Security
Responsible disclosure
We take the security and privacy of our users seriously — Looqa handles body photos and other personal data. If you believe you have found a vulnerability, we want to hear from you.
How to report
Email security@looqa.ai. Please include: what you found, the steps to reproduce it, the impact, and any proof-of-concept. Do not include other people's personal data in your report.
Our commitment (safe harbour)
If you make a good-faith effort to comply with this policy during your research, we will not pursue or support legal action against you, and we will work with you to understand and fix the issue quickly. We aim to acknowledge your report within 3 business days and to keep you informed of our progress.
Scope
In scope: the Looqa web application (looqa.ai and its subdomains) and the Looqa mobile apps. Out of scope: denial-of-service (DoS) attacks, physical attacks, social engineering of our staff or users, spam, and automated scanning that degrades the service for others.
What we ask
- Do not access, modify, or delete data that isn't yours — use test accounts and stop at a proof-of-concept.
- Report promptly and give us reasonable time to fix before disclosing publicly.
- Do not run attacks that could harm users, their data, or the availability of the service.
Melden (Nederlands)
Denk je een kwetsbaarheid gevonden te hebben? Mail security@looqa.ai met wat je vond, de stappen om het te reproduceren, de impact en een eventuele proof-of-concept. Neem geen persoonsgegevens van anderen op in je melding.
Onze toezegging: bij onderzoek te goeder trouw binnen dit beleid ondernemen we geen juridische stappen tegen jou en lossen we het probleem zo snel mogelijk samen met je op. We streven naar een bevestiging binnen 3 werkdagen.
Scope: de Looqa-webapp (looqa.ai + subdomeinen) en de mobiele apps. Buiten scope: DoS-aanvallen, fysieke aanvallen, social engineering, spam en geautomatiseerd scannen dat de dienst verstoort. We vragen je geen data van anderen te benaderen of te wijzigen en ons redelijke tijd te geven om te herstellen vóór publicatie.
See also /.well-known/security.txt.
This disclosure programme is operated by Looqa Technology B.V. (KvK 42110646). · Dit programma wordt beheerd door Looqa Technology B.V. (KvK 42110646).