Think Outside The Box Ventures, LLC ("Company," "we," "us," or "our") operates Peekaboo ("Service"). This Privacy Policy explains how we collect, use, and protect your personal data.
We comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Information We Collect
- Account Data: Name, email address, billing address, and payment details (processed via Stripe). Our database stores your email address, subscription ID, and the sign-up source described below.
- Sign-Up Source: When you create an account, we record how you arrived: the page you first landed on (its address, keeping only campaign and ad-click parameters), the referring website's domain, campaign (UTM) parameters, any advertising click identifier (for example from Google, Microsoft or Meta ads), and when those visits happened. We keep your first and most recent source. We may also ask how you heard about us on a short screen right after sign-up, and store your answer. We use this only to understand which channels bring us customers (legitimate interest), never to identify individual visitors before they sign up. It is stored in our database and with your account at our authentication provider, Clerk. See Section 2 for how it is kept in your browser before you sign up.
- Usage Data: Login and authentication data (via Clerk), which we collect whenever you sign in to an account. Only where the tools described in Section 2 are active, we also collect: session recordings of your interactions with our pages (Microsoft Clarity); analytics such as device type, browser, IP address, geolocation, and interactions with the Service (Google Analytics); your IP address sent to Apollo, which may return the company associated with it; an affiliate referral token stored in your browser by Affonso, so a partner who referred you can be credited (if that token is in your browser while you are signed in, we also send Affonso your email address, account ID and name for the same purpose); and, via the Reddit Pixel, the pages you visit and whether you sign up, start a trial or make a purchase, which Reddit uses to measure and improve our ads on Reddit. When you subscribe, our servers also send Reddit that purchase together with a hashed (one-way encoded) copy of your email address and account ID, your browser type, and Reddit's own browser and ad-click identifiers, so Reddit can match it to its ads; we never send Reddit your email address in readable form. If those tools are not active for you, none of this tool data is collected (except for a checkout page you opened, or a subscription you bought, while they were active; see Section 2); the product usage records described below are separate and are kept either way.
- Product Usage Records: While you are signed in, we record a limited set of events in our own database, linked to your account and workspace: the pages of the app you open, the onboarding steps you complete, when your account is created, clicks on trial or upgrade buttons, when you start checkout, and when you start a trial or buy a plan (the plan and amount). We use these records to provide, support and improve the Service (performance of our contract with you, and our legitimate interest in improving the Service), and we keep them whatever you choose in Section 2. These records are not sent to analytics or advertising partners and never include the content of your reports, prompts or messages. Separately, a purchase is also reported to Google and Reddit where the tools in Section 2 are active, or were active when you opened its checkout page, as described above and in Section 2.
- Third-Party Data: Information obtained from OpenAI (ChatGPT), Google Gemini, Perplexity, and SimilarWeb, as well as data submitted by customers about their websites or brands.
- Customer Input Data: Any information you choose to submit. We do not intentionally collect personal data of your end-users; if you provide such data, you are responsible for ensuring appropriate rights and consents.
2. Cookies & Tracking
We use necessary cookies to operate the Service and enable authentication. We also use five non-essential third-party tools: Google Analytics (product and traffic analytics), Microsoft Clarity (session recording, which captures your interactions with our pages), Apollo (website-visitor identification), Affonso (affiliate referral attribution), and the Reddit Pixel (measuring the results of our advertising on Reddit). To learn how Google uses data from Google Analytics, see Google's page "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites). Google Maps map previews on our public pages follow the same choice: they load only when these five tools are active for you. The location map inside our app, on a prompt's "Local tracking" tab, does not follow that choice: it loads Google Maps whenever that tab shows it. Loading either one sends your IP address and browser information to Google, which may also use its own cookies.
