Privacy policy

Last updated 16 October 2026

This policy explains what personal data Cutonce collects, why, who handles it for us, how long it is kept, and what you can do about it. It applies from 11 October 2026 and covers:

• the website at cutoncestudio.com;
• the web app at app.cutoncestudio.com;
• the quiz, payment and legal pages at quiz.cutoncestudio.com;
• the Cutonce apps for iPhone and Android. Section 9 applies only to those apps.

1. Who is responsible

The controller of your personal data is Juicy Lucy AI, UAB, Tiltų g. 19, LT-91249 Klaipėda, Lithuania.

For anything about your data, write to hello@cutoncestudio.com. We answer within one month.

2. What we collect

When you visit the website

• The website at cutoncestudio.com sets no cookie and runs no analytics or advertising tool. Vercel, which serves it, handles the technical data of each request, such as your network address, and keeps its own logs of requests.
• If the link that brought you to the website carries campaign labels or click identifiers, the website keeps them in your browser for as long as that tab is open. When you follow a link to buy, it adds them to the address of the quiz. If your link carried no campaign label, it adds labels that say you came from our website and which button you used. The website sends them nowhere itself: the quiz pages record them as the next part describes.

When you open the quiz, payment or legal pages on the web

• A visitor identifier that these pages give your browser, and details of your visit: the pages and steps you opened, the page you came from, campaign labels and click identifiers on the link you followed, your network address, the country worked out from it, and the type of device and browser you use.
• If you take the quiz, your answers: the units you prefer, your experience, the tools you have, what you want to build and why.
• Your email address, which the quiz asks for before the payment page. It becomes your account.

If you subscribed on the web

• Our payment processor, Stripe, receives your payment details and creates a customer record with your email address. We do not receive or store your full card number. We can see the last four digits of the card, the amounts, the dates and the status of each payment.
• We store the state of your subscription: its status, plan, price, dates, and the identifiers that link it to the payment processor and to your quiz visit.

When you use Cutonce

• Your account: your email address, and a profile made of your quiz answers and your settings.
• Your progress through each plan, your favourites and your settings.
• Photos you take or choose: of your finished pieces, and of wood or furniture you ask the photo tools about.
• The results of the photo tools, your questions to the helper and its answers, and feedback you give.
• A count of your use of the photo tools and the helper, with the time and the cost of each request, so that the daily limits work.

When you contact us or make a request

• The email you send to hello@cutoncestudio.com and our reply.
• A request made through the support form or the withdrawal form: its kind, your email address, your message and the time.

Automatically, for security

• A one-way hash of the network address behind a request to open a purchase or to send a support request, used only to limit abuse. We do not store the address itself.
• A ledger of the payment events we receive, holding identifiers and times, not contents.
• Technical logs of our server functions, holding identifiers, never your email address, a sign-in code or a photo.
• The providers that host Cutonce keep their own technical logs of requests, which include network addresses.

What we do not collect

We do not ask for your name, your postal address, your telephone number or your date of birth. The web app does not read your location or your contacts. No analytics tool runs in the web app today, and it contains no advertising pixel.

3. Why we use it, and the legal basis

• To provide your account and the service. Email address, subscription state, progress, photos, scan results and the helper's chats. Legal basis: performance of the contract with you.
• To take payment and keep invoices. The customer record and the invoices at the payment processor. Legal basis: performance of the contract, and a legal obligation to keep accounting records.
• To send service emails. Sign-in codes, "your account is ready", reminders before a charge, payment failed, cancellation confirmed, subscription ended, request received and account deleted. Legal basis: performance of the contract, and a legal obligation for the reminders and confirmations.
• To run the website and pass campaign labels on to the quiz. The technical data of each request to the website, and the campaign labels and click identifiers on the link you followed. Legal basis: our legitimate interest in delivering the website securely and in knowing which link brought a visitor to the quiz.
• To run the quiz, payment and legal pages and carry your answers into your account. The visitor identifier, your answers and the details of your visit. Legal basis: steps taken at your request before a contract, and our legitimate interest in knowing that the pages work.
• To keep the service secure, limit abuse, and handle fraud and payment disputes. The hashed network address, the event ledger and the log of use of the photo tools and the helper. Legal basis: our legitimate interest in a secure and fair service.
• Marketing email. We send none. If that changes, it will be with your separate consent.

