Trust, built into how QikTools works
How we protect your account, data and content, what AI providers do with what you send, the safety measures behind every run, and plainly, what we don’t have yet.
Last reviewed · Questions? hello@qiktools.com
At a glance
- Your data sold or used for adsNever
- Database isolationRow-level security on every table
- Server secrets in your browserNone: every build is scanned
- Intimate-imagery reportsDisabled at once, reviewed within 2 hours
- SOC 2 / ISO 27001Not yet, and we say so
01
Security
Encrypted in transit
Every page and API is served over HTTPS, with HSTS in production so browsers refuse plain HTTP.Encrypted at rest
Our database and file storage host, Supabase, encrypts the data it stores for us at rest with AES-256. Generated files hosted by our AI providers are stored on their infrastructure under their terms.Row-level security on every table
Each request can read or change only the signed-in person’s own data, or data explicitly shared with their team. Uploads you keep are in private storage that only you, and your team when you share, can open. To run a job, the file is sent to the AI provider, which may hold a temporary copy at an unguessable address.Secrets stay on the server
Provider keys never reach your browser. Every production build is scanned automatically and fails if a server secret shows up in browser files.Least-privilege access
The all-access database key never leaves our servers and is used only for specific server tasks. Database functions are locked to what each role needs, and the admin console is limited to named administrators, with every action logged.Rate limits
On sign-in, sign-up, password resets, every paid tool and costly free features, so accounts can’t be brute-forced and the service can’t be abused.Automated abuse detection
Daily checks for fraud signals, such as many sign-ups from one network, refund loops, payment disputes or unusual spending, with alerts for review.A hardened web platform
Security headers on every page, refusal of cross-site requests that change data, strict input limits, and a guarded fetch that refuses private network addresses for any link you give us.No card data with us
Dodo Payments, our merchant of record, handles US dollar payments, and Razorpay processes rupee payments for us. We never see card numbers, and payment notifications are verified with signatures before any credits are added.Responsible disclosure
Found a vulnerability? We reply within 72 hours and support good-faith research. How to report
More detail, including how we handle incidents, is on the Security & Trust page.
02
Privacy & data
What we collect
Account and sign-in details, plans and purchases, the content you create, faces and voices you use with consent, your Brand Vault, team and social-planning details, what clients tell you through review links and property pages you publish, the YouTube channels and ad accounts you choose to connect (only what that access covers), usage, security and safety records, and support messages. We don’t use advertising trackers and we never sell personal data.
Your controls
- Download my data in Settings → Profile gives you a machine-readable copy.
- Delete account in Settings removes your account and data, apart from the records in our retention schedule that we must or may keep, and generated files on our AI providers’ networks, which they remove on their own schedules.
- Pause or delete a saved voice or custom model at any time to withdraw consent.
- Switch reminder emails off in Settings or with one click in any of them.
How long we keep things
- Account and profile
- While your account is open.
- Registration details after an account is closed
- 180 days after the account is closed.
- Free-trial fingerprint
- 3 years after your account is closed, then deleted.
- Free first ad record
- 3 years after your account is closed, then deleted.
- Projects, designs and saved files
- Until you delete them or your account.
- Fonts you add to a Brand Kit
- Until you delete the font, delete the team it belongs to, or delete your account.
- Generated files
- Hosted by our AI and media providers, which remove many files after a period (some after about 7 days).
- Files saved to your Library
- Until you delete them, the Library entry they belong to, or your account.
- Videos and recordings uploaded to the Accessibility Studio
- Deleted from our storage as soon as the job that uses them ends; a video sent for the free check is deleted as soon as the check ends.
- Videos uploaded to the AI Video Translator
- Deleted from our storage when everything you started from the upload has finished, or after 24 hours if you start nothing. Anything left over is removed by our daily clean-up once it is over 24 hours old.
- Packs and sessions (AI Content Repurposer, Personal Brand Engine)
- Until you delete them or your account.
