Cutout.Pro

GDPR overview

Implementation is partial, and stated in the terms rather than in a dedicated notice. Clause 9.1 says that where the customer is a private individual processing data for personal or family activities, cutout.pro processes all personal data exclusively on the basis of the General Data Protection Regulation, and that business customers are covered by a Data Processing Agreement published at www.cutout.pro/dpa. The privacy policy sets out a right of access and withdrawal at any time, self-service deletion of the account and its data from the dashboard, and a legitimate-interest basis for server logs. Beyond that, nothing: no data protection officer, no Article 27 representative for the European Union, no standard contractual clauses, no transfer mechanism and no hosting location. Governing law is Hong Kong.

Who owns the data?

The privacy policy names WINROAD HOLDINGS LIMITED, Hong Kong, as the party that controls the data. Uploads remain the customer's own: the vendor states that images and videos travel over SSL/TLS encryption, are used only to carry out the processing requested, and are never shared or published to third parties, while the files themselves are deleted automatically. Only usage statistics, stripped of the images, are retained for customer-relationship purposes. Amazon Web Services is named as the cloud provider that processes and edits photographs. Customers must guarantee they hold every right, copyright and trademark included, over what they upload, and business customers fall under a published Data Processing Agreement.

Reuse rights

Rights of use are non-exclusive, worldwide and limited to the duration of the contract, for the customer's own or internal use. What may then be done with the output depends on the plan: a commercial tariff lets the results be used, processed or exploited commercially in any manner, whereas a non-commercial tariff forbids any direct or indirect commercial purpose. Passing the software or the API interface on to third parties, whether paid or free, is not permitted. Customers using the API free of charge must credit the vendor to the recipients of the edited photographs through a link it supplies, and some paid tariffs carry the same advertising obligation. Responsibility for holding the rights to the source images stays entirely with the customer.

Data retention & training

Hosting summary

The vendor names Amazon Web Services as the third-party cloud provider that processes and edits photographs, but never says in which country or region that happens. Uploads travel over SSL/TLS encryption, are used only for the processing requested, and are not shared or published to third parties. Photographs are cached on the cloud servers while they are being edited and remain there for twenty-four to forty-eight hours after the last edit. The controlling entity named in the privacy policy is WINROAD HOLDINGS LIMITED in Hong Kong, and the terms are governed by Hong Kong law with jurisdiction before the Hong Kong courts; the 98% availability commitment is itself measured from an internet connection in Hong Kong. Network lookups resolve the domain to an Amazon anycast address geolocated in the United States, which describes the delivery network rather than any storage location the vendor commits to. There is no trust or security page, no certification, no subprocessor list and no data residency option.