Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Cutola ("we", "us") collects, uses, and protects your personal data. We are based in the United Kingdom and act as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to handling your data lawfully, fairly, and transparently.

1. Data we collect

  • Account data: your email address and authentication identifiers, managed on our behalf by Clerk.
  • Image data: the images you upload for processing and the outputs we generate from them.
  • Usage data: tools used, credits consumed, job status, file sizes, and processing times, used to operate and improve the Service.
  • Payment data: handled by Polar as our Merchant of Record. We do not store your full card details on our systems.
  • Technical data: limited IP and device information used for security, abuse prevention, and anonymous usage limits.

2. How we process your images

Uploaded images and generated outputs are stored in Cloudflare R2 object storage. Image processing runs on our own infrastructure and, for background removal, on GPU infrastructure operated by Replicate, a specialist model-hosting provider acting as our sub-processor. Images sent to Replicate are used solely to produce your result and are not retained by them for training. We do not use your images to train models, and we never sell them or use them for advertising. Files are retained only for a short period to allow you to download your results, after which they are automatically deleted.

3. Legal bases for processing

  • Performance of a contract: to provide the Service you have signed up for and to process the images you submit.
  • Legitimate interests: to secure our platform, prevent abuse, and improve our service, balanced against your rights.
  • Legal obligation: to comply with tax, accounting, and other legal requirements.

4. Sub-processors

We rely on a small number of trusted providers to deliver the Service:

  • Clerk — authentication and account management.
  • Cloudflare R2 — temporary storage of uploaded and processed images.
  • Replicate — GPU model hosting used to run background removal on submitted images.
  • Polar — payment processing as Merchant of Record.

Where data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent standard contractual clauses.

5. Data retention

Uploaded and processed images are deleted automatically after their short retention window. Account, credit, and transaction records are kept for as long as your account is active and for a reasonable period afterwards to meet legal and accounting obligations.

6. Your rights

Under the UK GDPR you have the right to:

  • access the personal data we hold about you;
  • request correction of inaccurate data;
  • request erasure of your data (the "right to be forgotten");
  • object to or restrict certain processing; and
  • request a copy of your data in a portable format.

You can delete your account and associated data at any time from your account settings. To exercise any other right, contact us via our contact page. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

7. Cookies

We use only essential cookies required to keep you signed in and to operate the Service securely. We do not use advertising or cross-site tracking cookies.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date above reflects the most recent revision, and we will notify you of material changes where required.

9. Contact

For any privacy enquiry or to exercise your data rights, please reach us through our contact page.