This policy explains what Cutter Canvas (“we”, “us”) collects when
you use cuttercanvas.com, why, and what you can do
about it. Cutter Canvas is operated by Charles Ostman, a sole proprietor, at 625 Bluegrass
Dr, Wheaton, IL 60189, United States.
What we collect
Google account details. If you sign in, we receive your Google account
identifier, name, email address, and profile picture from Google. We do not receive your
password, and we only accept accounts whose email address Google has verified. Signing in
is optional — building shapes and exporting STL files works without an account.
Designs you save. Cutter outlines, geometry settings, generated images,
prompts, and tags you choose to save, stored against your account.
Prompts and images you submit to AI features. Text prompts, uploaded
photos, and reference images are sent to Google's Gemini API to generate a result.
Order details. For printed cutters: the model file, your shipping name and
address, and your email. Card details go directly to Stripe — we never see or store
them.
Analytics. Which page and tool you used, the browser you used it in, and
where you arrived from. This covers Google Analytics 4 and our own usage records, kept in
our Google Cloud account.
If you are in the UK, EU, or EEA, we collect none of it until you accept
the prompt shown on your first visit. Until you do, Google Analytics is loaded in a state
where it cannot store anything on your device or identify you, and our own usage records
are off entirely.
Everywhere else, analytics is on by default and you can turn it off at
any time using the control under “Your choices” below. We also honour the
Global Privacy Control signal if your browser sends one. The app works identically either
way.
Advertising measurement. If you reached us from a Google ad, we measure
whether that ad led to a purchase. Outside the UK, EU, and EEA this uses Google’s
advertising cookies, which are on only while analytics is on and go off with it. We do
not use them for personalised advertising or remarketing, and we do not
build advertising audiences from what you do here. In the UK, EU, and EEA they are off
entirely, and accepting the analytics prompt does not turn them on.
Transaction records. Purchases and credit activity (what you bought, what
it cost, credits spent and refunded) are kept as business records whether or not you
accept analytics. We need them to run accounts, honour refunds, and meet tax and
accounting obligations.
Email list. If you enter your email address to hear about new shapes and
guides, we store that address, the date, and which page you entered it on. Nothing else,
and only if you type it in - signing in or ordering does not add you.
Server logs. Standard request logs, including IP address, retained for
security and debugging for 30 days.
Abuse-prevention counters. To stop automated sign-in attempts, checkout
spam and mass newsletter signups, we count recent requests against the IP address they
came from. These counters hold a request count and a timestamp — no name, no email,
nothing about what was requested — and are deleted automatically within a few hours.
Why we use it
To provide the app: generating designs, saving your work, fulfilling print orders.
To take payment and prevent fraud and abuse, including limiting free credit grants.
To understand which features are used, unless you have turned analytics off.
To measure whether an ad we paid for led to a purchase, unless you have turned analytics
off or are in the UK, EU, or EEA.
To respond when you contact support.
Where the UK or EU GDPR applies, our lawful bases are performance of a contract (providing
the app and fulfilling orders), legal obligation (keeping transaction records for tax and
accounting), legitimate interests (security and abuse prevention), and consent (analytics
only, which you may withdraw at any time). Outside the UK and EEA we rely on our legitimate
interest in understanding which features are used, and you may opt out at any time.
Who we share it with
We do not sell your personal information. We share it only with providers that run the service:
Google Cloud — hosting, database storage, and the analytics and transaction records described above.
Google Gemini API — processes prompts and images you submit to AI features.
Google Identity — sign-in.
Google Analytics — usage analytics, unless you have turned it off
(and, in the UK/EEA, only if you accepted).
Google Ads — measures whether an ad led to a purchase. Outside the
UK/EEA only, and only while analytics is on.
Stripe — payment processing; Stripe is an independent controller for your payment data.
How long we keep it
Saved designs stay until you delete them or close your account. Order records are kept for
7 years to meet tax and accounting obligations — if you close your account first, they
are stripped of your name, email and address and kept only as anonymous figures. Server logs
are kept for 30 days, and backups for 30 days on a rolling basis.
Checkouts that are started but never paid for are deleted in two stages. The order itself
— your shipping name, address and email — is deleted automatically within 24
hours. The files attached to it, meaning the model and any reference photograph you
uploaded, are deleted within 30 days. The gap is deliberate: if a payment succeeds but the
step that files the order away fails, the longer window is what lets us still find your
model and send you the cutter you paid for, rather than losing the order to a tidy-up.
Email list entries are kept until you ask us to remove you, or until you close your account
— closing your account removes your address from the list as well.
Closing your account also leaves one anonymous marker recording that the Google account had
already claimed its free signup credits, so the bonus cannot be claimed repeatedly by
deleting and re-registering. It holds nothing else — no name, no email, no history.
Full details.
Your choices
Your choice is stored in this browser, so it applies to this browser on this device. It
takes effect the next time the app loads.
Delete any saved design from the app at any time.
Delete your whole account yourself, from your profile in the app —
no request, no waiting. See Delete your account for exactly
what is removed and the two anonymous records that are kept.
Download everything we hold about you as a single file, from the same
place in your profile.
Turn analytics on or off with the control above, at any time and as easily either way. If
your browser has JavaScript disabled, clearing this site’s data has the same effect.
Request access to, correction of, or deletion of your information, request a copy in a
portable format, or object to processing, by emailing
support@cuttercanvas.com. We respond within
2 business days and complete requests within 30 days.
If you are in the UK or EU and are unhappy with our response, you may complain to your
local supervisory authority.
Where your data is stored
We operate from the United States, and all data is stored in Google Cloud's
us-west1 region (Oregon, USA). Print orders ship to US addresses only, and
we do not currently sell AI credits in the UK, EU, or EEA. The rest of the app is available
anywhere — so if you are in the UK or EU, using this service still means your
information is processed in the United States. Our providers (Google
Cloud, Stripe) rely on the UK/EU Standard Contractual Clauses and the EU–US Data
Privacy Framework for their own processing.
Children
Cutter Canvas is not directed at children under 13, and we do not knowingly collect their
information. If you believe a child has given us personal data, email us and we will delete
it.
Changes
We will update the date at the top when this policy changes, and give notice in the app for
material changes.