We do not sell your data. We do not use your photos, your questions or your builds to train artificial intelligence models. Anthropic, the provider named in section 4, may not train its models on them either under its commercial terms, which are the terms we use its service on.

We make no decision about you by automated means that has a legal or similarly significant effect. The photo tools give estimates for your information only.

4. Who handles data for us

We use the providers below. Each receives only what it needs to provide its service to us.

• Supabase. Database, sign-in, photo storage and server functions. It holds everything in your account: email address, profile, subscription state, progress, photos, scan results, chats and requests. Where: European Union (Ireland).
• Vercel. Serves the files of the website and of the web app. It handles the technical data of a page request, such as your network address. Where: Vercel's worldwide network, which includes the United States.
• Stripe. Payment processing and receipts for subscriptions started on the web. It handles the customer record, the payment method and the invoices. Stripe also acts as a controller for some purposes of its own, such as fraud prevention. Where: the countries where Stripe operates, which include the United States.
• web2wave (AppWave Corporation, a company registered in Delaware, United States). The quiz, the payment page, the subscription management page and these legal pages. It handles quiz answers, your email address, visit and click identifiers, and its copy of the subscription. Where: United States. web2wave uses providers of its own, which its data processing addendum lists.
• Resend. Sends our emails. It handles your email address and the content of the emails we send you. Where: emails are sent from the European Union (Ireland). Resend is a company in the United States.
• Anthropic. The artificial intelligence model behind the photo tools and the helper. It receives a photo or a question only when you use those tools, to produce the answer. Where a result is labelled as a sample, nothing was sent. Where: United States.

In the apps, two more providers are used, and Apple or Google sells the subscription. Section 9 names them.

We share personal data with authorities only where the law requires it.

5. Transfers outside the European Union

Your account data is stored in the European Union. web2wave and Anthropic process data in the United States, and Stripe, Vercel and Resend may do so as section 4 describes.

For web2wave, its data processing addendum applies the European Commission's standard contractual clauses to the transfer. For each of the other providers, its own data processing terms name the safeguard it uses. You can ask us which safeguard applies to a provider.

6. How long we keep it

• Account email address, profile and the quiz answers in your profile: until you delete your account.
• Subscription state: until you delete your account.
• Progress, favourites and settings: until you delete them or your account.
• Photos: until you delete them or your account.
• Scan results, chats with the helper and feedback: until you delete them or your account. A scan or a creation you delete disappears at once and is erased for good 30 days later.
• The copy of a photo or question sent to Anthropic for analysis: we keep no separate copy. Anthropic keeps it only as its own terms allow.
• Customer record, payment method and invoices at Stripe: for as long as accounting and tax law requires. Deleting your account does not delete your invoices.
• Quiz answers and visit details held by web2wave: for as long as our agreement with web2wave runs. We have yours deleted earlier if you ask.
• Emails we sent you, in the logs of the sending provider: for as long as that provider keeps its logs.
• Emails you send to our support address, and our replies: 24 months.
• Withdrawal and support requests: 6 years, as records of a legal request.
• The record that an account was deleted: 6 years. It holds no email address and no name: an internal identifier, a one-way hash of the email address, the payment processor's customer identifier, the reason if you gave one, and the date.
• Claim records (the attempts to open a purchase, with a hashed network address): 7 days.
• The ledger of payment events (identifiers and times, no contents): 400 days.
• The log of your use of the photo tools and the helper (counts and cost, not the photos or the questions): 13 months, or until you delete your account.
• The hashed network address stored with a support or withdrawal request: as long as the request itself.
• Database backups: 7 days. Deleted data leaves the backups after that.

7. Your rights, and how to use them

You have the rights below under the General Data Protection Regulation. The first three are built into Cutonce, so you do not need to ask.