- Video Dubbing Autopilot history and channel connections
- The captions we read are deleted when a dub ends, or after 7 days if it is still waiting for your approval. Titles and lengths of YouTube videos in your history are refreshed from YouTube or removed within 30 days, and the subtitles and transcript of a finished dub from captions (text made from the video’s YouTube captions) are deleted within 30 days after the dub finishes. A channel connection (its encrypted access keys) lasts until you disconnect it, remove QikTools in your Google account (we notice within 7 days), or delete your account.
- Accessibility Autopilot websites and scans
- Until you remove the website or delete your account. Each website keeps its 15 most recent scans in full; older scans keep only their scores and counts.
- Winning Ads Loop data and ad-account connections
- The ad-level results you import or read stay in your loop until you delete it or your account; on the free plan a loop not opened or changed for 15 days is deleted automatically (paid plans, active teams and accounts with scheduled posts are exempt). An ad-account connection lasts until you disconnect it, delete your account or the ad platform revokes the access.
- Global Launch Kit and Marketplace Listing Engine step results
- Each paid step’s result and the confirmation you gave for it are kept with the step’s billing record until you delete your account (so a result can be recovered if your browser closes, and to avoid charging you twice for it).
- Property pages and enquiries (Real Estate Listing Studio)
- An enquiry sent through a property page is deleted automatically 90 days after it arrives, or sooner if the agent deletes it. A page stays online for 12 months after it is published or last renewed (updates don’t extend it), then goes offline; the agent can take it offline or delete it at any time. The pictures and video on a page are copied to our own storage when the page is published or updated (our AI provider deletes its own copies after about 7 days), and removed again when the page goes offline, expires or is deleted. A suspended or closed account’s page files are kept privately, not public, until the suspension ends or the page or account is deleted.
- Client review links and usage records (agency workspaces)
- A review link that was turned off or has expired is deleted, with its comments and decisions, one year later; deleting a client workspace (or the team) deletes its review links at once. Network-address hashes: 90 days. Client usage records: 25 months. Budget-alert records: 13 months.
- Files you choose to delete automatically (optional)
- 30, 90, 180 or 365 days after a file was made — only if you (or your team’s owner or an admin, for files shared with the team) switch it on in Compliance → Data retention.
- Face photos, voice samples and training images
- Voice samples and consent recordings: until you delete the voice or your account. Presenter photos: the single-use presenter made at our video provider is deleted as soon as the video is ready. Training images: not kept once training ends. Custom models: until you delete them or your account; models of a person also stop after their one-year consent term.
- Consent evidence
- 6 years after the later of the last use of that face or voice and the closure of your account.
- Consent and agreement records
- While your account is open and for 6 years after it is closed, or longer only while a legal claim, investigation or dispute that needs them is open.
- Provenance records
- 6 years from when the file was created, including after your account is closed.
- AI text records
- 3 years from the day the text was generated, then deleted automatically (a weekly job).
- Removed content and reports
- Records of removed content — what it was, where it was, which account made it and our decision — with a copy of the content where we hold one (never child sexual abuse material, which we report instead): at least 180 days, or longer if a court or authority requires. Report case files: 6 years after the report is resolved, or 7 years after it was made if it is never resolved.
- Safety records
- Records of refused requests: 1 year. Strikes and restrictions: up to 3 years after the event.
- Purchase and tax records
- Up to 8 years, as tax and accounting laws require.
- Security logs
- Sign-up checks and refused-request records: 1 year. Server and sign-in logs: kept by our hosting and database providers for the period their plans allow.
- Messages, feedback and emails
- Support messages, feedback and cancellation reasons: up to 3 years. The record of which emails we sent you: 90 days (2 years for the rules reminders the law requires). Our copy of each email we send you, including its text: 90 days. Emails you send to our company mailbox: up to 3 years.
- Talk to Munns (live voice help) conversation records
- 90 days after the conversation starts, then deleted automatically (sooner if you delete your account). The record holds when it started and ended, how long it lasted, what it cost us, quality numbers and which on-screen actions were used. The voice and the words of a conversation are not kept, except a request refused as child sexual abuse material (see Safety records).
