Cutano Privacy Policy

Last Updated: July 31, 2026

Effective Date: July 31, 2026

Cutano ("the App," "we," "us," or "our") is a photo cutout and editing application developed and operated by an individual developer. This Privacy Policy explains how we handle information in connection with your use of the App. It applies to all users worldwide, including users in the European Economic Area (EEA), United Kingdom, United States, Japan, South Korea, and Southeast Asian countries.

By downloading, accessing, or using Cutano, you acknowledge that you have read and understood this Privacy Policy.

1. Our Privacy Commitment: Local-First Architecture

Cutano is designed with a privacy-by-design approach. The App's core image processing functionality — including AI-powered cutout, background replacement, batch processing, and product showcase image creation — operates entirely through an on-device AI model. This means:

• All images you import and edit are processed exclusively on your device;
• No images, photos, or editing data are ever uploaded to, transmitted to, or stored on any remote server;
• We do not collect, store, or process any personal data about you on our servers;
• We do not employ any third-party analytics SDKs, advertising frameworks, or user-tracking technologies.

In essence, we do not collect your personal data. The information you create and edit within the App remains solely on your device under your control.

2. Apple Sign-In and Registration

The App supports sign-in with Apple ID. When you sign in with Apple, we collect your Apple ID identifier (a unique user identifier provided by Apple), avatar, and nickname (if you authorize), to create and associate your App account and to process your subscription and membership entitlements. Payment-related information is processed directly by Apple Inc. We do not access or store any of your sensitive payment information.

3. Information We Do NOT Collect

To be transparent and explicit, we do not collect:

• Personal identifiers (name, email address, phone number, government ID numbers);
• Device identifiers (IDFA, IDFV, advertising IDs);
• IP addresses or network location data;
• Geolocation or GPS data;
• Browsing history, usage analytics, or behavioral data;
• Contacts, calendar data, or health information;
• Biometric data or facial recognition templates (the on-device AI model processes pixel data for segmentation purposes only and does not create, store, or transmit any biometric identifiers);
• Clipboard contents or keystroke data.

4. Information Processed On-Device

The following data processing occurs locally on your device and never leaves your device:

• Photo Library Access: When you choose to import an image, the App requests permission to access your photo library. We access only the specific images you select. We do not scan, index, catalog, or transmit any other content in your library.
• On-Device Processing Data: Intermediate computational data generated during AI model inference exists only in device memory (RAM) and is released immediately upon completion. It is never written to persistent storage or transmitted.

5. Subscription and Payment Information

Cutano offers a premium membership subscription through Apple's App Store and StoreKit framework.

• All payment transactions are processed entirely by Apple Inc. We do not receive, access, or store any payment information (credit card numbers, Apple ID credentials, billing addresses).
• Apple's processing of your payment data is governed by Apple's Privacy Policy: https://www.apple.com/legal/privacy/
• We may receive limited subscription status information from Apple's Server-to-Server Notifications (e.g., whether a subscription is active, expired, or refunded). This information does not include payment details and is used solely to verify your entitlement to premium features.

6. Crash Reports (Optional)

If you have enabled "Share with App Developers" in your device settings (Settings > Privacy & Security > Analytics & Improvements), Apple may provide us with anonymized crash and diagnostic logs. These logs do not contain personal data and are used exclusively to identify and fix software defects. You may disable this sharing at any time in your device settings.

7. Legal Bases for Processing (EEA/UK — GDPR)

For users in the European Economic Area and United Kingdom, to the extent any processing of personal data occurs (limited to subscription verification and optional crash logs), we rely on the following legal bases under the General Data Protection Regulation (EU) 2016/679 and UK GDPR:

• Performance of a contract (Article 6(1)(b)): Verifying your subscription status to provide paid features;
• Legitimate interests (Article 6(1)(f)): Analyzing anonymized crash data to improve App stability and security;
• Legal obligation (Article 6(1)(c)): Compliance with applicable legal requirements.

