Privacy Policy

Last Updated: July 15, 2026

Cuta ("Cuta," "we," "us," or "our") provides artificial intelligence tools that help people create, edit, manage, and share images, videos, audio, and other creative content. This Privacy Policy (the "Policy") explains how we collect, use, disclose, store, and otherwise process Personal Data when you visit our website, create an account, or use our products and services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Services. This Policy should be read together with our Terms of Service.

1. Definitions

For purposes of this Policy:

Personal Data means information that identifies, relates to, describes, or could reasonably be linked to an individual or household. It may include identifiers, account information, device data, payment records, and content associated with an account.
User Content means prompts, text, images, videos, audio, reference files, generated outputs, project data, and other content that you submit to or create through the Services.
Usage Data means technical and operational information about how the Services are accessed and used, including events, logs, device information, and performance data.
Service Provider means a third party that processes data on our behalf to help us operate the Services, such as infrastructure, payment, communications, analytics, security, and AI model providers.

2. Information We Collect

The information we collect depends on how you interact with the Services.

2.1 Information you provide directly

We may collect:

Account information, such as your name, email address, profile details, password credentials in protected form, and authentication preferences.
User Content, including prompts, uploaded media, reference materials, project settings, generated outputs, and related metadata.
Transaction information, such as your selected plan, credit purchases, billing status, and payment history. Payment card details are processed by our payment provider and are not stored directly by Cuta.
Communications, including support requests, feedback, survey responses, and other messages you send to us.
Team and integration information, such as organization membership, invitations, connected accounts, and permissions you authorize for third-party services.

2.2 Information collected automatically

When you use the Services, we may automatically collect:

IP address, approximate location derived from the IP address, browser type, operating system, device type, language, and time zone.
Device or session identifiers, authentication events, referring URLs, and cookie or local-storage identifiers.
Pages and features viewed, buttons or tools used, prompts or generation events, timestamps, session duration, and navigation activity.
Diagnostic information such as request records, error logs, crash data, latency, and service performance.
Usage and metering information used to calculate credits, enforce limits, prevent abuse, and maintain the Services.

2.3 Information from third parties

We may receive information from:

Authentication providers when you choose a third-party sign-in method, such as your provider account identifier, name, email address, and profile image, subject to the permissions you approve.
Payment providers, including transaction status, subscription information, billing identifiers, and fraud signals.
Connected services and integrations that you authorize. We access only the information made available through the connection and needed to provide the requested functionality.
Analytics, security, and marketing partners, which may provide device, attribution, campaign, or fraud-prevention information in accordance with your consent choices and applicable law.

2.4 Children and sensitive information

The Services are not directed to children under 18, and we do not knowingly collect Personal Data from children. If you believe a child has provided Personal Data to us, please contact us so we can take appropriate action.

Please do not submit sensitive Personal Data that is not required to use the Services, such as government identification numbers, financial account credentials, health records, biometric identifiers, or precise geolocation. The Services are not designed to process regulated health information or other specially protected data unless we expressly state otherwise in a separate agreement.

3. How We Use Personal Data

We may use Personal Data to:

Create and manage accounts, authenticate users, and provide the features you request.
Receive, process, store, and deliver User Content and generated outputs.
Operate AI generation, editing, moderation, upload, storage, project, and asset-management workflows.
Process payments, subscriptions, refunds, credits, usage metering, and related records.
Personalize the experience, remember preferences, and maintain projects across sessions.
Monitor reliability, diagnose errors, improve performance, and develop new functionality.
Detect, investigate, and prevent fraud, abuse, unauthorized access, policy violations, and security incidents.
Provide customer support and respond to inquiries, feedback, and rights requests.
Send transactional messages, including account, security, billing, and service notices.
Send marketing communications where permitted by law and consistent with your choices.
Comply with legal obligations, enforce our agreements, resolve disputes, and protect the rights and safety of Cuta, our users, and others.
Create aggregated or de-identified information that no longer reasonably identifies an individual, and use that information for lawful business purposes.