In the EEA, the United Kingdom, Switzerland, California, Quebec and certain other regions, these five tools load only after you accept them: by choosing "Accept all" in our cookie banner, by turning on "Analytics & improvement" under "Customize" and saving your choices, or by choosing "Allow tracking" in the control below. An acceptance you gave on an earlier version of our banner or of that control also counts. "Reject all", or saving with that option off, keeps them off. Elsewhere they run by default, and you can turn them off at any time using the control below, or by enabling Global Privacy Control in your browser. If you are signed in when you turn tracking off, using the control below or by refusing in our banner ("Reject all", or saving under "Customize" with that option off), we also stop reporting purchase and subscription events to Google from our servers for the workspaces you administer, including for subscriptions you already have. Enabling Global Privacy Control turns these tools off in your browser, even if you accepted them before, and they stay off if you later turn the signal off (see below); our servers also stop attaching these tools' identifiers to checkouts you start afterwards. Turning tracking off in any other way, signed in or not, also stops our servers attaching these tools' identifiers to checkouts you start afterwards. Turning tracking off while signed out, or with Global Privacy Control, does not change reporting to Google for a subscription you already have; to stop that, sign in and use the control below. A checkout page you opened while tracking was active stays linked: if you complete it, the purchase is reported as described in Section 1, and if it expires or a new checkout replaces it, Google is told that once. To stop reporting to Google for a subscription bought that way, use the control below after subscribing.
Global Privacy Control. If your browser sends a Global Privacy Control signal, these tools do not run, in every region, even if you previously accepted them, with "Accept all" or "Customize" in our banner, on an earlier version of it, or with "Allow tracking" in the control below; a refusal you made before, including on earlier versions of our banner ("Not now" or "Decline"), also stands. We record that in your browser as your choice to turn them off, so they stay off even if you later turn the signal off; to allow them again, turn the signal off and choose "Allow tracking" with the control below. While the signal is on, we do not show the banner or ask you to opt back in. The signal stops these tools from loading the next time you open one of our pages. It does not delete cookies they have already set, and it does not stop reporting to Google for a subscription you already have. The control below deletes those cookies and, if you are signed in when you use it, also stops that reporting for the workspaces you administer.
We also set one strictly necessary cookie, peekaboo_consent_region, so the site knows which of the two regimes above applies to you. It lasts 30 days, stores only the value "required" or "optional", and contains no identifier.
Recording your choice. We store your choice in your browser's local storage (not in a cookie) so we do not ask again on every page. Each time you make or change a choice in our banner, its "Customize" panel or the control below, we also keep a record in our own database: the option you chose, where you chose it (the banner, its "Customize" panel or the control below), whether your region requires us to ask first, whether your browser sent a Global Privacy Control signal, which version of the banner was in use, and the time. If you are signed in, the record is linked to your account and workspace; otherwise it contains no identifier. When you are not signed in, we use a hash of your IP address for up to two days to limit abuse of this recording, and we do not store it with the record. We keep these records to show that we asked for and respected your choice (compliance with legal obligations) and to measure how many visitors accept (legitimate interest).
Sign-up source. Where tracking is active for you (the first paragraph of this section), we set a first-party cookie, peekaboo_acq, on your first visit — even a direct visit with no campaign parameter or referring site — to remember the marketing source described in Section 1. It is updated only when a later page itself carries new marketing information — a campaign parameter, an advertising click id, or a link from outside aipeekaboo.com; browsing between our own pages does not. It lasts 30 days from the last such update and holds, for your first and most recent marketing visit, the landing page address (keeping only campaign and ad-click parameters), the referring website's domain, campaign parameters, any advertising click identifier, and the time of the visit. If you turn tracking off, this cookie is removed: with the control below or our banner, along with the others described above; with Global Privacy Control, the next time you open one of our pages. Where tracking is not active for you, we keep this information in memory for your current visit only, never in a cookie or any other browser storage; if you sign up during that visit, it is attached to your new account once, and not before. If you use one of our free tools while tracking is active, a second first-party cookie, peekaboo_source_free_tool, remembers only which tool you used, for 30 days, so we can tell whether it led to a subscription. Your browser's session storage also remembers which button started a free report, for that browsing session only. Neither is written while tracking is off, and the cookie is removed if you turn tracking off using the control below.
Tracking preference
Loading your current choice…
3. How We Use Data
We use personal data to:
- Provide and operate the Service.
