Privacy Policy

This Privacy Policy explains what CutoutBG AI ("we", "us" or "our") collects when you use cutoutbg.ai (the "Service"), why we collect it, who we share it with, how long we keep it and the choices you have. It applies to visitors, people who use the Service without an account, and account holders. If you do not agree with this policy, please do not use the Service. Questions go to [email protected].

The short version

• We process the images you upload only to produce the result you asked for. They are never used to train a model.
• Files from free use are deleted after 7 days, files from paying accounts after 180 days, and you can delete a result sooner yourself.
• We do not sell your personal information.
• Card details are entered on Stripe's page and never reach our servers.
• To stop the free allowance being abused, we use cookies, a browser fingerprint and your IP address.

Information we collect

Images and the files we create from them

When you upload an image we store the file, its file name and its technical details, such as pixel dimensions, format, file size and whether it contains transparency. We then store the result: the cutout itself and, when you pick a blurred or replaced background, the composited file. We also record the job: the background option you chose, the token it cost, when it ran and whether it succeeded. Producing a cutout means sending the image to the AI provider named under "How we share information".

Account information

Accounts are created by signing in with Google. Google shares your email address, your name and your profile picture with us, and we use them to create your account, show you who is signed in and answer support requests. We never receive your Google password.

Using the Service without an account

When you pick a file without being signed in, we create a guest account for your browser so that your free daily tokens and your results stay with you. It is identified by a session cookie. If you later sign in with Google, your guest results move into your account.

Payment information

Plans and token packs are paid on a checkout page hosted by Stripe. Stripe collects your card or wallet details; we receive only what we need to run your purchase: a Stripe customer reference, the product you bought, the amount, the currency, the payment status and the dates of your billing period.

Device, usage and anti-abuse data

We collect some information automatically when you use the Service:

• Technical data: IP address, browser type and version, operating system, and the pages and requests your browser makes, which are recorded in our server logs.
• Browser fingerprint: an identifier calculated in your browser from its configuration by an open-source library. It is stored in a cookie for 30 days and sent to us when a guest account is created, so that the same browser cannot keep opening new accounts for extra free tokens. Nothing is sent to the library's maker.
• Security checks: if we see unusual activity, we may ask you to complete a Cloudflare Turnstile check, which collects signals from your browser to tell people from bots.
• Analytics: Google Analytics records how pages are used (pages viewed, time on page, approximate location, device and referring site) and whether key steps such as a purchase happened.

Messages you send us

If you email us, we keep your email address, the message and any attachments so that we can reply and keep a record of the request.

How we use your information

• To remove backgrounds from your images and let you preview and download the results
• To create your account, keep you signed in and keep your results available until they are deleted
• To give out and meter tokens, including the free daily allowance
• To process payments, renew or cancel plans, and handle refunds and chargebacks
• To prevent abuse of the free allowance, fraud, and attacks on the Service
• To answer support requests and send messages about your account or purchases
• To understand how the Service is used and fix problems, using analytics and error logs
• To meet legal, tax and accounting obligations and enforce our Terms of Service

Your images are never used to train a model. They are not reviewed by people as part of normal operation; staff open a file only when you ask for help with a specific job, when needed to investigate abuse or a legal complaint, or when the law requires it.

Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Performance of a contract: processing your images, running your account, metering tokens and handling payments.
• Legitimate interests: preventing abuse and fraud, keeping the Service secure, and understanding how it is used so we can improve it. We weigh these interests against your rights.
• Legal obligation: keeping payment and tax records and responding to lawful requests.
• Consent: where the law requires it for cookies or similar technologies. You can withdraw consent at any time.

Cookies and similar technologies

• Session cookie: keeps you signed in, or keeps your guest account attached to your browser. Strictly necessary.
• Visitor ID cookie: holds the browser fingerprint described above for 30 days. Used only to prevent abuse of the free allowance.
• Local storage: keeps a copy of the same visitor ID in your browser.
• Google Analytics cookies: measure visits and usage. See how Google uses this data at policies.google.com/technologies/partner-sites.
• Google sign-in and Cloudflare Turnstile: these services may set their own cookies when you use them.

You can block or delete cookies in your browser settings. If you block the session cookie, you will not be able to sign in or use the free allowance. You can opt out of Google Analytics with Google's browser add-on.

How we share information

We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising. We share it only in these cases:

• Service providers that work on our behalf under contract and only on our instructions: GoEnhance AI, which runs the background-removal model on the images you upload; cloud hosting providers; Cloudflare (content delivery, file storage and Turnstile); Stripe (payments); and Google (sign-in and analytics).
• Legal requirements: when we must comply with a law, court order or valid request from a public authority.
• Safety and rights: to investigate fraud or abuse, or to protect the rights, property or safety of our users, the public or us. Content that appears to show child sexual abuse is reported to the relevant authorities.
• Business transfers: as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.
• With your consent for any other purpose we tell you about first.

How long we keep information

• Uploaded images and results: deleted 7 days after the job for guests and free accounts, and 180 days after the job for accounts with a plan or a token pack. An upload that never becomes a job is deleted within about 24 hours. You can delete a result from your history at any time, which removes its files straight away.
• Job records (background option, image size, tokens, status, no image content): kept while your account exists, so your token balance and purchases can be checked.
• Account information: kept until you ask us to delete your account.
• Payment and invoice records: kept for as long as tax and accounting law requires, even after the account is deleted.
• Anti-abuse data: IP-based counters expire within a day; fingerprint-based counters within 30 days.
• Server logs and support emails: kept only as long as needed for security, troubleshooting and handling your request.

A deleted file can stay in content delivery caches for a short time afterwards. Download anything you want to keep before it expires.

How we protect information

All traffic to the Service uses HTTPS. Images are stored under random file names that cannot be guessed, and the Service shows their links only to the account that created them; anyone you pass a link to can open the file, so share download links with care. Access to production systems is limited to the people who need it, and payment notifications from Stripe are verified with signatures. No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security, but we will notify you and the relevant authorities of a breach where the law requires it.

Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your information and your account
• Receive a copy of your information in a portable format
• Object to or ask us to restrict certain processing
• Withdraw consent where we rely on it
• Complain to your local data protection authority

You can delete individual results yourself from your history. For everything else, email [email protected] from the address on your account. We may need to confirm your identity before acting, and we will reply within 30 days. We will not treat you differently for exercising these rights. California residents have these rights under the CCPA; we do not sell or share personal information as those terms are defined there.

Age requirement (18+)

The Service is only for people who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a minor has used the Service, please contact [email protected].

International data transfers

We and our service providers process information in several countries, which may include the United States and other countries outside the one you live in. Their data protection laws may differ from yours. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

Third-party links and services

The Service links to other websites and uses Google sign-in and Stripe checkout. Those companies handle the data you give them under their own privacy policies, which we encourage you to read. We are not responsible for their practices.

Changes to this Privacy Policy

We may update this policy as the Service or the law changes. We will post the new version on this page and change the "Last updated" date. If a change materially affects how we use your personal information, we will also tell account holders by email or on the Service before it takes effect.

Contact us

For questions about this policy or to exercise your rights, email [email protected]. You can also read our Terms of Service and Refund Policy.