Privacy Policy

1. Who we are

Cutlock ("we", "us", "our") is a file delivery platform operated by Jakub Bandzarewicz, a sole proprietor based in Żory, Poland. We can be reached at jacob@voidx.pl.

To reduce public exposure of a private residential address, our full postal address is not displayed on this public page. It is available upon legitimate legal or regulatory request sent to the contact email above.

Cutlock operates the website at cutlock.app and provides services to creative freelancers for secure file delivery.

2. Data we collect and why

Account data

When you create an account, we collect:

• Email address - required to identify your account and send notifications
• Name - displayed in your profile and delivery pages
• OAuth profile data - if you sign in with Google, Apple, or Discord, we receive your name, email, and profile picture from that provider
• Subscription and usage data - your plan, billing period, storage usage counters, project counts, file counts, and monthly transcoding counts

Legal basis: Contract performance (Article 6(1)(b) GDPR). We need this data to provide the service you signed up for.

Files you upload

Files you upload, including photos, videos, PDFs, and audio, are stored on our infrastructure on your behalf. You are the data controller for any personal data contained in those files. Cutlock acts as a data processor. We do not access, analyse, or use the content of your files except to generate watermarked previews and deliver them to your clients as you instruct.

Legal basis: Contract performance. Storing and delivering your files is the core service you have contracted us to provide.

Client data

When your clients interact with delivery links, we may collect their name and email address if they choose to provide it. Comments left on delivery pages may include the author name, email address, and comment content. This data is collected on your behalf as part of the delivery service. Client email addresses are used only for confirmations, access, and notifications related to your project.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) and contract performance where needed to provide delivery access.

Payment and subscription data

Your Cutlock subscription is processed by Polar, our Merchant of Record. Polar handles billing, invoices, and payment processing. We receive confirmation of your subscription status from Polar but do not store your card details.

Payments from your clients to you are processed through your own Stripe, PayPal, Przelewy24, or Revolut account. Cutlock does not process or store those payment credentials or transaction funds. Where API keys or access tokens are needed to connect your provider account, they are stored encrypted.

Legal basis: Contract performance.

Usage and technical data

We automatically collect:

• Storage used in bytes
• Monthly transcoding count
• Project and file counts
• Login timestamps stored by Supabase Auth
• IP address for rate limiting and abuse prevention on delivery pages

Privacy-safe error reporting, without default PII, is used to keep the service secure and reliable. Product analytics, performance traces, and masked session replay remain off unless you explicitly enable their respective optional category. We do not use advertising cookies.

Legal basis: Legitimate interest for security, plan enforcement, and essential error reporting; consent (Article 6(1)(a) GDPR) for optional product analytics and enhanced diagnostics.

3. How long we keep your data

4. Who we share data with

We share data only with subprocessors necessary to operate the platform. We aim to maintain Data Processing Agreements or equivalent data protection terms with each subprocessor where required.

We do not sell your data. We do not share your data with advertisers. We do not use your data to train AI models.

5. International transfers

Some subprocessors are based in the United States or operate global infrastructure. When transferring personal data from the EU/EEA or UK to another country, we rely on Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, adequacy decisions, or the EU-US Data Privacy Framework where applicable.

6. Your rights under GDPR

If you are located in the EU, EEA, or UK, you have the following rights:

• Right of access - request a copy of your personal data
• Right to rectification - correct inaccurate data
• Right to erasure - request deletion of your data
• Right to portability - receive your data in a machine-readable format
• Right to restriction - restrict how we process your data
• Right to object - object to processing based on legitimate interest
• Right to withdraw consent - where processing is based on consent

To exercise any of these rights, use our Data Subject Request form or email jacob@voidx.pl. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO) at uodo.gov.pl.

7. Security

We protect your data through:

• Encryption at rest and in transit (TLS 1.2+ for all connections)
• Payment credentials stored with AES-256-GCM encryption
• Row-level security on database tables
• Access tokens with short expiry for file downloads
• Rate limiting on public-facing endpoints

In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours where required by GDPR.

8. Cookies

We use technically necessary storage required to operate the service, such as session cookies for authentication and a cookie recording your privacy choices. Optional product analytics and enhanced diagnostics are disabled until consent. You can change or withdraw consent through the Privacy settings button available on every page. We do not use advertising cookies. See our GDPR & Cookie Policy for full details.

9. Children

Cutlock is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at jacob@voidx.pl and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy when our practices change or when required by law. We will notify you by email at least 30 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

For privacy-related questions, requests, or complaints:
Email: jacob@voidx.pl
Operator: Jakub Bandzarewicz, Żory, Poland
Postal address: available upon legitimate legal or regulatory request.