We do not use Personal Data to make automated decisions that produce legal or similarly significant effects without providing any notice or safeguards required by applicable law.

4. Legal Bases for Processing

Where applicable law requires a legal basis, we process Personal Data based on one or more of the following:

Performance of a contract: to provide and support the Services you request.
Legitimate interests: to secure, maintain, analyze, and improve the Services, provided those interests are not overridden by your rights.
Consent: for optional cookies, marketing communications, or other processing where consent is required. You may withdraw consent at any time.
Legal obligations: to comply with laws, lawful requests, accounting requirements, sanctions, and regulatory duties.
Protection of vital interests: in limited circumstances where processing is necessary to protect a person from serious harm.

5. AI Processing and User Content

To provide AI features, Cuta may transmit your prompts, uploaded media, relevant project context, and generation settings to the AI model provider selected for a task. The provider returns generated or edited content to Cuta so that we can deliver it to your account and, where applicable, store it in your project or asset library.

Different features may use different AI providers. Their infrastructure, processing locations, and retention practices may vary. We contractually or technically limit provider access where reasonably available, but a provider may process data under its own terms when you connect your own account or API credentials.

We do not sell User Content. We do not use private, identifiable User Content to train general-purpose AI models unless we first obtain your consent or clearly disclose a different arrangement for a specific feature or plan. We may use limited Usage Data, feedback, and de-identified or aggregated information to evaluate quality, prevent abuse, and improve the Services.

You should not include Personal Data or confidential information in prompts or uploads unless it is necessary and you have the right to provide it.

6. How We Disclose Personal Data

We may disclose Personal Data in the following circumstances:

6.1 Service Providers

We use Service Providers to support functions such as:

Cloud hosting, databases, media storage, content delivery, and network services.
AI model inference, media generation, editing, and content moderation.
Payment processing, subscription management, invoicing, and fraud prevention.
Authentication, email delivery, customer support, analytics, and service monitoring.

Service Providers may access Personal Data only as necessary to perform services for us or as otherwise permitted by applicable law and their agreements with us.

6.2 Integrations you choose

When you connect Cuta to another service, we may exchange information with that service as directed by you. You can disconnect an integration through the available account controls or the third party's settings. Information already transferred to a third party is governed by that third party's privacy policy.

6.3 Legal, safety, and enforcement purposes

We may preserve or disclose information if we reasonably believe it is necessary to:

Comply with a law, regulation, court order, subpoena, or other valid legal process.
Detect, prevent, or investigate fraud, abuse, security incidents, or illegal activity.
Enforce our agreements and policies.
Protect the rights, property, safety, and integrity of Cuta, our users, or the public.

Where permitted, we will seek to limit disclosures to the information reasonably necessary and may notify affected users unless prohibited by law or doing so would create a security risk.

6.4 Business transfers

Personal Data may be disclosed as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. We will take reasonable steps to require the recipient to handle Personal Data consistently with this Policy or provide notice of material changes.

We do not sell Personal Data. We also do not share Personal Data for cross-context behavioral advertising where that activity is treated as a sale or sharing under applicable law, except as disclosed through consent controls and subject to your right to opt out.

7. International Data Transfers

Cuta and our Service Providers may process Personal Data in countries other than the country where you live. Those countries may have different data-protection laws.

Where required, we use recognized safeguards for international transfers, such as adequacy decisions, standard contractual clauses, contractual protections, or another lawful transfer mechanism. You may contact us for more information about safeguards that apply to your Personal Data.

8. Cookies and Similar Technologies

We and our partners may use cookies, pixels, browser storage, device identifiers, and similar technologies for the following purposes:

Strictly necessary: authentication, session routing, security, fraud prevention, load balancing, and saving privacy choices.
Functional: remembering language, theme, workspace, and interface preferences.
Analytics and performance: understanding feature use, diagnosing errors, measuring performance, and improving the Services. Our analytics tools may include PostHog and Google Analytics.
Advertising and attribution: measuring campaigns and understanding how users reach the Services, where permitted by law.

