Privacy Notice

ForgeStudio operates CutoutKit. This notice applies to the public site, product workflows, customer support, and related operational systems tied to https://cutoutkit.com.

Privacy questions and rights requests can be sent to hello@cutoutkit.com.

We process only the categories reasonably needed to run the service, secure it, support customers, and meet legal and accounting obligations.

• Contact and account data such as name, email address, auth identifiers, and organization details.
• Billing and subscription records such as Stripe customer IDs, plan status, invoice metadata, and payment-event history.
• User content such as uploaded images, generated outputs, prompts, workflow settings, and download activity.
• Technical and device data such as IP address, browser, approximate geolocation derived from network traffic, request logs, and failure diagnostics.
• Support and compliance records such as tickets, abuse reports, takedown notices, and fraud or security review notes.
• Preference data such as theme settings and saved cookie-consent choices.

We collect information directly from you, automatically from your device and browser, from payment and auth providers you use through the service, and from vendors that help us process requests and operate support or security workflows.

We use information to provide the requested service, authenticate users, route jobs to image-processing vendors, create outputs, deliver downloads, bill customers, investigate failures, prevent abuse, satisfy legal duties, and maintain the service.

Optional browser diagnostics are used only if the user consents through the cookie banner or cookie settings.

We do not sell personal information for money. We share information with service providers and subprocessors only as reasonably needed for the product stack and only subject to applicable legal and contractual safeguards.

• Hosting and deployment providers such as Vercel.
• Authentication, database, and storage providers such as Supabase.
• Payment processors such as Stripe.
• Error monitoring and support-diagnostics providers such as Sentry, when enabled.
• AI and image-processing providers such as Photoroom, Replicate, remove.bg, fal.ai, or your configured self-hosted worker.
• Professional advisers, law enforcement, regulators, or counterparties where disclosure is legally required or reasonably necessary to protect rights and safety.

We keep information for as long as reasonably necessary to provide the service, maintain security, comply with law, resolve disputes, enforce agreements, and preserve financial records. Different data types may be retained for different periods.

If you need stricter deletion timelines for a production launch, configure them operationally and ensure the product behavior matches what you publish here.

We use reasonable administrative, technical, and organizational measures to protect information, but no system is perfectly secure. You should avoid uploading information that is unnecessary for the requested workflow.

Data may be processed in the United States and other countries where our vendors operate. Cross-border transfers may occur when using globally hosted services.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict certain personal information, and to object to some processing. We will honor rights that apply under the laws governing your relationship with the service.

We do not currently run targeted advertising on the public site. If that changes, the cookie notice and privacy notice should be updated before launch.

CutoutKit is not directed to children and is not intended for users under 18. Do not use the service to process children's data, biometric data, or highly sensitive information unless you are independently authorized and legally compliant.