- Other operational records
- Changes we make to your account (for example a credit adjustment): 2 years. Notifications: 60 days after you read them, and 180 days at most. Rate-limit counters: about 2 days. Library activity records (when a file was approved, shared, renamed or restored): 2 years. A share link you turn off is deleted 90 days later, and one that has expired 180 days after it expired. Compliance Report records: 3 years. Records that let a paid run that didn’t finish be refunded: 90 days after they close. Developer API idempotency records (key, body fingerprint, first response): 24 hours, deleted daily. Finished background jobs: the record of a Developer API job, a Movie Director scene render or voice track, or a paid step of an AI Explainer Video is deleted 30 days after it finishes, and a cloud film render’s record after 90 days; a job whose credits were kept after an AI provider’s safety refusal stays with the account, and nothing is deleted while a report about the account is open, the account is suspended or banned, or evidence is being preserved. Cost totals are kept without your identity after your account is closed.
Periods for data we hold are enforced by scheduled jobs where a deletion is due; files hosted by our AI providers follow their schedules. The full retention schedule
Consent records
Each time you confirm that a face or voice is yours or used with written consent, we record who confirmed what and when, and which version of the wording, as evidence. A voice saved for reuse needs a spoken consent from its owner. We never build face or voice recognition templates. Consent evidence is kept for 6 years after the later of the last use and the closure of the account.
Where data is processed
QikTools is run from India. Our database and storage run on Supabase, our website on a web host we name before launch. Our providers work mainly in the United States; some model developers reached through Fal and Runway are based elsewhere, including China and Singapore (see the processors page). Transfers out of Europe use the EU Standard Contractual Clauses.
Your rights
Under India’s DPDP Act and the GDPR you can access, correct and delete your data, withdraw consent, object to or restrict some processing, take your data elsewhere and, in India, nominate someone to act for you. We answer within 30 days, and never later than 90 days under India’s DPDP Rules. You can complain to the Data Protection Board of India or your data protection authority. How to use your rights
Data Processing Agreement
GDPR Article 28 processor terms with annexes (details of processing, security measures, sub-processors), the EU Standard Contractual Clauses with the UK Addendum, and an India DPDP addendum. Incorporated into our Terms for business customers; download it for your records. Version 2026-10-10.
03
AI transparency
The models and who makes them
Every model available in QikTools, its developer and how we reach it is listed publicly. Every tool shows its price before you run it. Tools that let you choose a model show which one will run, and every screen that uses a Runway-served model shows “Powered by Runway”.
How providers handle your content
The provider that runs a job receives what that job needs. Some providers’ terms let them use content to train their models (Runway’s say inputs and outputs may be used to train its models). Where a provider lets us switch training off, we do; where it doesn’t, its terms apply and we have no control over that use.
May train on content× 7No training by default× 10Not stated× 4
Labels, Content Credentials and verification
- Realistic images and videos carry a visible “AI-generated” label. Audio in a cloned voice, and AI speech delivered as audio (for example from AI Voice Studio), starts with a short spoken disclosure; videos with AI speech carry the visible label.
- Files we generate carry IPTC metadata marking them as AI-made, a unique generation ID and, where the format allows, a signed C2PA Content Credential that names QikTools and the model, never you, timestamped whenever our timestamp service answers in time. Files exported from our editors are signed too when signing succeeds; if it can’t, you still get the file with its visible label.
- Most pictures we generate also carry an invisible watermark (Adobe TrustMark), so a screenshot or re-saved copy can often still be traced to its record. Very small, transparent, animated or very wide pictures don’t get one.
- Files we generate also get a provenance record with a fingerprint, so they can still be checked after their metadata is stripped.
- AI-written text is marked and checkable: machine-readable marks in copies and downloads, signed where we recognise the text, and a free Check text tool on /verify.
