# Privacy Policy — data, retention and your rights | Cut Marketing

> What personal data Cut Marketing (컷마케팅) collects, why, how long we keep it, who processes it, international transfers, and how to exercise your rights.

Privacy

# Cut Marketing Privacy Policy

Effective 8 November 2026 · Last updated 8 November 2026

Cut Marketing ("we", "us") processes personal data only as needed to provide our AI ad creative service at https://cutmarketing.app and https://app.cutmarketing.app, in line with the Korean Personal Information Protection Act and, where applicable, the EU/UK GDPR.

We do not sell personal data and we do not share it with third parties for advertising.

[Terms of Service →](/zh-cn/terms)

1.  [1\. Data we collect and how](#items)
2.  [2\. Why we use it](#purpose)
3.  [3\. How long we keep it](#retention)
4.  [4\. Sharing with third parties](#third)
5.  [5\. Processors](#processors)
6.  [6\. International transfers](#overseas)
7.  [7\. Deletion](#destroy)
8.  [8\. Your rights](#rights)
9.  [9\. Cookies and similar technologies](#cookies)
10.  [10\. Security](#security)
11.  [11\. Children](#children)
12.  [12\. Payment information](#payments)
13.  [13\. Privacy contact](#officer)
14.  [14\. Remedies (Republic of Korea)](#remedy)
15.  [15\. Changes](#changes)

## 1\. Data we collect and how

| Category | Data | Source |
| --- | --- | --- |
| Account and sign-in (required) | Google account identifier, email address, display name | Provided by Google when you sign in with Google and consent |
| Using the service (required) | Images, video and audio you upload; prompts and scripts; generated outputs; product and brand briefs; projects, experiments and review records; credit grants and usage | Entered or uploaded by you, or created while you use the service |
| Advertising results (optional) | Ad metrics you upload or enter (impressions, clicks, spend, conversions, etc.) | CSV upload or manual entry by you |
| Automatic (required) | IP address (country), hashed browser/device information, access times, error and security logs, essential cookies | Generated when you access the service |
| Analytics (optional) | Google Analytics 4 cookies and usage events | Only after you accept analytics cookies |
| Notifications (optional) | Web push subscription (endpoint and keys issued by your browser) | Only if you turn on completion notifications |
| Contact (optional) | Email address, message and attachments | When you email [hello@cutmarketing.app](mailto:hello@cutmarketing.app), [support@cutmarketing.app](mailto:support@cutmarketing.app) or another of our addresses |

## 2\. Why we use it

-   Identify you, keep you signed in, secure the service and prevent abuse
-   Provide the features you request — AI image, video and voice generation, prompt assistance, photo editing — and store the results
-   Grant trial credits and reserve, charge and release credits
-   Provide workspace features such as projects, assets, experiments and report comparisons
-   Answer enquiries, send service notices and handle incidents
-   With your consent only, analyse usage to improve the service
-   Comply with law and handle disputes

## 3\. How long we keep it

We delete personal data without delay once its purpose is fulfilled. Specific periods:

| Data | Retention |
| --- | --- |
| Account data, outputs, uploads, workspace records, credit history | Until you delete your account; assets you delete are removed immediately |
| Sign-in sessions | Up to 30 days (removed automatically on expiry) |
| Generation job events | 90 days |
| Duplicate-request and retry records | 7–8 days |
| Temporary upload files | 1 day |
| Security and rate-limit records | Until the limit window ends |
| Analytics (Google Analytics) | Per our Google Analytics retention setting (only with consent) |
| Support emails | 3 years after the enquiry is resolved (for disputes), or earlier on request |

## 4\. Sharing with third parties

We do not provide your personal data to third parties, except with your prior consent or where the law requires it through lawful procedures.

