Privacy policy

Who is responsible

Lookat AS, org. no. 935 342 767, Wirgenes vei 13, 3157 Barkåker, Norway, is the controller. Send questions about privacy to contact@lookat.no.

Visiting lookat.no

The website uses no cookies, no analytics tools and no tracking. The fonts are hosted on our own domain, so your browser fetches nothing from anyone else along the way. If you choose a light or dark theme, or another language, the choice is remembered in your browser and is not sent to us.

Visit counting is switched off. We tried our own count of visits to lookat.no on 18 October 2026, and switched it off the same day, because we want to settle the question of consent first. It stored only Lookat’s own test visits, no one else’s. If we switch counting on again, it will say so here before it is used.

If you are logged in to app.lookat.no in the same browser, the website asks the app for your user ID and how many tokens you have, and shows it at the top of the page. Nothing else is fetched, and nothing is stored on the website.

The website is hosted by Cloudflare. Like everyone who delivers websites, they see the requests that come in, including IP address and browser type, as part of operations and security. We have no statistics or analytics on top of that.

Troubleshooting: if you open the website with “?feilsok=1” in the address, the page records your touches and scrolling and sends them to us, so we can find bugs on phones we do not have. This happens only with that address, never by itself, your IP address is not stored with the log, and the receiver closes by itself after 25 October 2026.

The contact form

If you submit the form, we receive your name, your email address and the message you write. The details are sent as an email to contact@lookat.no, and are not stored anywhere else: the server that receives the form sends the email and keeps nothing. The email goes through One.com, our email provider, within the EEA.

We use the details to reply to you, and for nothing else. The enquiry stays in our mailbox until it has been dealt with; we clear it out at least once a year and delete what we no longer need.

So that the form cannot be misused for spam, we count how many submissions come from the same IP address. The count lasts ten minutes and is not linked to your enquiry.

Your account on app.lookat.no

You create an account in one of three ways, and we only get what is needed to recognise you and reach you:

• With Vipps: your name, phone number and email address, confirmed by Vipps, and a user ID that Vipps creates for Lookat. We do not ask for your national identity number, address or date of birth. The Vipps login cannot be used by people under 15.
• With Google: your name, email address and a user ID from Google.
• With email and password: the name you enter, your email address and the password. The password is never stored in plain text, only as a hash (scrypt) that cannot be reversed.

If you log in with Vipps and already have an account with the same confirmed email address, the two are joined into one account. The phone number and email address are also used when you pay: Vipps gets the number so you do not have to type it, and the receipt goes to your email address.

While you are logged in, one cookie holds your session. It is strictly necessary, is set only for app.lookat.no, and contains a random key of which we store only a hash. The session lasts twelve hours without use, and 30 days at most. Lookat’s own administrators who log in with email must also enter a code sent by email.

To prevent misuse, we count login attempts per IP address and per email address for a few minutes. The count is kept only in the server’s memory, and is not stored.

The account also holds: whether it is approved, blocked or waiting, which plan it has, the spending limits, the token usage per project, any request for a coupon with the message you wrote, the messages in the inbox, and whether you want them by email. Everything Lookat does with an account (approve, block, change limits, delete) is written to an audit log with the account’s ID, without names.

Payment: tokens and subscription groups

You buy tokens with Vipps or card, and a subscription group is paid monthly or yearly with Vipps (a recurring payment you approve in the Vipps app) or card. Payments are received by Vipps MobilePay or Stripe on behalf of Lookat:

• Vipps gets the amount, your phone number, and what the payment is for (the package, or the group’s name and level). Vipps is itself responsible for what happens in the Vipps app.
• Stripe gets the amount, your email address (for the payment page and the receipt) and the card details. The card number is entered only at Stripe, and Lookat never sees it. Stripe is itself responsible for the card details.

We store the purchase: what you bought, when, for how much including VAT, your consent to the terms and to delivery starting at once, and the reference at Vipps or Stripe. Purchases, subscriptions and payments for the groups are kept for five years because the Norwegian Bookkeeping Act requires it, also when the account is deleted. They are then left with IDs only, without names and email.

A subscription group is stored with the name you gave it, the products, the level, the projects in it, the payments and the tokens it has given. The receipt for a purchase is sent by email from Lookat when you pay with Vipps, and from Stripe when you pay by card.

Lookat Studio: property pages and living images

What you upload (pictures of the property, a sales prospectus as a PDF if you have one, address, area, price and other facts, and the estate agent’s name, phone number and email) is stored on Lookat’s server and used to make the website and the films. What is meant for the page is also in the published page.

To make the proposal, the pictures and the sales prospectus are sent to Claude at Anthropic, and to make living images, the pictures are sent to Seedance at BytePlus, which is outside the EEA. They only do the job we ask for. Lookat does not use your material to train artificial intelligence.

A published page is hosted by Cloudflare at an address under lookat.no. If the page has a contact form, the enquiries go as email to the recipient the page is set up with, and are not stored by us. Sales prospectuses may contain the names of the seller and others; whoever uploads them must have the right to use the material.

Lookat SUN: sun and shadow

The address you search for goes through the app to the address search of the Norwegian Mapping Authority (Kartverket), which sees the search text, but not who is searching. The position, the outline and heights of the project and the outdoor areas are stored in the study and used to calculate sun and shadow. Map data for about three by three kilometres around the plot is fetched from Kartverket and OpenStreetMap; they see the area, not who is asking.