Where required, non-essential technologies are used only after you provide consent. You can manage cookies through available consent controls and your browser settings. Blocking some technologies may affect features or prevent the Services from remembering your preferences.

9. Information Security

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Data. These may include encryption in transit, access controls, credential protection, monitoring, backups, provider reviews, and incident-response procedures.

No system can be guaranteed to be completely secure. You are responsible for using a strong password, protecting your sign-in credentials, limiting access to your devices, and promptly notifying us if you suspect unauthorized account activity.

10. Data Retention

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain security and business records, comply with legal obligations, resolve disputes, and enforce agreements.

Retention periods vary based on the type of information, the feature used, account status, legal requirements, and technical backup cycles. For example:

Account and project information is generally retained while your account is active.
User Content is retained while needed to provide the selected feature or until you delete it, subject to backup cycles, legal holds, and technical limitations.
Transaction and billing records may be retained for tax, accounting, fraud-prevention, and legal purposes.
Security and diagnostic logs are retained for a limited period appropriate to their operational purpose.

When information is no longer required, we delete it, de-identify it, or isolate it from further use, unless continued retention is required or permitted by law.

11. Your Privacy Rights and Choices

Depending on where you live, you may have the right to:

Request access to the Personal Data we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of Personal Data, subject to legal exceptions.
Request a portable copy of certain information.
Object to or restrict certain processing.
Withdraw consent where processing is based on consent.
Opt out of certain marketing, targeted advertising, sale, or sharing activities.
Appeal a decision we make about a privacy request where applicable.
Lodge a complaint with a data-protection authority.

You may update certain account information and preferences through the Services. Marketing emails include an unsubscribe option; opting out of marketing does not stop essential account, security, or transaction messages.

To submit a privacy request, use the contact method in Section 17. We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law. We will not discriminate against you for exercising your privacy rights.

12. Regional Privacy Disclosures

12.1 European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, United Kingdom, or Switzerland, you may have rights under applicable data-protection law, including access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You may also complain to your local supervisory authority.

12.2 United States

Residents of states with comprehensive consumer privacy laws may have rights to know, access, correct, delete, or obtain a copy of Personal Data, and to opt out of certain sales, sharing, targeted advertising, or profiling. Cuta does not sell Personal Data. We will honor legally valid requests and recognized opt-out preference signals where required.

12.3 Canada and other regions

You may have rights to access or correct Personal Data, withdraw consent, and complain to a privacy regulator, subject to applicable law. We will process verified requests within the period required by law.

13. Third-Party Services and Links

The Services may link to or integrate with third-party websites, payment services, authentication providers, AI models, storage providers, and other tools. We do not control those third parties, and this Policy does not apply to information they process independently. Review their privacy policies before providing information or enabling an integration.

14. Communications

We may send service-related communications such as verification codes, account alerts, security notices, billing messages, product changes, and support responses. These messages are necessary to administer your account or provide the Services.

Where allowed, we may also send product news or promotional communications. You can opt out using the unsubscribe link in the message or available account controls.

15. Changes to This Policy

We may update this Policy to reflect changes in the Services, our data practices, or applicable law. We will post the updated Policy on this page and revise the "Last Updated" date above.

If a change materially affects your rights or how we use Personal Data, we will provide additional notice where required, such as by email or an in-product message. Your continued use of the Services after an updated Policy takes effect is subject to the updated Policy.

16. Severability

If any provision of this Policy is found to be unlawful or unenforceable, that provision will be interpreted or limited to the minimum extent necessary, and the remaining provisions will remain in effect.

17. Contact Us

If you have questions about this Policy, want to exercise a privacy right, or need to report a privacy concern, please contact us through our Support page. Please include enough information for us to understand your request, but do not send passwords, full payment card numbers, or other unnecessary sensitive information.

We aim to respond to verified privacy requests within the period required by applicable law. If you are not satisfied with our response, you may have the right to contact your local data-protection or consumer-privacy authority.

18. Entire Policy

This Policy, together with the Terms of Service and any privacy notice presented for a specific feature, describes how Cuta handles Personal Data in connection with the Services.