- Documents and ZIP packs our tools make from AI-generated material are marked too: PDF, Word, PowerPoint and Excel files carry a digitally signed AI mark in their metadata or properties, and a ZIP pack carries a signed list of its files with each file’s fingerprint and whether AI made it. Your browser sends us only a fingerprint to sign, never the file, and the check on /verify shows whether a file or pack has changed since.
- Anyone can check a file for free, with independent verification on /verify, and platforms and researchers can use its free detection API (in line with the EU Code of Practice on marking and labelling AI content). It never shows who made a file.
Our Content Credentials are signed by QikTools, but our signing certificate isn’t on the C2PA trust list yet, so some checkers show the signature as valid but from an unknown signer. How labelling works
EU AI Act, Article 50
From 2 August 2026, providers of AI that generates images, video, audio or text must mark the results in a machine-readable way so they can be detected as AI-generated, and people must be told when they talk to an AI. Anyone who publishes a deepfake must disclose it. We mark what we generate as described above, and our help assistant, Munns, is an AI. When you publish realistic AI content, disclosing it is your part.
India’s IT Rules, as amended in 2026
Since 20 February 2026, services that let people create synthetic content must label it prominently, embed permanent metadata with a unique identifier, stop users removing labels, and act on takedowns within 3 hours for court or government orders and 2 hours for non-consensual intimate imagery. That is how we label and mark files, forbid label removal, and run takedowns.
04
Safety measures
Screened before generating
The text and images in every request that reaches a generative model, and frames and the opening speech of uploaded video and audio, are checked by our own rules, a list of public figures and an automated moderation model before any credits are taken. The AI Video Translator checks a video’s frames before you pay and its whole transcript before any of it is translated or voiced, and refunds a language it stops. Tools that only read your own files aren’t screened.Public figures blocked
Requests that name a listed public figure are refused before they run. We don’t depict, voice or impersonate real public figures, even as parody.Consent for real faces and voices
You confirm each time that a face or voice is yours or used with written consent, and the confirmation is kept as evidence. Saved voices need a spoken consent from their owner. A real child’s face or voice is never used in realistic content; a parent or guardian may turn a child’s photo into an illustration.Takedowns on a clock
Reported intimate imagery is disabled as soon as the report arrives (within 2 hours if a report needs checking first) and reviewed within 2 hours. Court and government orders are acted on within 3 hours, other unlawful content within 36 hours.Child sexual abuse material
Never allowed: such requests are stopped before they reach any model that generates content. An attempt pauses the account until a person reviews it, we report it to the authorities where the law requires, and accounts used for it are closed.Repeat offenders
Three strikes within 12 months close an account. Child sexual abuse material, intimate imagery of a real person, fraud and impersonation close it at once, and people we close out may not return.Provider safety filters too
Our providers’ own safety systems check requests as well. If one refuses a request that passed our checks and charges us for it, the credits shown are charged; otherwise refused runs are refunded. The ruleLabels that stay on
Realistic images and videos carry a visible “AI-generated” label, and removing a label or Content Credential breaks our Terms.
05
Accessibility
Our accessibility statement
The standard we aim for, what we have done, the limitations we know about and how to tell us about a barrier are in our accessibility statement. Found a problem? Write to hello@qiktools.com.
06
Compliance status, honestly
What we have
- Published Terms, Privacy Policy, AI & Acceptable Use Policy, Cookie Policy and a Data Processing Agreement with the EU Standard Contractual Clauses, the UK Addendum and an India DPDP addendum.
- A public list of every processor, with a free feed of changes.
- A Grievance Officer with published deadlines, as India’s IT Rules and Consumer Protection (E-Commerce) Rules require, and a single point of contact under the EU Digital Services Act.
- Takedowns on India’s IT Rules deadlines, with statements of reasons and appeals.
- AI labels, embedded metadata and C2PA Content Credentials on generated files, with free verification.
- Consent records for real faces and voices.
- Row-level security on every table, build-time secret scanning, rate limits and audit logs.
- A database host, Supabase, that reports SOC 2 Type 2 compliance.
