Privacy Policy

Cutio LLC is the controller responsible for the Cutio website, account, licensing and product-support activities described here. Company identification number: 402382514. Registered address: Georgia, Tbilisi, Chughureti District, Tina Enukidze 2nd Lane, No. 6. Contact support@cutioapp.com for privacy questions and requests.

1. Information we process

Website and support

Hosting and security services process technical connection information, such as IP addresses, request details and timestamps, to deliver the website and downloads and investigate problems or abuse. If you contact support, we receive your email address, message, purchase or account reference if supplied, and any diagnostic files or attachments you choose to send. Send only what is needed; exclude passwords, verification codes, API keys, full card details and unnecessary customer information.

Accounts, devices, trials and licenses

The licensing service processes account email and identifiers, verification challenge and session records, device identifiers or aliases, device names, trial and license status, activation and transfer history, and event timestamps. Some technical identifiers are derived or hashed; they may still relate to a device or person and are not automatically anonymous. A trial without email still requires device and trial information. We receive information from your application and account actions and generate status and security records when providing these services.

Local project work

Project files, catalogs, settings and recovery copies are stored on your computer through the desktop application. Ordinary local project work is separate from account licensing. Your own backup or synchronisation provider may hold copies if you choose such a folder. Uninstalling Cutio or signing out does not establish that your local files and backups have been erased.

Optional recognition

When you choose image/PDF recognition, the client sends the selected source content and filename directly to OpenAI using your configured API key and API account. Review the document before sending it and ensure that you are entitled to submit any third party's information. Recognition is optional and is not required for Excel import.

The recognition request sets store: false. This is not a guarantee of zero retention: OpenAI's API data controls distinguish application-state storage from abuse-monitoring records and account-specific exceptions. Your provider agreement and settings also apply.

Payments

Online purchases are not open yet. When paid sales begin through Paddle, Paddle will handle the transaction as reseller/Merchant of Record under its own terms and privacy notice. Cutio will use the purchase, subscription, adjustment and entitlement information needed to provide the license and support. Cutio does not receive full payment-card numbers. Payment processing and optional recognition are not treated as activities carried out solely on Cutio's behalf.

2. Purposes and legal bases

• Requested services: to provide account access, the trial, activation, license verification, device transfers and product support. Where applicable, the basis is performance of a contract or steps requested before entering one.
• Security and abuse prevention: to protect accounts and infrastructure, enforce entitlements and prevent repeated trial abuse. Where applicable, the basis is the legitimate interest in providing a secure service, balanced against your rights and limited to necessary information.
• Legal requirements and claims: to meet applicable recordkeeping duties and establish, exercise or defend legal claims. The relevant legal obligation or justified claim determines the scope of any retention.
• Optional choices: where consent is the applicable basis, we seek it for the stated purpose and you may withdraw it without affecting earlier lawful processing. Choosing recognition sends the selected material to your API provider; it is not a blanket consent for other data uses.

Browsing does not require a Cutio account. Without information necessary for account verification or licensing, we cannot provide the corresponding function. You may decline optional recognition and continue using Excel import. Automated entitlement and trial checks can affect licensed access; contact support if a result is wrong or you need a person to review it.

3. Recipients and international processing

Google Cloud/Firebase provides infrastructure, website and download hosting. Postmark sends transactional messages; Namecheap Private Email hosts the support mailbox. Authorised support and technical personnel may access information necessary for their duties. Information may also be disclosed where required by law or necessary for a properly assessed legal claim. Optional recognition uses your OpenAI account; future purchases through Paddle have the independent reseller processing described above.

These providers may process information outside Georgia or your country, including in the United States. Their locations and safeguards vary by service and activity. Their published privacy information is available from Google, Postmark, Namecheap, OpenAI and Paddle. Contact us for information about the arrangements applicable to Cutio's processing. This policy does not promise that all data stays in one country.

4. How long information is kept

The following periods or criteria distinguish service records from provider copies. Expiry of a code, session, trial or signed license is not the same as deletion of its record. Signing out, releasing a device, cancelling billing and asking for erasure are different actions.

• Accounts and device links: kept while needed to provide requested access and associated rights, resolve a support issue or comply with a specific justified obligation. An inactive free account and an account with an active paid or Perpetual entitlement are assessed differently. Keeping proof of a valid entitlement does not justify keeping every related personal detail.
• Trial, license and activation history: kept to establish trial use, prevent proportionate abuse, honour paid rights and resolve relevant disputes. We assess the continuing need and retain only information necessary for those purposes. No automatic new trial is promised when a historical record is removed, and no fixed automatic erasure deadline is promised for these categories.
• Verification and sessions: codes and authorisations have limited validity and can expire or be revoked. Expired records may remain until the service's cleanup path runs. We do not describe token validity as a guaranteed data-deletion deadline.
• Logs: the configured Google Cloud Logging _Default bucket has a 30-day retention period and _Required a locked 400-day period. These are bucket settings, not a retention rule for the database, all application logs or email. Other diagnostic records are assessed by their security and troubleshooting need.
• Support correspondence: kept while the issue, associated service obligation or a justified dispute requires it. Attachments are assessed separately for necessity; where the mailbox cannot remove an attachment independently, deletion of the whole eligible message must be considered. No fixed automatic mailbox-deletion period is promised.
• Transactional email: Postmark documents a default 45-day message-content/activity period. Expired activity is queued for deletion, so this is not a promise of complete physical erasure on day 45. Aggregated statistics and suppression records have separate provider rules, including indefinite retention. A suppression record can be needed to prevent further unwanted delivery.
• Backups: operational, deployment and disk-snapshot copies have separate lifecycles and may retain earlier states. An active-record deletion does not establish deletion from every backup. Namecheap documents daily service backups retained for up to four weeks; deleted correspondence can remain in provider backups until their lifecycle ends. Recovery, incident or legal needs may justify a specific restricted exception; they do not justify unrestricted reuse.
• Local files and your API account: local projects and your own backups remain under your control. OpenAI's retention depends on the service, agreement and settings of your API account.

For a deletion request, we assess each relevant category, any specific duty or claim that requires limited retention, and the effect on an existing license. We explain what was deleted, what must be retained, and any provider or backup limitation that remains. We do not promise immediate physical removal from every historical copy or an automatic account-erasure feature.

5. Your rights and how to request them

Depending on applicable law, you may request information, access or a copy, correction, erasure or termination of processing, restriction or blocking, portability where applicable, object to certain processing, or withdraw consent. Rights have conditions and exceptions. Contact support@cutioapp.com, identify the relevant account or correspondence and state your request. Do not send a password, one-time code or API key. We may ask for proportionate evidence of identity or authority; a full identity document is not routinely needed.

We assess requests within applicable legal deadlines and explain any lawful refusal or limitation and available remedies. You may complain to the competent data-protection authority or seek a court remedy. For Georgia, the current Personal Data Protection Law identifies the State Audit Office as the supervisory authority. This does not restrict rights to contact another competent authority where applicable.

6. Security and your choices

We limit access to service needs and use the security controls of the relevant application and infrastructure. No system can guarantee absolute security. Protect your computer and email account, keep verification codes private, review recognition inputs and share only necessary diagnostics with support. If you believe an account or key has been exposed, contact support without including the secret itself.

7. Changes and contact

Changes to this policy will be published with an effective date. Material changes will be communicated as required by law. A policy update does not itself authorise an unrelated new use of information.

Controller: Cutio LLC
Company identification number: 402382514
Registered address: Georgia, Tbilisi, Chughureti District, Tina Enukidze 2nd Lane, No. 6
Privacy and support: support@cutioapp.com