Privacy Policy

Account information

Your email address and, if you provide one, your name. Collected to create and secure your account and to contact you about the service. Sign-in itself is handled by Clerk.

Content you upload

Screen recordings, screenshots, images and other files you add to a project. Collected because the film is made from them.

Briefs and requests

What you type into the starting brief and every change you ask the director for — your product description, audience, tone, and any instructions. Used to research, write and make your film.

Pages from the web

If you give a product URL, Cutaway visits it and related public pages to learn the product: its text, colours, fonts, logos and images. Only public pages are visited, never anything behind a login.

Generated content

What the director makes for your project: its working files and film code, preview frames, the finished films and posters, a soundtrack it composes, and its step-by-step account of the work and replies to your requests. Stored so you can return to a project and ask for changes.

Billing information

Your plan, subscription status, credit balance, and purchase history. Payment card details are handled by Polar and its processors; Cutaway never receives or stores them.

Usage and credit records

Which actions you took and what they cost in credits. Used to operate the credit system, show you your usage, and investigate billing disputes.

Device and network information

IP address, browser and device type, and request metadata, recorded in server logs by our hosting providers. Used to keep the service available and to investigate abuse and errors.

Diagnostics

Error reports and performance traces. Filtered before sending to remove email addresses, tokens, and asset paths. Browser-side error reporting runs only if you consent.

Analytics

Pseudonymous measurement of how the site and product are used. Loads only if you consent to analytics cookies. If you decline, no analytics are collected.

Support messages

What you write to us by email, kept so we can answer you and refer back to the conversation.

Cutaway does not collect special category data (health, biometrics, political or religious views, and similar) and asks you not to upload it. Cutaway is not intended for children under 16.

Cutaway does not train models. It has no training pipeline and does not build datasets from customer content. However, each film is made by an AI director running on a third-party model provider, so your material is sent to that provider, and what it does with it is governed by its terms.

Anthropic

Receives your brief and change requests, the files you upload, the content captured from the product URL you give, and frames and measurements of your film while it is being made. Cutaway uses Anthropic's commercial API. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models, and are deleted after a limited retention period unless flagged for a usage-policy review.

Where the GDPR applies to you, Cutaway relies on the following bases. Where Rwanda's Law No. 058/2021 applies, the equivalent grounds under Articles 3 and 4 are relied on.

Performance of a contract

Creating your account, storing and processing your projects, generating videos, and billing you. Without this processing there is no service to provide.

Consent

Analytics cookies and browser-side error monitoring. Nothing in these categories loads before you opt in, and you can withdraw at any time from Cookie settings in the footer.

Legitimate interests

Server-side error logging, security monitoring, abuse prevention, and protecting the service from fraud. Balanced against your rights, and limited to what is needed for those purposes.

Legal obligation

Records we are required to keep for tax and accounting purposes.

Cutaway is a small operation built on third-party infrastructure. Running it means other companies process your data on our behalf. This is the complete list.

Beyond these processors, Cutaway discloses personal data only where legally compelled, and will tell you unless prohibited from doing so. Your content is never sold.

Cutaway is operated from Rwanda, and the processors above are located in the United States and the European Union. Using Cutaway therefore involves transferring your personal data outside Rwanda and, if you are in Europe, outside the EEA.

For transfers out of the EEA and UK, we rely on the recipients' own transfer mechanisms, which include Standard Contractual Clauses and, for some providers, certification under the EU–US Data Privacy Framework.

Depending on where you live, you have some or all of the following rights. Cutaway honours them for everyone regardless of location, because operating two standards is harder than operating one.

• Access — get a copy of the personal data held about you.
• Portability — receive that copy in a structured, machine-readable format.
• Rectification — correct information that is wrong.
• Erasure — have your account and content deleted.
• Restriction and objection — ask us to pause or stop certain processing, including processing based on legitimate interests.
• Withdraw consent — turn off analytics and browser-side monitoring at any time, without affecting anything done before you withdrew.
• Complain — raise the matter with your supervisory authority.

Two of these are built into the product and need no request: Settings → Privacy and data lets you download a complete JSON export of your account, and lets you delete your account and everything in it.

For anything else, email privacy@usecutaway.com. We aim to respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

If you are in Rwanda, you may complain to the Rwanda National Cyber Security Authority (NCSA) at https://dpo.gov.rw. If you are in the EEA or UK, you may complain to your national data protection authority.

Cutaway takes the following concrete measures. This list is deliberately specific: it describes what is implemented, not what would sound reassuring.

• All traffic runs over HTTPS.
• Authentication and session management are handled by Clerk; Cutaway never stores passwords.
• Stored files are not publicly listable, and each file URL carries a signature that must be presented to read it.
• Access to projects and files is checked against the signed-in account.
• Error reports are filtered to remove email addresses, access tokens, and asset paths before they leave your browser or our servers.
• Payment card details never reach Cutaway's systems.

Cutaway does not hold SOC 2, ISO 27001, or any comparable certification, and does not claim to. It is an early-stage product operated by one person.

If a breach affects your personal data, we will notify the supervisory authority within the timeframes required by law — 48 hours under Rwanda's Law No. 058/2021, 72 hours under the GDPR — and will tell you directly where the law requires it. To report a vulnerability, write to privacy@usecutaway.com.

Cutaway sets a small number of cookies, and loads nothing optional until you say so. The Cookie Policy lists every one of them, what it does, and how long it lasts.

If this policy changes materially, the effective date at the top changes and, where the change affects how your data is used, you will be told in the product or by email before it takes effect. Continuing to use Cutaway after that means the new version applies.

Privacy questions and requests: privacy@usecutaway.com. Anything else: hello@usecutaway.com. Postal address: Kevin Tuyizere, Kigali, Rwanda.