Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

When you register or use our Service, we collect:

• Account Information: Email address, name, password (encrypted)
• Profile Information: Optional profile photo, bio, preferences
• Payment Information: Processed securely through Stripe (we do not store full credit card numbers)
• Communication Data: Messages you send to our support team

1.2 Content You Upload or Create

1.3 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, actions taken
• Device Information: Browser type, operating system, device type, IP address
• Cookies and Similar Technologies: See our Cookie Policy for details
• Analytics Data: Aggregated usage statistics (anonymized)

1.4 Information from Third Parties

• OAuth Providers: If you sign in with Google, Apple, or other providers, we receive basic profile information (name, email, profile photo) as permitted by that provider
• Payment Processors: Stripe shares transaction status and payment metadata

2. How We Use Your Information

We use your information for the following purposes:

2.1 Providing the Service

• Process your SVG files through our AI-powered tools
• Store and manage your generated content
• Authenticate your account and maintain security
• Process payments and manage subscriptions
• Provide customer support

2.2 Improving Our Service

• Analyze usage patterns to improve features and user experience
• Monitor and prevent technical issues
• Conduct research and development (using anonymized data only)
• Test new features and functionality

2.3 Communication

• Send transactional emails (account notifications, receipts, password resets)
• Respond to your inquiries and support requests
• Send marketing communications (you can opt out at any time)
• Notify you of important changes to our Service or policies

2.4 Legal and Security

• Comply with legal obligations and enforce our Terms of Service
• Detect, prevent, and address fraud, abuse, or security issues
• Protect the rights, property, and safety of CutMagic, our users, and the public

3. Third-Party AI Processing

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers

• Cloud Hosting: Supabase (database and file storage)
• Payment Processing: Stripe (payment transactions)
• Email Services: Email service providers for transactional and marketing emails
• Analytics: Google Analytics (anonymized data)
• AI Processing: Azure OpenAI (as described in Section 3)

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to:

• Comply with legal processes
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or abuse

4.3 Business Transfers

If CutMagic is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

5. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained until you delete your account, plus 30-day grace period
• Generated SVG Files: Retained until you delete them, or 90 days of account inactivity (free tier)
• Transaction Records: Retained for 7 years (tax and legal compliance)
• Support Communications: Retained for 3 years
• Analytics Data: Anonymized and retained indefinitely for product improvement

After the retention period, we securely delete or anonymize your data unless longer retention is required by law.

6. Your Privacy Rights

6.1 General Rights (All Users)

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data (subject to legal retention requirements)
• Export: Download your data in a portable format
• Opt-Out: Unsubscribe from marketing emails (transactional emails will continue)

6.2 GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have additional rights under GDPR:

• Right to Object: Object to processing of your data for marketing or legitimate interests
• Right to Restrict: Request restriction of processing under certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

6.3 CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Know what personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of your personal information (Note: We do not sell your information)
• Right to Non-Discrimination: Not be discriminated against for exercising your CCPA rights

6.4 How to Exercise Your Rights

To exercise any of these rights, contact us at:

We may request verification of your identity before processing your request to protect your privacy.

7. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Strict access controls and authentication for our systems
• Regular Audits: Security assessments and vulnerability testing
• Employee Training: Staff trained on data protection and security best practices
• Secure Infrastructure: Hosted on secure, SOC 2 compliant cloud platforms
• Password Protection: Passwords hashed using bcrypt with salt

8. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience. See our Cookie Policy for detailed information.

Types of Cookies We Use:

• Essential Cookies: Required for authentication and core functionality (cannot be disabled)
• Analytics Cookies: Help us understand how you use our Service (can be disabled)
• Preference Cookies: Remember your settings and preferences

You can manage cookie preferences in your browser settings or through our cookie consent banner.

9. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@cutmagic.app. We will promptly delete such information.

Users Aged 13-18: Parental or guardian consent is required. By using our Service, users in this age range represent that they have obtained such consent.

10. International Data Transfers

CutMagic operates globally. Your information may be transferred to and processed in countries other than your own, including the United States.

These countries may have data protection laws different from your country. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses: We use EU-approved Standard Contractual Clauses for transfers from the EU
• Adequacy Decisions: We rely on adequacy decisions where applicable
• Service Provider Agreements: Our service providers commit to GDPR-compliant data handling

By using our Service, you consent to the transfer of your information to countries outside your residence.

11. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals because there is no industry standard for how to interpret them. We will update this policy if we adopt DNT practices in the future.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email (for significant changes)
• Display an in-app notification banner

Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy. If you do not agree to changes, please stop using our Service and delete your account.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Note: We are an India-based company. For EU/UK users exercising GDPR rights, please contact privacy@cutmagic.app. We will respond within 30 days as required by applicable data protection laws.

14. Summary of Key Points