Cutback

GDPR overview

There is no mention of the GDPR anywhere on the site: a search across every retrieved page returns zero occurrences of the regulation, and no data processing agreement, standard contractual clauses, lawful basis or Article 27 EU representative is named. The privacy policy follows the Korean framework instead, with its "data subject" and "Personal Information Protection Officer" vocabulary, and the terms place the contract under the laws of the Republic of Korea with exclusive jurisdiction at the company's principal place of business. Users are nonetheless offered access, rectification, suspension of processing and deletion rights, exercisable in writing, by phone, email or fax, and a protection officer is named: Tom Kim, chief executive, reachable at the general support address. SOC 2 Type II compliance is claimed in the footer, with a Vanta-hosted trust centre — a security posture, not a GDPR one.

Who owns the data?

Cutback Corporation keeps every intellectual property right attached to the service itself — interface, graphics, design, code and software — and grants users only a limited, non-exclusive, non-transferable licence tied to their account, which may not be sold, transferred or encumbered. Nothing in the terms claims ownership of, or a licence over, the footage you upload; but nothing explicitly confirms it stays yours either, because the contract simply never addresses customer content. On personal data, the company collects names, emails, payment details, logs, usage, device and approximate location data, discloses them to third parties only with consent or a legal basis, and deletes account data within 72 hours of termination.

Reuse rights

Customers can freely reuse what they produce from their own footage — timelines, transcripts, subtitles, exported videos — since the terms place no restriction on the commercial exploitation of that output. What is restricted is the service itself: reverse engineering, decompiling and disassembling are prohibited, as is the unauthorised reproduction, distribution, promotion or commercial use of information obtained through the service, and accounts may not be lent or transferred to anyone. On its own side, Cutback processes personal data to run the service (including automatic video editing and personalised recommendations), manage members, analyse usage, develop features, optimise recommendation models, prevent fraud, bill paid plans and send marketing that users may opt out of. It reserves the right to aggregate or de-identify personal data for analysis and research, names seven processors, and transfers member email addresses to Loops in the United States only with prior consent.

Data retention & training

Hosting summary

Cutback names Google Cloud and Amazon Web Services as the processors that run its servers, but states no region or country for either, so the jurisdiction in which uploaded footage physically sits is undisclosed. The privacy policy lists five further processors: Google (Firebase) for the member information system, Channel Corporation for customer support and sales, Toss Payments for payments in Korea, Lemon Squeezy for international payments, and Loops for email delivery. The only documented cross-border transfer concerns Loops: member email addresses are sent to the United States with prior consent, kept until the member withdraws, and refusing the transfer prevents registration altogether. Contractually, everything falls under the laws of the Republic of Korea, with exclusive jurisdiction at the company's principal place of business. Security is described in three layers — administrative plans and staff training, technical access controls with encryption of unique identifiers and anti-virus software, and physical access control to server rooms — and the footer claims SOC 2 Type II compliance with a trust centre hosted on Vanta.