Privacy policy

Who we are

In this policy, “Cuttl”, “we” and “us” mean the business that runs cuttl.io. We are the controller of the personal data collected on cuttl.io and through Cuttl accounts, which means we decide how it is used. We haven’t appointed a data protection officer. Questions about this policy or your data: contact@cuttl.io.

This policy covers the cuttl.io website, the live demo and accounts on app.cuttl.io. When customers use Cuttl on their own websites, they decide what is collected there, and their own privacy policies apply. We process that data for them under our terms.

What we collect

The pages you view, what you click and how you move through them, including session recordings. We take steps to keep what you type into forms out of recordings.
Technical details such as your browser, device type, language, the page that sent you here and an approximate location based on your IP address. We don’t keep your IP address in our analytics.
Details you give us, such as your name, work email, company and phone number when you sign up for the live demo or contact us.

We measure the site with Cuttl, our own product, and with Google Analytics. Google may process data in the United States; see Google’s privacy policy.

How we use it

To run the site and the live demo, keep them secure and fix problems.
To understand how people find and use cuttl.io, and to improve our site and products.
To give you access to the live demo and get in touch with you about Cuttl.
To send you product news, if you’ve asked for it.
To meet legal obligations and protect our rights.

We don’t sell your personal data.

Accounts on app.cuttl.io

When you or your team use an account on app.cuttl.io, we keep:

Account details: your name, email address, password (stored only as a secure hash), how you sign in, including single sign-on through your company’s identity provider, your two-factor settings, and your role and access in the workspace.
Security records: the devices you’re signed in on, and logs of sign-ins, changes and who viewed what in the workspace. These include IP address, browser and approximate location.
Billing details: your plan and payment status. Payments are handled by our payment provider as merchant of record, so we don’t see or store your card details.
Messages: emails about your account, such as verification, invites, security alerts and billing notices, and anything you send us for support.

We do not collect all of it directly from you. A teammate who invites you gives us your email address, and with single sign-on your company’s identity provider shares your name and email address with us.

We use this to provide Cuttl to you, keep accounts secure, prevent abuse, give support and handle billing. Cuttl support may view your workspace when you ask for help, or when we need to keep the service secure.

Cookies and storage

Some cookies and browser storage are needed for the site to work and are always on, including Cuttl’s own measurement. If you are in the UK or EU, Google Analytics runs only after you choose Accept. Everywhere else it’s on by default, and you can turn it off any time with in the footer. These are the main ones:

Name	Set by	What it does	Kept for
_ga, _ga_<id>	Google Analytics	Tells sessions from the same browser apart	Up to 2 years
_hm… keys (browser storage)	Cuttl	Links the pages of a session, and repeat sessions, together	Up to 400 days
cuttl_consent	cuttl.io	Remembers your cookie choice	12 months
cuttl_demo, cuttl_demo_reg	demo.cuttl.io	Lets you into the live demo after you sign up	Up to 400 days

If you choose Necessary only, Google Analytics stores nothing.

Measuring the site with Cuttl, keeping it secure and fixing problems: our legitimate interest in running and improving cuttl.io.
Google Analytics: your consent, which you can withdraw any time with Cookie settings.
Live demo access and follow-up: our legitimate interest in responding to your interest in Cuttl.
Product news: your consent, which you can withdraw any time.
Accounts on app.cuttl.io: to perform our contract with you (running your account and billing), and our legitimate interest in keeping accounts secure and preventing abuse.
Legal obligations: where the law requires us to keep or share data, such as billing records for tax.

We share data with service providers that help us run cuttl.io, such as hosting, storage, analytics, email, payment and error-monitoring providers. They may use it only to provide their services to us.

The sign-in, sign-up, email confirmation, early access, password reset and live demo forms use Cloudflare Turnstile to tell people from bots. To run the check, Cloudflare sees details of your browser and connection, such as your IP address. See Cloudflare’s Turnstile privacy addendum.

We may also share data when the law requires it, to protect our rights or the safety of others, or as part of a sale, merger or reorganisation of our business.

International transfers

Some of our providers are based outside the UK and EU, including in the United States. When data leaves the UK or EU, we rely on the safeguards the law allows, such as adequacy decisions, standard contractual clauses or the UK’s international data transfer agreement.

How long we keep data

We keep data only as long as we need it for the purposes above. As a guide:

How you use the site: up to 2 years.
Live demo sign-up details: up to 2 years after your last session in the demo, or until you ask us to delete them.
Account details: while your account is open. When it’s closed, we delete them, apart from records the law requires us to keep.
Signed-in device records: up to 30 days after the session ends.
Activity logs: up to 400 days. Records of who viewed what in a workspace: while the workspace exists.
Billing records: as long as tax and accounting law requires.
Cookies and storage: as listed above.

We may keep some data for longer when the law requires it or to settle disputes.

Security

We use reasonable technical and organisational measures to protect your data. No system is completely secure, so we can’t guarantee it.

Your rights

Depending on where you live, you have these rights over your personal data:

Access: request access to your data and get a copy of it.
Rectification: ask us to correct data that is wrong or incomplete.
Erasure: ask us to delete your data.
Restriction: ask us to limit how we process your data.
Portability: get the data you gave us in a structured, machine-readable format.
Objection: object to processing based on our legitimate interests (see below).

Email contact@cuttl.io to use any of these rights. We’ll reply within the time the law allows, and we may need to confirm who you are first.

Your right to object

Where we rely on our legitimate interests, you have the right to object to that processing at any time, for reasons relating to your situation. You can always object to direct marketing. Email contact@cuttl.io, or turn off Google Analytics with Cookie settings.

Where we rely on your consent, you can withdraw consent at any time with Cookie settings (for Google Analytics) or by emailing contact@cuttl.io. Withdrawal does not affect processing we carried out before you withdrew.

Automated decisions

We don’t make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

Complaints

You can complain to a supervisory authority. In the UK that is the Information Commissioner’s Office (ICO), at ico.org.uk. In the EU, it is the data protection authority where you live or work. We’d appreciate the chance to sort out your concern first, so please contact us before you go to the regulator.

Children

cuttl.io is for businesses. It isn’t meant for children under 16, and we don’t knowingly collect their data.

Changes

We may update this policy from time to time. When we do, we change the date at the top of this page.