## 5\. Processors

We use the following service providers to run the service under contracts that require appropriate protection of personal data.

| Processor | Purpose |
| --- | --- |
| Cloudflare, Inc. | Hosting, database and file storage, inbound email routing, security |
| Google LLC | Google sign-in, Google Analytics (with consent), operator mailbox |
| Amazon Web Services, Inc. | Sending email from our addresses (Amazon SES, Seoul region) |
| Pickshot and the AI model providers it routes to | Processing generation and prompt-assistance requests. Only the prompt and reference media needed for a request are sent; private references are shared through time-limited signed links |

## 6\. International transfers

Because we use global cloud and AI infrastructure, personal data is transferred outside your country as follows. If you object, you may stop using the service and ask us to delete your account; the service cannot be provided without these transfers.

| Recipient | Country | Data | When and how | Purpose and retention |
| --- | --- | --- | --- | --- |
| Cloudflare, Inc. | USA and countries with Cloudflare data centres | Account data, uploads, outputs, workspace records, access data | Network transfer while you use the service | Hosting and storage / as in section 3 |
| Google LLC | USA | Google identifier, email, name, analytics cookies and events (with consent) | Network transfer at sign-in and access | Authentication and analytics / until account deletion or per Google retention settings |
| Amazon Web Services, Inc. | Republic of Korea (Seoul region), USA (headquarters) | Email address, message content | Network transfer when an email is sent | Email delivery / for the delivery period |
| Pickshot and connected AI model providers | Republic of Korea, USA and other provider countries | Prompts, reference images, video and audio, outputs | Network transfer when you request a generation | Generation / per each provider's policy after processing |

## 7\. Deletion

-   Data whose retention period has ended or whose purpose is fulfilled is deleted without delay.
-   Electronic records are deleted irreversibly from the database and file storage.
-   Where the law requires retention, the data is kept separately for that period and then deleted.

## 8\. Your rights

-   You may request access to, correction or deletion of your personal data, suspension of processing, or withdraw consent at any time.
-   In the workspace you can download your data as JSON from the Account page and delete assets yourself.
-   Send account deletion and other requests to [support@cutmarketing.app](mailto:support@cutmarketing.app); after verifying your identity we respond within 10 days.
-   You can withdraw analytics consent at any time via Cookie settings in the site footer or the workspace analytics preferences.
-   If you are in the EU or UK you also have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to a supervisory authority. Legal bases: contract (providing the service), legitimate interests (security and abuse prevention) and consent (analytics, notifications).

## 9\. Cookies and similar technologies

-   Essential cookies and storage: sign-in session (up to 30 days), interface language, recovery of interrupted generation requests (up to 8 days). Required for the service.
-   Analytics cookies: Google Analytics 4, only with your consent; every feature works if you decline.
-   We do not use advertising cookies or third-party tracking pixels.
-   You can block cookies in your browser, but sign-in and some features will not work.

## 10\. Security

-   Encryption in transit (HTTPS/TLS) and access-controlled private storage
-   Ownership checks on private files; time-limited signed links when a file must be shared with a processor
-   Hashed session tokens, rate limiting and least-privilege operator access
-   A dedicated sending account restricted to our service addresses

## 11\. Children

The service is not directed to children under 14 and we do not knowingly collect their personal data. If we learn that we have, we delete it without delay.

## 12\. Payment information

Paid checkout is not open, so we do not collect payment methods or payment details. Before paid plans launch we will add the payment processor and the data involved to this policy and give advance notice.

## 13\. Privacy contact

For privacy questions, complaints or remedies, contact the team below. We respond without delay.

-   Privacy team: Cut Marketing operations team
-   Privacy requests: [support@cutmarketing.app](mailto:support@cutmarketing.app)
-   General enquiries: [hello@cutmarketing.app](mailto:hello@cutmarketing.app)

## 14\. Remedies (Republic of Korea)

-   Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
-   Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
-   Supreme Prosecutors' Office Cyber Investigation: 1301, www.spo.go.kr
-   Korean National Police Agency Cyber Bureau: 182, ecrm.police.go.kr

## 15\. Changes

We announce changes on the site at least 7 days before they take effect, or 30 days before for material changes such as new data categories, purposes or third-party sharing. Previous versions are available on request.