Privacy Policy

Who we are

Cutflare is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS, CITY, STATE, PIN CODE, INDIA] ("we", "us"). We are the controller (under GDPR) and the Data Fiduciary (under India's DPDP Act) for the personal data described here. For privacy questions write to privacy@cutflare.com.

Data we collect

Data you give us

• Account: email address, password (stored only as a secure hash), workspace names.
• Content: topics, scripts, scene notes, brand kits (names, descriptions, faces, product and logo images), captions and anything else you type or upload, plus the videos, images and text the Service generates for you.
• Connections: your MuAPI API key (stored encrypted and never shown back in full) and the ids and names of YouTube and Instagram accounts you connect through it.
• Billing: plan, purchases, invoices and payment status. Card, UPI and bank details go directly to Razorpay (see Payments).
• Support: messages you send us.

Data collected automatically

• Usage: which actions you run, credits charged, job status and timing, errors, and the inputs/outputs of AI calls kept with each charge so we can explain bills and fix problems.
• Technical: IP address, browser and device type, and server logs.

We do not collect sensitive data such as health, religion or biometric templates, and we ask you not to upload it.

How we use it and why

Under India's DPDP Act we process your data on the basis of your consent and for legitimate uses the Act allows, such as providing a service you asked for.

AI processing

• To generate ideas, scripts, images, video and captions, we send the relevant parts of your content (for example your topic, script, brand-kit text and reference images) to AI model providers. They process it to return a result to us.
• We do not use your content to train AI models, and we choose providers and settings that do not train on API data where that option exists. Each provider's own retention rules apply to the copy they process.
• We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

Who we share it with

We share personal data only with service providers (processors) that help run Cutflare, under contracts that limit their use of it to providing their service to us:

When you publish, your video and captions also go to YouTube (Google) or Instagram (Meta), whose own privacy policies then apply. We may also disclose data if the law requires it, to protect rights and safety, or to a buyer if the business is sold (we will tell you first). We do not sell your personal data and do not share it for cross-context behavioural advertising.

Payments

Payments are handled by Razorpay Software Private Limited. You enter card, UPI, net-banking or wallet details on Razorpay's secure checkout, not on our servers. We receive only what we need to run your plan: payment and subscription ids, amount, status and, from Razorpay, basic contact details. Razorpay's privacy policy applies to the data it collects. Card data is handled to PCI-DSS standards by Razorpay; we never see your full card number or CVV.

Cookies and local storage

We do not use advertising or third-party tracking cookies. The app stores a few things in your browser's local storage, which are strictly necessary or remember your choices:

• sign-in tokens, so you stay signed in;
• your active workspace;
• display preferences such as light/dark theme, colour palette and currency;
• unsaved work-in-progress in the studio, so a reload does not lose it.

Razorpay may set its own cookies on its checkout to prevent fraud. You can clear local storage in your browser settings at any time; you will be signed out. If we ever add analytics or marketing cookies, we will update this policy and ask for consent where the law requires it.

How long we keep data

• Account and content: while your account is open. You can delete projects and files at any time.
• Generated media in storage: while your account is open, or until you delete it; we may remove old, unused renders after a reasonable period and will tell you before doing so in bulk.
• Payments, invoices and the credit ledger: kept for up to 8 years after the transaction, as Indian tax and accounting laws require, even after you delete your account (in de-identified form where possible).
• Server logs: typically up to 90 days.
• Backups: overwritten on a rolling basis, normally within 30 days.

Deleting your account

You can delete your account yourself in the app under Profile. Deleting it ends any paid plan straight away, deletes your workspaces and their projects, brand kits and connections, and anonymises your user record. Payment and usage records we must keep by law are retained without your name or email. You can also ask us to delete your data by emailing privacy@cutflare.com.

Security

We use encryption in transit (HTTPS), hashed passwords, encryption of stored API keys, access controls and least privilege for our team. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authorities as the law requires (including the Data Protection Board of India and EU/UK regulators).

International transfers

We are based in India and our providers run servers in several countries, including the United States, the European Union and India. Your data may therefore be processed outside the country where you live. Where data from the EU, EEA or UK is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or other lawful safeguards offered by our providers. Transfers out of India follow the DPDP Act and any restrictions the Indian government notifies.

Your rights in the EU, EEA and UK

If you are in the EU, EEA or UK, you have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• have your data erased;
• restrict or object to processing, including processing based on legitimate interests and any direct marketing;
• data portability (receive your data in a common, machine-readable format);
• withdraw consent at any time, where processing is based on consent;
• complain to your local data protection authority (in the UK, the ICO). We would appreciate the chance to fix the issue first.

To use these rights, email privacy@cutflare.com. We answer within one month and may need to verify your identity. [OWNER: if you have users in the EU/UK, appoint an EU and UK representative under Article 27 GDPR if required and add their details here.]

Your rights in California (CCPA/CPRA)

If you are a California resident:

• Categories collected in the last 12 months: identifiers (email, IP address), commercial information (plans and purchases), internet activity (usage of the Service), and user content you upload. Sources and purposes are described above. We keep each category only as long as described in How long we keep data.
• We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the last 12 months. We do not knowingly sell or share the data of anyone under 16.
• We do not use or disclose sensitive personal information for purposes that would require a right to limit.
• You have the right to know, access, correct and delete your personal information, and to not be discriminated against for using these rights. You can use them yourself or through an authorised agent by emailing privacy@cutflare.com. We verify requests by matching them to your account email.

Residents of other US states with privacy laws (such as Virginia, Colorado, Connecticut and Texas) can use the same rights by writing to us.

Your rights in India (DPDP Act 2023)

If you are in India, under the Digital Personal Data Protection Act, 2023 you have the right to:

• get a summary of the personal data we process about you and how it is processed;
• have your data corrected, completed, updated or erased;
• withdraw consent at any time (this does not affect processing already done, and may mean we can no longer provide the Service);
• nominate another person to exercise your rights in case of death or incapacity;
• grievance redressal through our Grievance Officer (below), and then the Data Protection Board of India.

Children

The Service is not directed at children. You must be at least 16 to use it, and users under 18 need a parent or guardian's consent. We do not knowingly collect data from children under 13 (or under 16 in the EU/UK without parental consent), and we do not track or target advertising at children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this policy when our practices or providers change. We will change the "Last updated" date above and, for important changes, tell you by email or in the app before they take effect.

Contact and Grievance Officer

Privacy requests: privacy@cutflare.com
Grievance Officer (India): [GRIEVANCE OFFICER NAME], grievance@cutflare.com, [REGISTERED ADDRESS, CITY, STATE, PIN CODE, INDIA]. We acknowledge complaints within 48 hours and resolve them within 30 days.
Postal address: [LEGAL ENTITY NAME], [REGISTERED ADDRESS, CITY, STATE, PIN CODE, INDIA]

See also our Terms of Service and Contact page.