Since we do not collect personal data through the App's core functionality, no consent-based processing is required for the primary features.

8.1 Detailed Data Subject Rights Under GDPR (Articles 15–22)

For users in the EEA/UK, in addition to the rights listed in Section 8 above, you also have the following specific rights under the GDPR:

• Right to access (Article 15): You may request confirmation as to whether personal data concerning you is being processed, and if so, access to that data including purposes, categories, recipients, retention period, and source of the data;
• Right to rectification (Article 16): You may request correction of inaccurate personal data and completion of incomplete personal data;
• Right to erasure ("right to be forgotten") (Article 17): You may request deletion of your personal data where grounds such as withdrawal of consent, unlawful processing, or legal obligation apply;
• Right to restriction of processing (Article 18): You may request limitation of processing where accuracy is contested, processing is unlawful but erasure is objected to, or we no longer need the data but you require it for legal claims;
• Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller;
• Right to object (Article 21): You have the right to object at any time to processing based on legitimate interests or public interest, including profiling directly related to such processing;
• Rights related to automated decision-making and profiling (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

Given that we do not collect personal data through the App's core functionality, these rights are inherently satisfied. For subscription-related data held by Apple, please direct your requests to Apple using their designated privacy channels.

8.2 EEA/UK Data Protection Contact

For users in the European Economic Area and United Kingdom:

• Designated contact for data protection inquiries: ppdd2012@outlook.com
• Legal basis: As an individual developer not established within the EEA/UK who does not regularly process personal data on a large scale and does not offer goods or services specifically to EU/EEA/UK users (the App is available globally via Apple's platforms, and all payment processing is handled by Apple as merchant of record), we are not required to appoint a representative under Article 27 of the UK GDPR / EU GDPR. However, this email address serves as our designated point of contact for all data protection inquiries;
• Consent mechanisms: Where consent is required as a legal basis for processing (not applicable to the App's core features but potentially applicable to future optional features), we will obtain explicit, informed, and freely given consent via an opt-in mechanism before any such processing begins. Consent may be withdrawn at any time with the same ease as it was given.

8. Your Rights Under GDPR (EEA/UK Users)

If you are located in the EEA or UK, you have the following rights under applicable data protection law:

• Right of access: To request information about any personal data we process about you;
• Right to rectification: To request correction of inaccurate data;
• Right to erasure: To request deletion of your data;
• Right to restrict processing: To request limitation of processing;
• Right to data portability: To receive your data in a structured format;
• Right to object: To object to processing based on legitimate interests;
• Right to lodge a complaint: To file a complaint with your local data protection supervisory authority.

Given that we do not collect personal data through the App, most of these rights are inherently satisfied. To the extent any data exists (e.g., subscription records held by Apple), please direct your requests to Apple. You may contact us using the details in Section 20 for any questions.

9. California and U.S. Privacy Rights

9.1 California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

For California residents: We do not collect, sell, share, or disclose personal information as defined by the CCPA/CPRA. Specifically:

• We do not sell personal information;
• We do not share personal information for cross-context behavioral advertising;
• We do not collect sensitive personal information;
• We have not collected any categories of personal information about consumers in the preceding 12 months through the App's core functionality.

You have the right to be free from discrimination for exercising any privacy rights.

9.2 Other U.S. State Laws

For residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy legislation: Our data practices as described in this policy mean that the substantive rights under these laws (access, deletion, correction, opt-out) are inherently satisfied, as we do not process personal data through the App.

10. Japan — Act on the Protection of Personal Information (APPI)

For users in Japan:

• We do not acquire, retain, or utilize personal information (個人情報) as defined under the APPI through the App's core functionality;
• The on-device AI processing does not constitute acquisition of personal information, as data never leaves the user's device and is never recorded in any retrievable form by us;
• To the extent subscription verification data is processed, it is handled by Apple as the payment processor;
• We do not provide personal data to third parties (第三者提供);
• We do not use personal information for profiling or automated decision-making.