• Access and portability. Account, "Download my data" gives you a file with everything stored about you, including a link to each of your photos.
• Erasure. Account, "Delete my account" deletes your account and its data at once. It first cancels a subscription started on the web. It cannot be undone. Your invoices remain with the payment processor, and the minimal deletion record described in section 6 remains.
• Rectification. You can change your units and set-up answers in Settings. To change your email address, write to hello@cutoncestudio.com. We confirm that the purchase is yours before we change it.
• Objection. You can object to processing based on our legitimate interests by writing to us.
• Restriction, and any of the rights above by another route: write to hello@cutoncestudio.com. We answer within one month.
• Complaint. You can complain to the data protection authority of the country where you live or work, or to ours: the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, vdai.lrv.lt.

If you subscribed but cannot sign in, you can still make any request by email.

8. Photos

A photo you take in Cutonce may show your home or a person. Please do not photograph other people.

• Photos are stored in private storage that only your account can read.
• When you use a photo tool that gives a real answer, the photo is sent to Anthropic for analysis and is used for nothing else.
• You can delete any photo, scan or creation.

9. The apps for iPhone and Android

This section applies only when you use the Cutonce apps for iPhone and Android.

Using the apps without an email address

You can use the apps, and subscribe in them, without giving an email address. The app then creates an account for you with no email address attached. What section 2 lists under "When you use Cutonce" is stored against that account. If you add an email address later, it is used as this policy describes.

Subscribing in the apps

A subscription started in an app is sold and billed by Apple or Google, under the store's own terms and privacy policy. We do not receive your payment details. Apple and Google are responsible for the data they collect when you use their stores and devices.

RevenueCat

RevenueCat keeps the record of store purchases for us. It receives your account identifier in Cutonce, the store's records of your purchase and renewals (the product, the price, the dates and the status), and device identifiers used to connect a purchase to the install measurement below. Where: United States.

AppsFlyer

AppsFlyer measures which advert led to an install of the app. It receives a device identifier, your network address, from which an approximate location is worked out, the events of installing and opening the app, and subscription events such as "trial started" or "cancelled", which RevenueCat passes to it.

On iPhone, the app asks for the system's permission to track when you first open it. AppsFlyer receives your phone's advertising identifier only if you allow it. You can change your answer at any time in the iPhone's Settings under "Privacy & Security", "Tracking". On Android, you can delete or reset the advertising identifier in the phone's settings.

Permissions

The apps ask for the camera when you first take a photo. They do not read your contacts or your precise location.

Deleting your account in the apps

Account, "Delete my account" deletes the account and its data at once, whether or not it has an email address. It does not cancel a subscription billed by Apple or Google: cancel that one in the store, as the Subscription terms explain.

Without the app, you can ask for your account to be deleted as Delete your account explains.

10. Children

Cutonce is not aimed at children, and we do not knowingly collect a child's data. If you believe a child has given us personal data, write to hello@cutoncestudio.com and we will delete it.

11. Cookies and similar technologies

The website sets no cookie. It keeps the campaign labels of the link you followed in your browser until you close the tab. The web app sets no cookie. It stores a small number of items on your device that it needs to work. The quiz, payment and legal pages set a small number of cookies and record your visit. No advertising pixel runs on them today. The details are in the Cookie and tracking notice.

12. Security

• Every table in our database is protected so that an account can read and change only its own rows. Billing data cannot be changed from the app.
• Sign-in uses a one-time code sent to your email address. There is no password to leak.
• Secret keys are held on the server only. Payment details are handled by the payment processor or the store.
• Data is encrypted in transit.
• Access to the production systems is limited to the authorised staff of Juicy Lucy AI, UAB.

No system is perfectly secure. If a breach affects your rights we will tell you and the authority as the law requires.

13. Changes to this policy

We will update this policy when the service or the law changes. Where we hold an email address for you, we tell you by email about any change that matters to you before it takes effect. The date at the top shows the latest version.

14. Contact

Juicy Lucy AI, UAB, Tiltų g. 19, LT-91249 Klaipėda, Lithuania. Email: hello@cutoncestudio.com.