Privacy Policy

Effective date: August 1, 2026

1. Introduction

Cut OS FZ-LLC ("Company", "we", "us") operates the Cut OS platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service. We are committed to compliance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and the EU General Data Protection Regulation (GDPR) where applicable.

2. Data We Collect

We collect the following categories of personal data:

Account information

  • Name, email address, and password (hashed)
  • Company name and workspace settings
  • Role and team membership within a workspace
  • Profile photo (if uploaded)

Content you create

  • Projects, tasks, and production briefs
  • Uploaded videos, images, and documents
  • Chat messages and comments
  • Invoices, proposals, and client records

Automatically collected data

  • IP address, browser type, and operating system
  • Pages visited and features used within the Service
  • Timestamps of access and session duration
  • Device identifiers and screen resolution

Payment information

  • Billing address and plan details
  • Payment card information is processed by Stripe and never stored on our servers

3. How We Use Your Data

We process your personal data for the following purposes:

  • Service delivery — to operate, maintain, and provide the features of Cut OS.
  • Authentication — to verify your identity and manage access to your workspace.
  • Communication — to send transactional emails (invitations, password resets, invoice notifications) and service-related announcements.
  • Billing — to process payments and manage your subscription.
  • Support — to respond to your requests and troubleshoot issues.
  • Improvement — to analyze usage patterns (in aggregate) to improve the Service.
  • Security — to detect and prevent fraud, abuse, or unauthorized access.
  • Legal compliance — to comply with applicable laws and regulations.

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Data Storage and Security

Your data is stored on servers located in secure data centers. We implement industry-standard security measures including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Hashed and salted passwords using bcrypt
  • Role-based access controls and tenant isolation
  • Regular security audits and vulnerability assessments
  • Automated backups with point-in-time recovery

While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Sharing

We share your data only in the following circumstances:

  • Within your workspace — team members in your workspace can see shared projects, tasks, and communications as permitted by their role.
  • Service providers — we use third-party providers (Stripe for payments, email delivery services) who process data on our behalf under strict contractual obligations.
  • Client portal — if you share content with clients through the portal, they can view the content you have explicitly made available.
  • Legal requirements — we may disclose data if required by law, court order, or governmental authority.

We do not share your data with advertisers or data brokers.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data — retained until account deletion, then purged within 30 days.
  • Content — retained until deleted by you or until 30 days after account termination. You may request a data export before deletion.
  • Usage logs — retained for up to 12 months for security and analytics, then anonymized or deleted.
  • Billing records — retained for 7 years as required by applicable tax and commercial law.

7. Your Rights

Under the UAE PDPL and the GDPR (where applicable), you have the following rights:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — request correction of inaccurate or incomplete data.
  • Erasure — request deletion of your personal data, subject to legal retention requirements.
  • Portability — request a machine-readable export of your data.
  • Restriction — request that we limit processing of your data in certain circumstances.
  • Objection — object to processing of your data for specific purposes.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@cutos.app. We will respond within 30 days.

8. Cookies

We use essential cookies for authentication and session management. These are strictly necessary for the Service to function and cannot be disabled. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. International Transfers

If your data is transferred outside the UAE or EEA, we ensure appropriate safeguards are in place, including standard contractual clauses approved by relevant authorities, to protect your data in accordance with applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 14 days before they take effect. The "Effective date" at the top of this page indicates when the policy was last revised.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Cut OS FZ-LLC
Data Protection Officer
Dubai, United Arab Emirates
Email: privacy@cutos.app