If you have inquiries regarding our handling of personal information under the APPI, please contact us as described in Section 20.

11. South Korea — Personal Information Protection Act (PIPA)

For users in South Korea:

• We do not collect or process personal information (개인정보) as defined under PIPA through the App's core features;
• No personal information is collected, stored, or transmitted to servers;
• The on-device processing model means that no personal information items (항목) are collected, and no collection purpose (수집 목적) applies to our operations;
• Subscription payment processing is handled by Apple under its own PIPA-compliant policies;
• We do not entrust (위탁) or provide (제공) personal information to any third party;
• We do not process unique identification information (주민등록번호) or sensitive information (고유식별정보).

Korean users retain all rights under PIPA Articles 4, 35–39 (right to access, rectify, delete, and suspend processing). Since we hold no personal data, these rights are inherently fulfilled.

12. Southeast Asia — Regional Compliance

For users in Southeast Asian jurisdictions:

Singapore (PDPA)

We do not collect, use, or disclose personal data as defined under the Personal Data Protection Act 2012. The Do Not Call provisions are not applicable as we do not engage in marketing communications.

Thailand (PDPA)

We do not collect or process personal data as defined under the Personal Data Protection Act B.E. 2562 (2019). No legal basis for processing is required as no collection occurs.

Indonesia (PDP Law)

We do not collect or process personal data (Data Pribadi) as defined under Law No. 27 of 2022 on Personal Data Protection.

Vietnam (PDPD)

We do not collect or process personal data as defined under Decree 13/2023/ND-CP on Personal Data Protection.

Philippines (DPA)

We do not collect or process personal information as defined under the Data Privacy Act of 2012 (Republic Act No. 10173).

Malaysia (PDPA 2010)

We do not process personal data as defined under the Personal Data Protection Act 2010. As a non-Malaysia-based data processor, we are not required to appoint a Principal Data Protector (PDP) under Section 29 of the PDPA 2010; however, for any data protection inquiries from Malaysian users, please contact us at ppdd2012@outlook.com.

For all Southeast Asian users: Since the App processes images entirely on-device and we do not operate servers that receive or store user data, the substantive obligations under these laws (consent, purpose limitation, notification, access/correction rights) are inherently satisfied by our architecture.

13. Children's Privacy

The App is not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction, such as 16 in certain EU member states). We do not knowingly collect personal information from children. Since we do not collect personal information from any user, this commitment is inherently maintained. If you believe a child has provided information through the App, please contact us and we will take appropriate action.

For EEA/UK users: The App is not directed at children under 16. No parental consent mechanism is required as no personal data is collected.

For U.S. users: The App complies with the Children's Online Privacy Protection Act (COPPA) by virtue of not collecting any personal information from children.

14. Data Retention and Security

• We do not retain any personal data on servers, as none is collected;
• All images and editing outputs are stored locally on your device and are subject to your device's security settings;
• The App implements a screen-capture protection mechanism that prevents unauthorized screenshots of the App interface. This is a security measure to protect your creative work and does not involve collection of any data;
• We are not responsible for data loss resulting from device failure, operating system resets, App uninstallation, or other factors beyond our control. We recommend regularly exporting important work to your photo library or external storage.
• Security Measures: We implement reasonable technical and organizational measures to protect your information, including encryption of data in transit, anonymization of sensitive data, and strict access control mechanisms to ensure that only authorized personnel can access relevant information, with periodic security audits.
• Security Incident Response: We have established an information security incident response plan. In the event of a security incident (such as data breach or loss), we will promptly notify you of the incident, remedial measures, and mitigation advice as required by applicable law; where individual notification is disproportionate, we will issue a public notice through reasonable and effective means. We will also report the incident to the relevant regulatory authorities as required.