- Generate reports and analytics.
- Process payments and manage subscriptions.
- Improve and secure the Service.
- Communicate with you.
- Comply with legal obligations.
- Send marketing communications if you have opted in (you may withdraw consent at any time).
4. Legal Basis (GDPR)
For users in the EEA/UK, we process personal data based on:
- Performance of a contract (providing the Service, including the product usage records in Section 1).
- Legitimate interests (improving and securing the Service, and understanding which channels bring us customers, using the sign-up source and "How did you hear about us?" answers in Section 1). You can object to this processing at any time (Section 8).
- Compliance with legal obligations (including keeping a record of your cookie choices).
- Consent, where required (e.g., for marketing, and for the tools in Section 2 in the regions where we ask first).
5. Third-Party Service Providers
We use trusted third-party providers to operate the Service, including:
- Stripe – Payments
- Clerk – Authentication
- KalTalk – Support chat. The chat widget loads on most pages of the site (not on shared report links, white-label dashboards or the in-app chat page) and is necessary to operate our support channel, so it is not covered by the analytics choice in Section 2. When you are signed in it receives your account ID, email address and name so a conversation can be matched to your account.
- Vercel – Hosting
- Planetscale – Database
- Microsoft Clarity – Session recording and heatmaps
- Google Analytics – Web analytics
- Apollo – Website-visitor identification
- Affonso – Affiliate referral attribution
- Reddit – Advertising conversion measurement (Reddit Pixel)
- Calendly – Demo booking. Our "Book a demo" page shows Calendly's booking calendar, which loads from Calendly when you open that page. The details you enter to book a call, such as your name and email address, go to Calendly.
- Google (favicon service) – Website icons in our app and on some public pages load from Google, which receives your IP address and browser information. This is needed to show those icons and is not covered by the choice in Section 2.
- OpenAI (ChatGPT) – AI data processing
- Google Gemini – AI data processing
- Perplexity – AI data processing
- SimilarWeb – Data enrichment
6. International Transfers
If you are located in the EEA, UK, or Switzerland, your data may be transferred to the U.S. We rely on Standard Contractual Clauses (SCCs) and implement safeguards to protect your data.
7. Data Retention
We retain personal data as long as your account is active or as needed to provide the Service, and as required by law thereafter.
8. Your Rights
- GDPR: Right to access, correct, delete, restrict, port, and object.
- CCPA/CPRA: We do not sell personal information for money. Some of the tools described in Section 2 — Google Analytics, Microsoft Clarity, Apollo and the Reddit Pixel — may nonetheless count as "sharing" under the CPRA, including for cross-context behavioral advertising in the case of the Reddit Pixel. California residents can opt out using the control in Section 2 or by enabling Global Privacy Control, which we honor as described here, and can contact us to exercise their rights to know, delete, correct, and limit. Enabling Global Privacy Control turns these tools off in your browser, even if you accepted them before, and stops our servers from attaching these tools' identifiers to checkouts you start afterwards. We record the signal in that browser as your decision to opt out, so these tools stay off there if you later turn the signal off, until you allow them again with the control in Section 2. The signal does not unlink a checkout page you opened while these tools were active, or stop reporting to Google for a subscription you already have; Section 2 explains both, and how to stop that reporting with the control there.
- Requests: 📩 team@aipeekaboo.com
- We will respond within the required timeframe (generally 30 days).
9. Lawful Disclosure
We may disclose your information if required by law, legal process, or government request.
10. Security
We implement appropriate safeguards to protect your data. No system is completely secure.
11. Breach Notification
If a data breach occurs that affects your personal data, we will notify you and relevant authorities as required by law.
12. Children's Data
The Service is not directed to individuals under 18.
13. Aggregated & Anonymized Data
We may use anonymized or aggregated data for analytics, benchmarking, and product improvement. Such data does not identify individuals.
14. Data Processing Addendum (DPA)
Enterprise customers requiring a GDPR Data Processing Addendum (DPA) may request one by contacting us at team@aipeekaboo.com.
15. Changes
We may update this Privacy Policy from time to time.
