is being preserved. Cost totals are kept without your identity after your account is closed.

14.Your rights and choices

Depending on where you live, you can:

see and get a copy of your data: Settings → Profile → Your data gives you a readable report (PDF) and a machine-readable copy (a ZIP of JSON and spreadsheet files), and both include every consent you gave, with the words you saw;
correct it: edit your profile, or ask us;
delete it: Settings → Delete account removes your account and data, apart from the records listed above that we must or may keep. If content made with your account is being reviewed after a report, we finish the deletion when the review ends;
withdraw consent, for example by pausing or deleting a voice or model, and stop reminder emails with the unsubscribe link or in Settings. If the person whose voice or face a Voice Vault voice or person model copies withdraws their consent (with the private link we email them, or by writing to our Grievance Officer), the voice or model stops working and the copies we hold of what was made with it are removed: saved copies in Library storage are deleted, share links and public pages stop showing it, and its addresses are blocked across QikTools. A record that consent was given and withdrawn is kept as evidence;
object to or restrict some processing, and take your data to another service;
in India, nominate someone to exercise your rights if you die or become unable to, and have your grievances redressed by our Grievance Officer;
complain to a regulator: the Data Protection Board of India, your EU or UK data protection authority, or your US state regulator.

Email hello@qiktools.com for anything the settings don’t cover. We answer within 30 days. If a request is complex, we may extend that where the law allows (up to two further months in the EU and UK) and will tell you why. Requests under India’s DPDP Act are always answered within 90 days. We may need to confirm it’s you. We don’t charge for requests and we don’t treat you differently for making them.

California and other US states. We collect the categories of personal information listed above for the purposes listed above. We don’t sell or share personal information, we honour Global Privacy Control signals as a request not to, and we use sensitive personal information only to provide the Service you ask for.

15.Children

QikTools is only for adults aged 18 or over. We don’t knowingly collect personal data from anyone under 18, and we never use real children’s faces or voices for realistic images, video or audio. The one exception is an illustration: where a tool offers it, a parent or guardian (or someone with the guardian’s permission) can turn a child’s photo into a drawn character, confirming this each time. If we learn an account belongs to someone under 18, we close it and delete its data, apart from what the law requires us to keep. If you think a child is using QikTools, tell us at hello@qiktools.com.

16.Security and breach notification

We protect data with encryption in transit, encryption at rest by our database and storage provider, private storage, row-level access rules in our database, hashed API keys, bot protection, rate limits, least-privilege access and audit logs. People we authorise to help run QikTools (for example support or finance staff) may see account information only as their role needs; every action is recorded and access ends when no longer needed. No system is perfectly secure; read more on the Security & Trust page.

If a personal data breach affects you, we will tell you without undue delay, with what happened and what you can do. We will also notify the Data Protection Board of India (with a detailed report within 72 hours), CERT-In within 6 hours of noticing a reportable incident, and, where the GDPR applies, the relevant data protection authority within 72 hours.

Phishing. Criminals sometimes copy a company’s name to steal passwords and card numbers. Here is how to tell it’s really us:

Our official channels

www.qiktools.com is our only website. Pages, apps or messages using our name anywhere else — other than the checkout and sign-in pages we send you to from our site — aren’t ours and may be fraudulent. We’ll never ask for your password or card details by email, chat or phone.

17.Cookies and browser storage

We use essential cookies: one to keep you signed in, bot protection on sign-up, report and enquiry forms, one that remembers you entered the right password for a password-protected share link or review link, one that keeps a client signed in to an agency’s review portal, and short-lived ones that finish an ad-account or YouTube connection you start. We also set up to two preference cookies, only when you choose: one if you choose between US dollars and rupees for prices, and one if you pick a language in the language menu. Each remembers that choice for a year (when you are signed in, the choice is also saved to your account). Opening a page in another language, or a link to one, saves nothing; on a first visit we read the language your browser asks for, to show the site in it, and don’t save that either. If you are signed in and have not picked a language in that browser, we open the site in the one saved with your account, which we read from your sign-in cookie. Small preferences stay in your browser’s storage: your theme, unsent form drafts, editor view settings (including the fonts you used lately), details you chose to remember on that device (such as a reviewer’s name, an agent’s details or the sender details of a proposal) and the help assistant’s conversation for the current tab (cleared when you close it). We don’t use advertising, analytics or tracking cookies. Details are in the Cookie Policy.

18.Emails from us

We send emails you need for the Service: sign-up confirmation, security messages, receipts and renewal reminders, team invitations, reminders for scheduled posts, and the notices India’s IT Rules require at least every three months. Occasional product reminders include an unsubscribe link, and you can switch them off in Settings. For an account made in the EU, the EEA, the UK, Canada or South Korea (we go by the approximate country when you sign up) they start switched off, and we send them only if you switch them on. We keep a copy of the emails we send for our records. Our renewal, inactivity and cancellation emails are written in the language saved with your account, if you picked one in the language menu while signed in, and a team invitation in the language used by the person who sends it; other emails are in English.

19.Changes to this policy

We update this policy as QikTools changes and show the date and version at the top. For material changes we will tell you by email or in the app, and ask you to review them when you next sign in.

20.Contact and Grievance Officer

Privacy questions and requests: hello@qiktools.com. Grievance Officer: Sarthak Daruka, Proprietor & Grievance Officer. We acknowledge complaints within 24 hours and resolve them within 7 days. To report content, use the report form. More routes and deadlines are on the Grievance Officer & Contact page.

In short

1.Who is responsible for your data

2.What this policy covers

3.The personal data we collect, and why

Account and sign-in

Plans, credits and purchases

Your content

Faces and voices

Brand Vault and business details

Fonts you add to a Brand Kit

Teams and social planning

Usage and activity

Device and security data

Safety and trust records

AI text records

Messages and support

Developer API

Compliance center

Reports from anyone

Help assistant (Munns)

Talk to Munns (live voice help)

4.Faces, voices and consent

5.How AI processing works

6.How AI providers handle your content

7.Safety, fraud prevention and automated decisions

8.Client workspaces and review portals

9.Winning Ads Loop: ad results and ad-account connections

10.Video Dubbing Autopilot and connected channels

11.Who we share it with

12.International transfers

13.How long we keep it

Account and profile

Registration details after an account is closed

Free-trial fingerprint

Free first ad record

Projects, designs and saved files

Fonts you add to a Brand Kit

Generated files

Files saved to your Library

Videos and recordings uploaded to the Accessibility Studio

Videos uploaded to the AI Video Translator

Packs and sessions (AI Content Repurposer, Personal Brand Engine)

Video Dubbing Autopilot history and channel connections

Accessibility Autopilot websites and scans

Winning Ads Loop data and ad-account connections

Global Launch Kit and Marketplace Listing Engine step results

Property pages and enquiries (Real Estate Listing Studio)

Client review links and usage records (agency workspaces)

Files you choose to delete automatically (optional)

Face photos, voice samples and training images

Consent evidence

Consent and agreement records

Provenance records

AI text records

Removed content and reports

Safety records

Purchase and tax records

Security logs

Messages, feedback and emails

Talk to Munns (live voice help) conversation records

Other operational records