Still images and films from the 3D model are rendered at RunPod, in a data centre in the EU. The worker there fetches the study (the position, the project, an IFC model if there is one, and the name) directly from the app, and the working folder disappears when the job is done. The results (report, maps, shadow sequence and 3D view) are kept on the server and can be calculated again; the published 3D view is hosted by Cloudflare, in a sandbox with no access to your login.

Lookat AR: scanning with your phone

The camera is processed on your phone. What is uploaded when you scan a place is the map: small greyscale images (288 × 512), where the phone was when they were taken, and the points found in them. Saved places and notes are kept with the project on the server.

Colour images for a 3D model are taken only when you have said yes to it at the start of the scan. They are uploaded to the project, within a limit per project, and the model is trained at RunPod in a data centre in the EU. Under “Opptak” (recordings) in the overview you can see how much space they use, and you can delete them there.

Position: if you start AR outdoors, the app asks for the phone’s position to find the sun and north. If you lock the position to an AR project, it is stored precisely, and for a home it is then an exact address. You choose whether to lock it.

To find surfaces, one small image at a time is sent to the server, which measures the depth in it. The image is read in memory and never stored. A recording of the session (video and the phone’s movements) is stored only when you yourself say yes at the start; today only Lookat’s own administrators are asked. The test logs from a session contain numbers and the phone’s model, never images.

Lookat DEsign, Lookat PResentation and Lookat ART

In Lookat DEsign, what you write and the files you add (reference images, PDFs, floor plans, point clouds and 3D files) are sent to Claude at Anthropic, which builds the scene, and to a worker at RunPod that runs Blender while the job is running. The scene, the revisions and the conversation are kept on the server. Images may show people, belongings and addresses; whoever uploads them must have the right to use them.

In Lookat PResentation, the presentation is stored: name, description, the models you upload or export from Lookat DEsign, floor plans with pipes and wiring, where things are placed, and who has been given access.

Lookat ART (not yet open to customers) stores the room’s map as greyscale images, where the artworks hang, the enquiries you send to a gallery (the message, the email, and name and phone number when you tick the box), and the art certificates (Kunstbevis). A guest in Lookat ART has no account; the IP address is counted only in memory, for at most an hour and a quarter, and the room is deleted after a day without activity.

Who processes data for Lookat

We sell no data and do not pass it on to others. Those who see anything do so to deliver the service, on our behalf:

• Cloudflare: lookat.no, the published pages, the 3D views, the backups and the tunnel into the app.
• The server provider: what the app has on disk, in Norway or the EU.
• Vipps MobilePay (Norway) and Stripe (Ireland, with transfer to the USA under Stripe’s agreement): the payment, as described above.
• One.com (EEA): the email we send you, and the enquiries from the forms.
• Anthropic (Claude): the pictures and the sales prospectus in an analysis, and the conversation and the files in Lookat DEsign.
• BytePlus (Seedance, outside the EEA): the pictures that become living images.
• RunPod (data centre in the EU): the images and films of the sun studies, the 3D models from AR scans, and the jobs of Lookat DEsign.
• Kartverket and OpenStreetMap: address search and map data for an area, without knowing who is asking.
• Google: only if you choose to log in with Google.

Lookat’s own administrators have an assistant on trial that can take speech. It is off by default; when it is on, the audio is sent to OpenAI to be turned into text. Customers do not use it.

What Lookat sees and uses

Lookat sees the accounts (name, number, email, status and usage), the purchases and the groups, the projects on the server, and the logs of what has happened. We use this to run the service: approve and help accounts, answer enquiries, fix bugs, take payment and keep the accounts. The server’s log contains no names, phone numbers or project names.

We do not use what you upload, what you write, or the enquiries we receive to train artificial intelligence, and we do not use your data for marketing.

Backups

The accounts and projects are copied every night to storage at Cloudflare, and the last seven copies are kept. Something that is deleted may therefore remain in a backup for up to a week afterwards.

How long data is kept

• The account, the projects and the groups: until the account is deleted.
• The session: twelve hours without use, 30 days at most.
• Purchases, subscriptions and payments: five years, under the Bookkeeping Act.
• The audit log: kept, without names.
• Enquiries from the contact form: never stored by us; in the mailbox until they have been dealt with.
• Counts of attempts per IP address: minutes, in memory only.

Deletion

If you want your account deleted, write to contact@lookat.no (there is a button for it under “Kontodetaljer”, the account details, on Min konto). The name, phone number, email address, password and Vipps or Google ID are then removed, the published pages are taken down, the projects, studies, designs, presentations and rooms are deleted, payment for the groups is stopped, and the session is ended. The purchases remain as accounting records, with IDs only. Unused tokens are not refunded.

Your rights

You can ask to see what we hold about you, have what is wrong corrected, have it deleted, get it in a readable format, and object to processing. Write to contact@lookat.no, and we will sort it out. If you think we process data about you wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

The legal basis: we process the account, the payment and the products to fulfil our agreement with you; the accounts because the law requires it; the counts against misuse and the troubleshooting on the basis of our legitimate interest in a secure service; and the colour images in AR, the email notifications and the contact form on the basis of your consent, which you can withdraw.

Changes

If we change anything in this policy, we update the date at the top.