What we hold, and who else sees it.

• We store your email, your workspace, your uploaded footage and the videos made from it.
• We do not train models on your footage, sell it, or share it with anyone except the processors named below, who only touch it to do their job.
• We never see your card. Stripe handles payment and we only get the last four digits and the expiry.
• We advertise on Facebook and Instagram. If you let us, Meta is told that a visit, a signup or a payment happened here, with your email hashed. Say no and none of that runs.
• Ask us to delete your account and everything goes within 30 days.

Your email address. It is how you sign in, since there are no passwords, and how we send receipts and the note before a trial ends. Without it there is no account.

Your footage and the files made from it. Your uploads, the transcript, the edit, the finished videos, any avatars or music you generate. That is the product.

Billing records. What you were charged, when, and whether it succeeded. Stripe holds the card itself, we hold the record of the charge.

How the app is used. Which pages loaded and which actions ran, so we can find what is broken and what costs us money. Page analytics run through Plausible, which does not use cookies and does not build a profile of you. That is the analytics, and it is not the only thing that can run on this site — the advertising measurement described below is a separate thing, and it is the part you get to refuse.

What you write to support. Your messages and any screenshots you attach, so somebody can answer them.

We do not buy data about you. The one thing that does follow you off this site is the Meta advertising measurement described below, and it only happens if you agree to it.

Cutroom is not one machine. These companies process part of your data so the product can work. Each one gets only what its job needs.

• Supabase stores the database and runs sign-in.
• Cloudflare R2 stores your video files.
• Vercel hosts and serves the app.
• Stripe takes payments and holds the card.
• Resend sends our email.
• Deepgram transcribes the audio of what you upload.
• Anthropic reads the transcript to propose an edit.
• ElevenLabs generates voice-overs and music beds.
• fal.ai generates presenter (avatar) video.
• Trigger.dev runs the background work: renders, bakes, exports.
• Pexels and Pixabay supply stock footage. They receive a search phrase, never your video.
• Meta measures our ads, and only if you agree to it. It is the one name on this list that is here for our benefit rather than yours, which is why it gets its own section below.

Some of these are in the United States, so your data is transferred there. Where that transfer needs a legal basis under European law, it rests on the European Commission's standard contractual clauses.

If we replace one of these, this page changes with it. That is the point of naming them.

We buy ads on Facebook and Instagram, and we need to know which of them actually bring somebody here, otherwise we are burning money on guesses. So Meta gets told about some of what you do on this site. That is cross-site tracking. There is no gentler word for it and we are not going to invent one.

It does not run until you say yes. We ask on your first visit. Say no and nothing loads: no script from Meta, no cookie from Meta, and nothing about you is sent to them. If you were never asked, it is not running.

If you say yes, Meta is told when you arrive, when you head to checkout, when a card goes on file, and when a first payment goes through, with the amount of that payment. It travels two ways at once — a script in your browser (the Meta pixel) and a call from our own server — and both carry the same event id so Meta counts one signup once instead of twice.

Four things travel with it. Your email address, put through SHA-256 first — a fingerprint Meta can match against an account it already has, and one we cannot turn back into an address. The click id Meta itself attached to the link you arrived on. The id of the browser you are reading this in. And the IP address and browser your visit came from, which go across as they are, because that is how Meta tells one visit from another.

Google, and what we keep for it. If you arrive from a Google ad, the link carries a click id that Google put there. We record it in the same cookie that already remembers which page you landed on, behind the same consent — say no and it is not stored. Today it is only kept, not sent: we are not yet buying Google ads, and nothing about you goes to Google. When that changes, so does this paragraph, and it will say what is sent and when.

Your email is never sent unhashed. Your name is never sent at all, nor your footage, the ads you make, or a word of what you write to support.

Changing your mind. Your answer lives in a cookie on this site and nowhere else, so clearing this site's cookies makes us ask again from scratch and you can answer the other way. Refusing costs you nothing in the product — nothing here is gated on it. Meta gives you its own controls too, under ad preferences in your Facebook or Instagram account, and blocking trackers in your browser works on us the same as on anyone else. If you would rather just tell a human, email support@cutroomai.com.

Parts of Cutroom send your content to the models above: the audio goes to Deepgram to be transcribed, the transcript goes to Anthropic to be read.

None of them are permitted to train on your content, and we do not train anything on it either. The providers process it, return a result, and that is the end of it.

We keep a record of the prompts and responses so a bad edit can be debugged and so we can see what each call costs. Those records are deleted with your account.

Your files stay while your account does. Delete a project and its files go with it, straight away.

Removing an avatar, a Paper Films episode or a product shoot hides it from your workspace but keeps the files. If you want those files actually gone, ask us — see below — and we do it for you.

Close your account and everything is deleted within 30 days, except the billing records tax law requires us to keep for seven years. Those are amounts and dates, not your footage.

Support conversations are kept for two years so we can look back at what was said.

A copy of what we hold. A correction. Deletion. To object to us processing something. Email support@cutroomai.com and we will answer within 30 days. There is no form and no fee.

If you are in Europe and think we have handled something badly, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens. We would rather you told us first.

We set a cookie to keep you signed in, and one to remember which workspace you are in. If you arrived through a partner link, a third remembers who sent you so they get paid. A fourth remembers how you answered the advertising question, so we only have to ask once.

Those four are ours and the site does not work without the first two. Say yes to advertising and a few more appear: the two Meta's pixel works from, _fbc (which ad you clicked) and _fbp (this browser), plus one of ours holding an event id so a single signup is not counted as two. Meta's two are the ones that can recognise you elsewhere.

These are on by default. We used to ask before setting them and we no longer do, so you should assume they are already on when you arrive. You can turn them off whenever you like: Ad tracking at the bottom of any page opens the switch, and turning it off stops the browser pixel, stops us sending anything to Meta from our side, and stops the identifiers being attached to a payment. Your answer outranks the default and we keep it for six months.

One more of ours goes with them: it writes down the page you arrived on and the site that linked you here, so we can tell which of our own pages are worth keeping. It holds no name and no id, it keeps nothing of the referring address beyond the site itself, and it never leaves us. It cannot recognise you anywhere else — but it is still not needed to run the site, so it follows the same switch. Turn advertising off and not one of these is set.

Traffic is encrypted, files are stored privately and served through links that expire, and access to the database is restricted per workspace at the database itself rather than only in the app.

No system is perfect. If your data is exposed in a way that puts you at risk, we will email you within 72 hours of finding out, and tell you what happened rather than what our lawyers would prefer.

Cutroom is sold to businesses and is not for anyone under 18. We do not knowingly hold data about children. If we learn we have, we delete it.

If we change something that matters, we will email you before it takes effect. The date at the top always says when this page last moved.