Privacy
Privacy at TwoLooks
Effective October 15, 2026. TwoLooks is a product of Square Post Labs Inc., Ontario, Canada.
What this site collects
Our site itself sets no cookies and includes no analytics or advertising trackers. Our fonts and images are served from our own domain. Cloudflare, which hosts and protects the site, may set a security cookie to tell people from bots.
The design partner form
When you request a seat we keep the sentence you wrote about your buyer, your work email, the time it arrived, and the country Cloudflare derives from your connection. Your network address is used to limit repeated submissions; we don't add it to your request, our email or our Slack notice.
We use your request to reply about the design partner program, and to deliver, troubleshoot and protect the form. We don't add you to a mailing list.
We send a copy to our inbox with your buyer sentence, email, country, the time it arrived and a reference number, and post a notice with your buyer sentence, email and country in our internal Slack so that someone sees it quickly. If a delivery fails, we may get a notice with the reference number and how many attempts were made. Email is retried for a while and then stopped; a Slack notice that does not go out is not retried.
Email to contact@twolooks.com
Cloudflare forwards your email, including any attachments, to our inbox, and we use it to reply to you. We also post a short notice in our internal Slack with the sender's address, the From line, the address you wrote to, the subject and the approximate size. If that notice does not go out, your message is still in the inbox. The message body and attachments are not posted to Slack.
Live chat
When live chat is open, the chat button lets you talk to a person on our team. We keep your name, your email, the page you started from (without anything after a ? or #), what you write and any images you send, and use them to answer you. We also keep our team's replies and images, reactions, the time of each message, and which version of the chat notice you saw.
Images you send are redrawn in your browser, and our server removes hidden details such as location before storing them. Anything you can see in the picture stays.
Each chat, with your name, email, messages and images, is posted to a channel in the Square Post Labs Slack, where our team replies. Everyone in that Slack workspace can read the channel. Your reactions to our replies show there too. After a chat reaches Slack, we may email ourselves its reference number and a link to it, without your name, email or anything you wrote. If the chat is still waiting for a reply 5 minutes after it reaches Slack, we try to email its text, with your name and email, to our inbox so we can answer you by email. Images are not attached; they stay in Slack.
When live chat is closed or everyone is busy, you can leave a message instead. We email your name, email, message and the page you sent it from to our inbox, and post the same details, including your whole message, in our Slack channel.
When you start a chat or leave a message, Cloudflare Turnstile checks that you are a person. Cloudflare looks at your network address and browser to do this, and we send it your network address to confirm the result. See Cloudflare's Turnstile privacy addendum.
To limit repeated chats, messages and uploads, we use a one-way code made from your network address. The counters that hold it are deleted within two days, and an open chat connection holds it only until the connection closes.
Your browser keeps a reference to your chat, its access key, whether the chat panel is open and your sound setting in storage for that tab, so the chat continues on other pages of the site. It normally clears when you close the tab, though a browser that restores tabs may restore it.
Logs
Cloudflare keeps operational logs so we can check that messages were delivered, fix errors and stop abuse. They record requests, form reference numbers, delivery status and error details; for email, the sender, recipient and subject; and for live chat, technical chat references, wait times, chat length and how images were handled. Cloudflare keeps them for up to about a month.
Who handles it for us
- Cloudflare hosts the site and the live chat, stores form requests and chats, routes our email and keeps the logs above.
- Google Workspace holds our inbox.
- Slack carries our internal notices and live chats.
These providers may process and store information outside Canada, including in the United States, where courts, law enforcement and national security authorities may be able to access it under local law. We don't sell or rent personal information, and we don't share it for advertising.
How long we keep it
Our website deletes its stored form requests automatically, no later than 365 days after they arrive, including when someone becomes a design partner. We delete emails to contact@twolooks.com, and our inbox copies and Slack notices of form requests, 12 months after the original email or form request arrived; a later retry does not start that period over. If you become a design partner, we keep the email and Slack correspondence we need to run the program while you take part.
90 days after a chat ends, we delete it and its images from our system and try to remove our Slack posts of your details, messages and images. This automatic cleanup can miss copies in Slack; write to us and we will remove them. Our team's replies and images stay in Slack and may contain your information, and your reactions on them stay there too. Our emails about a chat follow the 12 months for email. So do messages sent with "Leave a message", in both our inbox and Slack, whether live chat was closed, everyone was busy or a chat did not go through.
Your choices
The owner of Square Post Labs Inc. is responsible for privacy and can be reached at contact@twolooks.com. Write there with privacy questions or complaints, to see what we hold about you, correct it, have it deleted, withdraw your request, or ask us to stop contacting you. If you withdraw consent to use information we need to answer you, we may not be able to continue with your request. We may need to confirm it's you. We respond to requests to see your information within 30 days; if the law allows us more time, we'll tell you within those 30 days. If we can't give access to or delete something because of a legal requirement, we'll explain why.
If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.
Changes
We'll update this page before adding anything that changes how we handle personal information, such as signal delivery, and change the date at the top. If a new use needs your consent, we'll ask for it first.