Privacy Policy

At cutlist, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

Information You Provide

We collect information you provide directly to us, such as:

• Account information: When you create an account, we collect your email address and password. Passwords are securely hashed and never stored in plain text.
• Profile information: You may provide additional information such as your name and profile picture.
• Payment information: When you make a purchase, our payment processor (Stripe) collects your payment card details. We do not store your full card number—only a tokenized reference and last four digits for display.
• Communications: When you contact us for support, we collect the information you provide in your messages.

Information Collected Automatically

When you use our service, we automatically collect:

• Usage data: Pages visited, features used, and actions taken within the application via PostHog analytics.
• Device information: Browser type, operating system, screen resolution, and device identifiers.
• Log data: IP address, access times, referring URLs, and error logs for debugging.

How We Use Your Information

• Provide, maintain, and improve our services
• Process purchases and provide access to purchased products and updates
• Send transactional emails (purchase confirmations, password resets, notifications) via Resend
• Respond to your comments, questions, and support requests
• Monitor and analyze trends, usage, and activities to improve the product
• Detect, investigate, and prevent fraudulent transactions or unauthorized access
• Comply with legal obligations and enforce our Terms of Service

Information Sharing

We may share your information with:

• Service providers: Stripe (payments), Supabase (auth + database), PostHog (analytics), Resend (email), and Vercel (hosting).
• Legal requirements: If required by law or in response to valid requests by public authorities.
• Business transfers: In connection with a merger, acquisition, or sale of assets.
• With your consent: When you have given us explicit permission.

We do not sell your personal information to third parties for marketing purposes.

Data Retention

• Account data: Retained while your account is active and up to 30 days after deletion for recovery.
• Purchase records: Retained for 7 years for tax and legal compliance.
• Analytics data: Aggregated and anonymized after 2 years.
• Support communications: Retained for 3 years.

Security

We implement industry-standard security measures: TLS/HTTPS encryption in transit, hashed passwords, database Row Level Security (RLS), PCI-compliant payment processing (Stripe), and regular security audits. However, no method of transmission or storage is 100% secure.

Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict processing of, or port your personal information, and to withdraw consent. EU/EEA residents have additional rights under the GDPR, including lodging a complaint with a supervisory authority. California residents have rights under the CCPA; we do not sell personal information. To exercise any of these rights, contact us at support@millroom.dev.

Cookies and Tracking

We use essential cookies (authentication, required), analytics cookies (PostHog, opt-out available), and preference cookies (e.g. dark mode). Some features may not function without essential cookies.

Children's Privacy

Our service is not directed to individuals under 16, and we do not knowingly collect their personal information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page, update the "Last updated" date, and email account holders of material changes.

Contact Us

Questions about this Privacy Policy? Contact us at support@millroom.dev.