15. International Data Transfers

Since we do not collect or store personal data on any server, no cross-border data transfers occur. Your images and data never leave your device. This section is included for completeness: in the event we introduce any server-based features in the future that involve personal data, we will update this policy and implement appropriate safeguards (such as Standard Contractual Clauses for EEA/UK transfers, or equivalent mechanisms for other jurisdictions) before any such transfer takes place.

16. Third-Party Services

The App integrates with the following third-party services:

• Apple App Store / StoreKit: For App distribution, subscription purchases, and entitlement verification. During this process, Apple processes information such as your subscription status, transaction identifiers, and purchase dates. This information does not include your payment details or personal identity information. Apple acts as an independent data controller for payment and account data. Apple's Privacy Policy: https://www.apple.com/legal/privacy/

The App does not integrate any other third-party SDKs, advertising networks, social media plugins, or analytics services.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Last Updated" date at the top of this policy and, where appropriate, provide in-App notice. Your continued use of the App after the effective date of a revised policy constitutes acceptance of the changes. We will not reduce your rights under this Privacy Policy without your explicit consent.

18. Disclaimers and Limitation of Liability

• The App's AI-powered cutout, background replacement, product showcase image generation, and other editing features are provided "as is" and "as available" without warranties of any kind, whether express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement;
• We do not guarantee that the output of AI processing will meet your specific requirements or expectations. Results are provided for creative and auxiliary purposes only;
• User Content: You are solely responsible for ensuring that any images you import and process do not infringe upon the portrait rights, copyright, publicity rights, or other rights of third parties. We assume no liability for user-generated content or the manner in which you use the App's output;
• Device Compatibility: We do not warrant that the App will function without interruption or error on all devices or operating system versions. We are not liable for data loss or functional issues arising from device incompatibility, operating system updates, or force majeure events;
• To the maximum extent permitted by applicable law, our total aggregate liability for any claim arising from your use of the App shall not exceed the amount you paid for the App or subscription in the twelve (12) months preceding the claim.

18.5 EU Digital Services Act (DSA) Compliance

For users in the European Union, pursuant to the Digital Services Act (Regulation (EU) 2022/2065), we provide the following contact information:

• Service provider: Cutano Developer (individual developer);
• Contact email: ppdd2012@outlook.com;
• Website: https://cutora.cn;
• Merchant of record: All subscription purchases are processed by Apple Inc., which acts as the independent trader for in-app purchase transactions. Billing-related inquiries should be directed to Apple's support channels.

19. Governing Law and Dispute Resolution

This Privacy Policy shall be governed by and construed in accordance with the laws of the People's Republic of China, without regard to its conflict of law provisions. Any dispute arising from or in connection with this Policy shall first be resolved through friendly negotiation. If negotiation fails, either party may submit the dispute to the competent court at our domicile.

For EU/EEA consumers: Nothing in this clause deprives you of the protection afforded by mandatory provisions of the law of your country of habitual residence, or your right to bring proceedings before the courts of your domicile.

For Korean consumers: Disputes shall be subject to the jurisdiction of the court designated under Korean Civil Procedure Act, and mandatory consumer protections under Korean law shall apply.

20. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data practices, please contact us:

• Website: https://cutora.cn
• Email: ppdd2012@outlook.com

We will respond to your inquiry within 20 working days of receipt (or within the shorter timeframe required by applicable law in your jurisdiction). For complaints, we will review the matter as soon as possible and provide a timely response after verifying your identity.

For EEA/UK users: You also have the right to lodge a complaint with your local data protection supervisory authority at any time.

For Korean users: You may also contact the Korea Internet & Security Agency (KISA) Privacy Center (privacy.kisa.or.kr / 118) for privacy-related consultations.

For Japanese users: You may also contact the Personal Information Protection Commission (PPC) for guidance (https://www.ppc.go.jp/).

This Privacy Policy is provided in English. In the event of any conflict between this English version and any translated version, this English version shall prevail to the extent permitted by applicable law.