Privacy policy
How we handle your data
Effective: 10 May 2026
Summary
- We collect the minimum needed to run the service: account info, the prompts and assets you submit, the videos we generate for you, and basic technical/operational logs.
- We send your prompts and scripts to third-party AI providers (OpenRouter, ElevenLabs or PlayHT, OpenAI, optionally Google Veo) so they can run the pipeline. Your prompts leave our servers when this happens.
- Generated videos and uploaded assets are deleted automatically after roughly 24 hours.
- We do not run third-party analytics, ad-tracking, or behavioural profiling on this site.
- Payments are processed by Dodo Payments. We never see or store your card number.
- You can request access, export, or deletion of your data at any time by writing to parbhat@parbhat.work.
What we collect
Account information
If you sign up, we collect your email address, a hashed password (we never store the raw password), and an optional display name. If you sign in with Google, we receive your Google account email, profile name, and the OAuth identifier Google sends us. We do not request additional Google permissions.
Anonymous session data
If you use Cutline without signing in, we set a first-party cookie containing an anonymous session identifier and we store the count of videos you have generated in that session. We do this so you can try the product before signing up. There is no advertising profile or cross-site tracking.
Inputs you give us
The prompt sentence you type, any optional duration / mode / model selections, and any files you upload (logos, product photos, reference images). These are required to generate your video.
Generated outputs
Intermediate artifacts produced by the pipeline (intent JSON, narrative, shot list, script, subtitle track, voice audio, sourced or generated images) and the final MP4. These are kept for the retention window described below.
Operational logs
Job identifiers, status (pending / processing / completed / failed), per-stage timings, error messages, your IP address (used for rate limiting and abuse prevention), browser user-agent. We do not log the contents of your prompts in our application logs.
Billing data
If you subscribe to a paid plan, our payment processor (Dodo Payments) handles your card data directly. They send us the plan you purchased, the status of your subscription, and a customer reference identifier. We do not see, store, or process your card number, CVV, or banking credentials.
How we use it
We use the data described above only for the following purposes:
- To run the video generation pipeline you requested.
- To authenticate you, maintain your session, and let you access your dashboard and past videos.
- To enforce rate limits, detect abuse (for example, repeated requests from the same IP), and keep the service stable.
- To process payments, manage subscriptions, and send transactional account emails (sign-in confirmations, payment receipts, important service notices).
- To investigate and fix bugs, by inspecting job metadata and error logs.
- To comply with our legal obligations and respond to lawful requests.
We do not sell your data. We do not share it with advertisers. We do not use your prompts or generated videos to train our own models.
Third parties we share with
To deliver the service we have to send some data to the following sub-processors. They each have their own privacy policies, which we recommend you read.
OpenRouter
What we send: The text of your prompt, intent, narrative, shot list, script, and any image-search queries we derive from them.
Why: Routes our LLM requests to the model you (or we) selected. Used in every text generation stage.
ElevenLabs or PlayHT
What we send: The script text we generate from your prompt.
Why: Converts the script into voiceover audio. You configure which provider via the TTS_PROVIDER setting.
OpenAI
What we send: Image prompts derived from your shot list. We never send your full prompt or account email.
Why: Generates fallback images via DALL·E 3 when no stock photo matches.
Unsplash and Pexels
What we send: Image search queries derived from your shot list.
Why: Returns stock photos used as the visual layer of each shot. Standard image-search API requests.
Google (Gemini / Veo)
What we send: Used only if you select "Talking object" mode. The script text is sent to Google Veo to generate the talking character clip.
Why: Generates AI character video. Optional and only triggered when you explicitly choose this mode.
Better Auth + Google OAuth
What we send: If you sign in with Google: your Google email, name, and OAuth identifier.
Why: Authenticates you and creates your account record.
Dodo Payments
What we send: Your email address and the plan you are purchasing. Card data goes directly to them, not to us.
Why: Processes subscriptions and one-time payments. PCI-DSS compliant; we are not in scope for cardholder data.
Neon (Postgres)
What we send: Account records, job metadata, anonymous-session records, subscription state.
Why: Database hosting.
Redis
What we send: Job queue entries, cancellation flags, rate-limit counters.
Why: Queue and ephemeral state. May be hosted by a managed Redis provider.
Object storage (optional)
What we send: Uploaded assets and generated videos.
Why: Either local disk on our server or S3-compatible object storage. Files are deleted on the retention schedule below.
AI processing notice
Cutline is an AI-driven video tool. Several things follow from that:
- Your prompts and any uploaded assets are processed by third-party AI providers (listed above) outside our infrastructure. Each of those providers may temporarily process your input on their own servers.
- Generated content (script, voiceover, images, video) is statistical output. It may be inaccurate, biased, or factually wrong. You are responsible for reviewing it before publishing or relying on it.
- Do not put confidential, personal-health, or other sensitive information in prompts or uploads. Anything you submit will leave our servers as part of the pipeline described above.
- We do not use your prompts, uploads, or generated videos to train our own models. Whether the third-party providers do is governed by their own policies; check their terms before submitting sensitive material.
