Privacy Policy

We keep your source video for as long as its analysis exists. When a video reaches us as an upload — the browser extension hands us the bytes your own browser downloaded, or you upload a file yourself — we store that file in a private bucket next to the analysis. It stays there until you delete your account. A reel often arrives as two files, picture and sound, because that is how the site it came from serves it; we merge them into one video and delete the separate sound file as soon as the merge succeeds.

This changed on 3 August 2026. The file used to be deleted the moment the job ended. We keep it now because opening a cut has to read the original again, and the media links these videos come from stop working after a few days. Without our own copy, an analysis you paid for would quietly stop being openable.

When we do not keep it: if you give us a link and we fetch the video ourselves — YouTube, for example — the file is not stored. It is fetched again each time it is needed, and only the link is kept.

The stored copy is never handed back out. It is not in your download bundle, it is not behind a link, and no browser can reach it — only our own backend can read it (section 10).

Account. Your email address and Google account identifier, received from Google when you sign in. We never receive your Google password.

Work you create. The source videos uploaded from your browser and the addresses the extension sends when you capture a video, the analysis derived from them (shot timings, measured camera movement, palettes, lighting and composition notes, blocking diagrams, prompts), extracted frames and reference sheets, and the video clips you generate.

Credits and payments. Your credit balance and a ledger of every change to it; and for each purchase, the amount, currency, product, order reference and status. We never see or store your card number — the card is handled entirely by our payment provider (section 5).

Usage events. A pseudonymous record of what happened — an analysis finished, a cut was regenerated, a score came out — stored under a one-way hash of your account id rather than the id itself. We use these to see where the product fails and to improve routing.

We do not use advertising trackers, we do not run third-party analytics scripts in your browser, and we do not sell personal data to anyone.

Videos reach Cutaway through our Chrome extension, so this section says exactly what it does on the pages you visit.

It reads one thing: the video you point at. On a page you are looking at, it puts a button on videos and images. Nothing is sent anywhere until you press that button. When you do, it sends us the address of that post and — where your browser already has the media file, as on Instagram — the video and audio bytes your browser downloaded. It also sends the address of the page you were on, so two captures can be told apart.

It does not record your browsing.There is no history collection, no page content scraping, no keystroke or click tracking, and nothing at all leaves the extension on pages where you do not press the button. It watches network responses on Instagram's media domains only, and only to learn which file belongs to the video you chose.

What it keeps on your computer: a capture token, the email of the account it is connected to (so you can see who it is connected as), and the address of the server it talks to. Pressing Disconnect removes them. The token can also be revoked from your account page, which stops it working even if the extension is still installed.

Where it sends things: only to Cutaway and to our storage provider (section 5). The extension refuses to upload to any address that is not our storage host, even if a server tells it to.

If the GDPR or UK GDPR applies to you: we rely on performance of a contract for your account, your work and your credits — without them there is no service. We rely on legitimate interests for usage events and abuse prevention (running a product that works and is not being farmed), and on legal obligation for keeping financial records. Where we ask for consent, you can withdraw it.

These are the companies involved in running the service:

• Supabase — database, authentication and file storage. Our data is held in the Seoul region (ap-northeast-2).
• Vercel — hosting for the website itself.
• Polar — payments, as merchant of record. Polar handles the card, billing and tax, and holds the billing details we never receive.
• Google — sign-in, and the Gemini vision models that read your video and score your results.
• Atlas Cloud — the model that generates your clips. Your prompt and the reference frames for a cut are sent there.

Because these providers are outside Korea, running the service involves international transfers. Where the GDPR applies, those transfers rely on the providers’ standard contractual clauses.

We cannot control what those providers do with what they receive.Whether a model provider uses submitted content for its own training is governed by that provider’s terms, not ours — our opt-out below covers our use, and only ours.

By default we use what the pipeline produces to make the product better — mainly to build a reliable answer key for how a shot should be routed, which is the part that most affects quality.

What that uses: derived numbers, labels and text — measured camera movement, palettes, prompts paired with their scores, whether you kept a result. What it does not use: the pixels of your videos and clips, unless the source was your own material. We store your source video so that your own analysis keeps working, not so that we can learn from it — holding a copy does not change what we are willing to use.

We do not use your work in marketing or showcases, and we do not sell or license it to anyone.

You can turn this off. Ask us at support@cutawayfilm.com and we will set your account to opt out — the service works exactly the same afterwards.

• Source videos you upload — kept for as long as the analysis they belong to, with no fixed expiry, and deleted when you delete your account. A video we fetch from a link ourselves is not stored at all.
• Analyses and generated clips — until you delete them or delete your account.
• Usage events — 12 months, after which they are deleted automatically by a scheduled job. Deleted immediately if you close your account.
• Payment and credit records — retained after account deletion for accounting and dispute handling, with your account reference removed so what remains is amounts and dates that no longer identify you.

You can delete your account yourself, at any time, from your account page. It is immediate and permanent. It removes your profile, your analyses, the source videos stored with them, your generated clips (including the stored video files) and your usage events. Any credits you still hold are forfeited.

The only thing kept is the anonymised financial record described in section 7.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Deletion you can do yourself in one click; for anything else, write to support@cutawayfilm.com and we will respond within 30 days.

If you are in the EEA or the UK and think we have handled your data badly, you may complain to your local supervisory authority. If you are in Korea, you may raise it with the Personal Information Protection Commission.

Access to your data is enforced in the database itself with row-level security, not only in the application. Generated clips are stored in a private bucket and are served through signed links that expire after six hours, so knowing a file path is not enough to open it. Your stored source videos sit in a private bucket that has no client access rule at all: no signed link to them is ever issued, to you or to anyone, so only our backend holding the server credential can read them. The credential that can spend money on video generation is held by a single background process and is not present in the website.

No system is perfect. If you find a problem, please tell us at support@cutawayfilm.com before disclosing it publicly.

Cutaway is not for people under 18, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

If we change this policy in a way that materially affects you, we will show the change in the service before it takes effect. The date at the top always reflects the current version.