Privacy Policy

1. What we collect

We collect only what we need to provide the Service and run the business.

Account information

• Name, email, hashed password (or OAuth identifier).
• Billing information handled by Stripe (we don't store card numbers).
• Team membership and role, if you're part of an Agency workspace.

Uploaded content

• Video and audio files you upload.
• Derived data produced from that content: transcripts, per-word prosody signals, take groupings, clip candidates, captions, and visual notes.

Usage data

• Feature usage, hours consumed, credits spent (aggregated for billing and product improvement).
• Basic device and browser info for security and troubleshooting.
• IP address for anti-fraud and geographic tax compliance.

2. How we use it

We use collected information to:

• Provide the Service — analyze your footage, produce scored transcripts, mine clip candidates, render outputs.
• Bill you and process payments (through Stripe).
• Notify you of important account and service events.
• Improve the product in aggregate (never using your individual footage to train models).
• Comply with legal obligations.

3. Your uploaded footage — special treatment

Your uploaded video and audio and the signals we derive from it are the most sensitive data you give us. They get stricter handling than any other data category:

• Not used for training. Not by us. Not shared for training by our sub-processors under our contracts. If a sub-processor's default policy differs, we opt out or route around it.
• Not sold, not licensed to advertisers, not commercially disclosed to third parties.
• Accessed only for support, security, or legal compulsion, and only with your permission for support cases.
• Deleted 90 days after your last account access, or on request within 30 days. Backups purge on a 60-day rolling cycle.

4. Sub-processors

To operate the Service we use the following sub-processors. Each processes only the data required for its function.

We keep a current sub-processor list. Material additions or changes are announced 30 days in advance.

5. Cookies and tracking

We use a small number of cookies. See our Cookies policy for the full list, what each does, and how to manage them.

CutFrame waitlist

Joining asks CutFrame to send launch updates and access announcements. We collect your email address and a record of your signup and the notice shown when you join. Joining does not create an account, start a paid plan, reserve a place, or guarantee access.

Your signup stops being active 180 days after you join, or sooner after we process your request to leave or retire this initial waitlist. Joining again while your signup is active does not extend that period. This initial waitlist ends when access announcements are complete or 180 days after collection opens, whichever comes first.

To leave the waitlist, email will@four28creative.com from the address you used to join and ask to be removed. You do not need a CutFrame account. To ask to join again after leaving, send a new request. Rejoining requires a verified new request and agreement to the current waitlist notice. Resending an old signup request does not add you back.

After removal or expiry, we retain limited protected references to honor requests to leave and prevent old signup requests from adding you back. We do not use these references to send updates. We keep them until this intake is permanently retired and retained copies can no longer restore the list.

Removal from the active list does not mean immediate deletion from every stored copy or backup. We keep restored copies closed to signup and sending until requests to leave have been reconciled.

This subsection applies to the waitlist. The separate account, billing and uploaded-footage retention terms do not set the retention period for waitlist records.

6. Retention and deletion

For waitlist records, see CutFrame waitlist above. The periods below apply to the separate account, billing, support and footage categories.

• Uploaded footage and derived signals: 90 days after your last account access, or 30 days after an explicit deletion request. Backups purge within 60 days of primary deletion.
• Account records and billing history: retained as long as required for tax and accounting purposes (typically 7 years in the US).
• Support tickets: 2 years after resolution.
• Anonymized aggregate usage stats: retained indefinitely.

7. Security

We employ industry-standard measures to protect your data:

• TLS 1.2+ encryption for all data in transit.
• AES-256 (or equivalent) encryption for stored footage and derived data.
• Hashed password storage (bcrypt/argon2). We never store plaintext passwords.
• Least-privilege access controls for our team; no ambient production access.
• Optional two-factor authentication on your account.
• Regular security reviews and dependency patching.

No system is perfectly secure. If we ever detect a breach that affects you, we will notify you within 72 hours in accordance with applicable law.

8. Your rights (GDPR, CCPA)

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Port your data to another service.
• Object to or restrict certain processing.
• Opt out of "sale" of personal information (we do not sell personal information under any interpretation, but you can confirm this election).
• Lodge a complaint with your local data protection authority.

You can exercise most of these rights directly from your account dashboard. For anything else, contact us.

9. Children

The Service is not directed to children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect data from children. If you believe we have, contact us immediately and we will delete it.

10. International transfers

We are based in the United States. If you are outside the US, your information will be transferred to and processed in the US or in other countries where our sub-processors operate. We rely on standard contractual clauses and other lawful transfer mechanisms as applicable.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email or in-app notice at least 15 days in advance.

12. Contact

Questions? Reach us at will@four28creative.com.