Not yet
- SOC 2 or ISO 27001 certification.
- An independent penetration test.
- Multi-factor authentication for email-and-password accounts. Teams using single sign-on get their identity provider’s.
- A representative in the EU or the UK under Article 27 GDPR.
- A legal representative in the EU under Article 13 of the Digital Services Act.
- A signing certificate on the C2PA trust list for our Content Credentials.
- An uptime commitment (SLA).
07
Security questionnaire
- Who provides the service?
- Who is responsible for security and privacy?
- Do you have written security and privacy policies?
- and 42 more
08
Processor updates
List last changed
Payments in Indian rupees through Razorpay
Purchases priced in Indian rupees are now sold by QikTools itself and paid through Razorpay (Razorpay Software Private Limited, Bengaluru, India), a payment gateway: it receives the buyer’s name, email address, payment method (card, UPI and bank details go to Razorpay, never to us), the amount and what was bought, and device signals for its fraud checks. Plans that renew in rupees use UPI AutoPay or a card or bank mandate held by Razorpay and the buyer’s bank. Purchases in US dollars are unchanged: Dodo Payments sells them as merchant of record.
09
Responsible disclosure
How to report
Email hello@qiktools.com with “Security report” in the subject and enough detail to reproduce the issue. We reply within 72 hours and keep you updated until it’s fixed.
Our contact is also published in security.txt.
Safe harbour
We won’t take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, doesn’t access other people’s data beyond what’s needed to show the issue, and gives us reasonable time to fix it before disclosure.
If an incident affects personal data, we tell the people affected without undue delay (business customers within 48 hours), report to CERT-In within 6 hours, and send the Data Protection Board of India a detailed report within 72 hours.
10
Official channels
Our official channels
www.qiktools.com is our only website. Pages, apps or messages using our name anywhere else — other than the checkout and sign-in pages we send you to from our site — aren’t ours and may be fraudulent. We’ll never ask for your password or card details by email, chat or phone.
Paying
You use the secure checkout of our payment partners: Razorpay’s payment window on www.qiktools.com for rupees, or Dodo Payments’s checkout (Stripe for some team plans) for US dollars. It’s the only place you ever enter card, UPI or bank details.
Signing in
Check the address bar shows www.qiktools.com. If you choose Google, Microsoft or your company’s single sign-on, you sign in on that provider’s own page.
Spotted a fake?
Don’t enter any details. Tell us at hello@qiktools.com or with the report form.
Trust & security questions
The QikTools Trust Center explains how QikTools protects accounts, data and content, how AI providers handle what you send, the safety measures behind every run, and which certifications we have and don't have yet.
- Is QikTools SOC 2 or ISO 27001 certified?
Not yet. We don't currently hold SOC 2 or ISO 27001 certification, and we haven't had an independent penetration test. Our database host, Supabase, reports SOC 2 Type 2 compliance. What we have, and what we don't have yet, is under Compliance status.
- Where is QikTools data stored and processed?
QikTools is run from India. Our database and storage run on Supabase. Our providers work mainly in the United States, and transfers out of Europe use the EU Standard Contractual Clauses. Every processor, what it receives and where it is, is listed on Third-Party Processors & Data Sharing.
- Does QikTools support multi-factor authentication?
Not yet for email-and-password accounts. Teams that sign in with single sign-on get their identity provider's multi-factor authentication.
- How do I report a security vulnerability?
Email hello@qiktools.com with "Security report" in the subject and enough detail to reproduce the issue. We reply within 72 hours, keep you updated until it's fixed, and won't take legal action against good-faith research (Responsible disclosure).
- What happens if there is a data breach?
We tell the people affected without undue delay (business customers within 48 hours), report to CERT-In within 6 hours, and send the Data Protection Board of India a detailed report within 72 hours.
QikTools is a trade name of Sarthak Daruka, an individual carrying on business in India as a sole proprietor. This page describes what is true today and is reviewed whenever our service changes.
All legal documents