Data retention
- Generated MP4 videos: deleted automatically approximately 24 hours after they are produced. Download yours within the window.
- Uploaded assets (logos, product photos): deleted approximately 24 hours after upload.
- Per-job temp files: deleted as soon as the job finishes, regardless of success or failure.
- Job records (status, timing, error metadata): kept while your account is active so you can see history; deleted with your account.
- Account data: kept until you delete your account or close it. After deletion we retain only what is required for legal, tax, fraud-prevention, or accounting purposes.
- Anonymous-session records: kept for the lifetime of the cookie. Clearing your browser or cookies effectively deletes them.
- Logs: kept up to 90 days for operational and security purposes.
Your rights
Depending on where you live, you may have rights under laws such as GDPR (EU/UK), CCPA/CPRA (California), or similar regimes. These commonly include:
- The right to know what personal data we hold about you and to receive a copy.
- The right to correct inaccurate data.
- The right to delete your account and personal data, subject to limited legal retention.
- The right to object to or restrict certain processing.
- The right to data portability (export).
- The right to withdraw consent where processing is based on consent.
- The right to lodge a complaint with your local data protection authority.
To exercise any of these, write to parbhat@parbhat.work from the email address associated with your account. We will respond within 30 days. We will not retaliate against you for exercising your rights.
GDPR (EU / UK)
If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (and the equivalent UK GDPR / Swiss FADP) gives you the rights summarised in "Your rights" above. This section explains how we apply those rules.
Data controller
Cutline, operating the service at cutline.cloud, acts as the data controller for personal data you submit to operate your account and use the service. You can reach the controller at parbhat@parbhat.work.
Legal bases (Art. 6 GDPR)
- Performance of a contract: to create your account, run the pipeline you requested, deliver the generated MP4, and provide your dashboard.
- Legitimate interests: to keep the service stable, prevent abuse, enforce rate limits, secure our infrastructure, debug errors, and communicate transactional notices. We have balanced these interests against your rights and freedoms.
- Legal obligation: where we must retain or disclose data to comply with tax, accounting, or law-enforcement requirements.
- Consent: used only where we explicitly ask (for example, optional marketing emails, where applicable). You can withdraw consent at any time without affecting prior processing.
Right to lodge a complaint
If you believe our processing of your personal data infringes the GDPR, you can lodge a complaint with the supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement, or with the UK Information Commissioner's Office (ICO) for UK residents.
Automated decision-making
The Cutline pipeline produces video output by automated means, but we do not make decisions that produce legal or similarly significant effects on you within the meaning of Art. 22 GDPR. The output is creative content delivered to you for review and use.
CCPA / CPRA (California)
If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you specific rights regarding your personal information.
Categories of personal information collected
In the last 12 months we have collected the following categories of personal information about California users, all from the user directly:
- Identifiers: name, email address, account identifier, IP address.
- Commercial information: subscription plan, transaction history (returned to us by our payment processors).
- Internet or other electronic network activity: session cookies, anonymous-funnel session identifiers, request logs (IP, user-agent, timestamps).
- User-generated content: prompts you submit, files you upload, configuration choices.
We do not sell or share your personal information
We do not sell personal information for monetary value, and we do not share personal information for cross-context behavioural advertising as those terms are defined under the CPRA. We do not knowingly sell or share the personal information of consumers under 16.
Sensitive personal information
We do not collect sensitive personal information as defined by the CPRA, and therefore do not use or disclose it in a way that triggers your right to limit. Account passwords are stored as cryptographic hashes only.
Your California rights
- Right to know: what categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we shared it.
- Right to delete: your personal information, subject to limited statutory exceptions.
- Right to correct: inaccurate personal information we hold about you.
- Right to opt out of sale or sharing: not applicable in practice because we do neither, but the right exists if our practices ever change.
- Right to limit use of sensitive personal information: not applicable because we do not collect it.
- Right to non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercise a CCPA/CPRA right.
How to make a request
Email parbhat@parbhat.work from the address associated with your account. We may need to verify your identity before fulfilling certain requests. Authorised agents may submit requests on your behalf with appropriate written authorisation.
International transfers
Cutline and its sub-processors operate from servers in multiple jurisdictions, including the United States and the European Union. If you access the service from outside those jurisdictions, your data will be transferred to and processed in them. We rely on the standard contractual clauses or equivalent safeguards offered by our sub-processors where applicable.
Children
Cutline is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact parbhat@parbhat.work and we will delete it.
Security
We use industry-standard practices: TLS for data in transit, hashed passwords, scoped API keys held server-side, and access controls on our database and storage. No system is perfectly secure; if we ever experience a data breach affecting your personal data, we will notify you and the relevant authorities as required by law.
Changes to this policy
We may update this policy as the product evolves. When we make material changes we will revise the "effective" date at the top of the page and, for changes that materially expand how we use your data, send a notice to your account email or display an in-app banner. Continued use of Cutline after a change means you accept the updated policy.
Contact
Questions, requests, or complaints about this policy or your data: parbhat@parbhat.work.