Legal
Privacy Policy
What we collect, why, and what you can ask us to do about it.
Last updated: 22 August 2026
Draft — not yet reviewed by a lawyer. This document is a working draft written to cover the obvious ground. Before you take a single payment, have it reviewed by a lawyer qualified in Ghana, and register with the Data Protection Commission if you have not already.
What this covers
This explains what personal data we collect, why, how long we keep it, and what rights you have. It applies to the Cutline website and application.
We are the data controller. Contact details are on the contact page.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Name, email, company | Running your account | While the account is open, then 12 months |
| Password (hashed) | Authentication | While the account is open |
| Uploaded artwork | Producing your cut files | 7 days from upload, then deleted nightly |
| Generated output files | Letting you re-download | 7 days, with the job that produced them |
| Client proof links and their images | Showing a customer the cut line | 7 days, so a link cannot outlive its file |
| Job records (size, settings, timestamps) | Producing and re-downloading your cut files | 7 days — the whole record goes with the files |
| Payment records | Billing and accounting | 7 years |
| Server logs (IP, browser, pages) | Security and diagnosis | A rolling window of a few days, then overwritten |
There are no payment records today: billing is not switched on and nothing has been charged. When it is, card details will be handled by Paystack and will never reach our servers.
What we do not do
- We do not sell personal data.
- We do not use your artwork to train machine-learning models.
- We do not share your artwork with anyone outside the infrastructure needed to run the service.
- We do not run advertising trackers.
Who else processes your data
| Processor | Purpose | Where |
|---|---|---|
| Oracle Cloud Infrastructure | Application and file storage | Region on request |
| Resend | Account and support email | Region on request |
| Paystack | Card payments, once billing is switched on | Nigeria / South Africa |
Each is bound by a data processing agreement. The hosting and email regions are not stated here; ask at the address on the contact page and we will name them.
Your rights
You may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or export it. Write to the address on the contact page. The law gives us 30 days to answer a request of that kind and we will not exceed it; ordinary email is answered the same day in most cases, on weekdays.
Deleting your account removes your artwork and output files. Job and payment records are kept for the statutory period because we are required to keep them.
If you are unhappy with how we handle your data you may complain to the Data Protection Commission of Ghana.
Security
- Traffic is encrypted in transit.
- Files are stored with access restricted to your account.
- Passwords are hashed, never stored in readable form.
- Access to production systems is limited and logged.
No system is perfectly secure. If a breach affects your data we will tell you and the Data Protection Commission without undue delay.
Children
The service is for business use and not directed at children. We do not knowingly collect data from anyone under 18.
Changes
Material changes will be notified by email and shown in the application before taking effect.