Privacy Policy

Account information

Your email address and, if you provide one, your name. Collected to create and secure your account and to contact you about the service. Sign-in itself is handled by Clerk.

Content you upload

Screen recordings, screenshots, images, and music files you add to a project. Collected because producing your video is impossible without them.

Prompts and briefs

What you type into the intake conversation and the editor — your product description, audience, tone, and any instructions. Used to generate creative direction and copy.

Generated content

The storyboards, compositions, narration, captions and rendered videos Cutaway produces for you, together with the intake transcript that led to them. Stored so you can return to a project.

Billing information

Your plan, subscription status, credit balance, and purchase history. Payment card details are handled by Polar and its processors; Cutaway never receives or stores them.

Usage and credit records

Which actions you took and what they cost in credits. Used to operate the credit system, show you your usage, and investigate billing disputes.

Device and network information

IP address, browser and device type, and request metadata, recorded in server logs by our hosting providers. Used to keep the service available and to investigate abuse and errors.

Diagnostics

Error reports and performance traces. Filtered before sending to remove email addresses, tokens, and asset paths. Browser-side error reporting runs only if you consent.

Analytics

Pseudonymous measurement of how the site and product are used. Loads only if you consent to analytics cookies. If you decline, no analytics are collected.

Support messages

What you write to us by email, kept so we can answer you and refer back to the conversation.

Cutaway does not collect special category data (health, biometrics, political or religious views, and similar) and asks you not to upload it. Cutaway is not intended for children under 16.

Cutaway does not train models. It has no training pipeline and does not build datasets from customer content. However, to generate your video, Cutaway sends your material to third-party AI providers, and what they do with it is governed by their terms.

OpenAI

Receives your prompts, intake conversation, project briefs, and uploaded images where a vision model is used. Under OpenAI's API terms, data submitted through the API is not used to train their models by default, and is retained for up to 30 days for abuse monitoring before deletion.

ElevenLabs

Receives the narration script text for your project. Cutaway is currently on a plan where ElevenLabs' Zero Retention Mode is not available, so your narration text is retained in ElevenLabs' request history under their privacy policy. If you would rather not have narration text leave Cutaway, do not use the voiceover feature.

Where the GDPR applies to you, Cutaway relies on the following bases. Where Rwanda's Law No. 058/2021 applies, the equivalent grounds under Articles 3 and 4 are relied on.

Performance of a contract

Creating your account, storing and processing your projects, generating videos, and billing you. Without this processing there is no service to provide.

Consent

Analytics cookies and browser-side error monitoring. Nothing in these categories loads before you opt in, and you can withdraw at any time from Cookie settings in the footer.

Legitimate interests

Server-side error logging, security monitoring, abuse prevention, and protecting the service from fraud. Balanced against your rights, and limited to what is needed for those purposes.

Legal obligation

Records we are required to keep for tax and accounting purposes.

Cutaway is a small operation built on third-party infrastructure. Running it means other companies process your data on our behalf. This is the complete list.

Beyond these processors, Cutaway discloses personal data only where legally compelled, and will tell you unless prohibited from doing so. Your content is never sold.

Cutaway is operated from Rwanda, and the processors above are located in the United States and the European Union. Using Cutaway therefore involves transferring your personal data outside Rwanda and, if you are in Europe, outside the EEA.

For transfers out of the EEA and UK, we rely on the recipients' own transfer mechanisms, which include Standard Contractual Clauses and, for some providers, certification under the EU–US Data Privacy Framework.

Depending on where you live, you have some or all of the following rights. Cutaway honours them for everyone regardless of location, because operating two standards is harder than operating one.

• Access — get a copy of the personal data held about you.
• Portability — receive that copy in a structured, machine-readable format.
• Rectification — correct information that is wrong.
• Erasure — have your account and content deleted.
• Restriction and objection — ask us to pause or stop certain processing, including processing based on legitimate interests.
• Withdraw consent — turn off analytics and browser-side monitoring at any time, without affecting anything done before you withdrew.
• Complain — raise the matter with your supervisory authority.

Two of these are built into the product and need no request: Settings → Privacy and data lets you download a complete JSON export of your account, and lets you delete your account and everything in it.

For anything else, email privacy@usecutaway.com. We aim to respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

If you are in Rwanda, you may complain to the Rwanda National Cyber Security Authority (NCSA) at https://dpo.gov.rw. If you are in the EEA or UK, you may complain to your national data protection authority.

Cutaway takes the following concrete measures. This list is deliberately specific: it describes what is implemented, not what would sound reassuring.

• All traffic runs over HTTPS.
• Authentication and session management are handled by Clerk; Cutaway never stores passwords.
• Stored files are not publicly listable, and each file URL carries a signature that must be presented to read it.
• Access to projects and files is checked against the signed-in account.
• Error reports are filtered to remove email addresses, access tokens, and asset paths before they leave your browser or our servers.
• Payment card details never reach Cutaway's systems.

Cutaway does not hold SOC 2, ISO 27001, or any comparable certification, and does not claim to. It is an early-stage product operated by one person.

If a breach affects your personal data, we will notify the supervisory authority within the timeframes required by law — 48 hours under Rwanda's Law No. 058/2021, 72 hours under the GDPR — and will tell you directly where the law requires it. To report a vulnerability, write to privacy@usecutaway.com.

Cutaway sets a small number of cookies, and loads nothing optional until you say so. The Cookie Policy lists every one of them, what it does, and how long it lasts.

If this policy changes materially, the effective date at the top changes and, where the change affects how your data is used, you will be told in the product or by email before it takes effect. Continuing to use Cutaway after that means the new version applies.

Privacy questions and requests: privacy@usecutaway.com. Anything else: hello@usecutaway.com. Postal address: [OPERATOR LEGAL NAME — SET BEFORE LAUNCH], [OPERATOR ADDRESS — SET BEFORE LAUNCH], Rwanda.