Privacy Policy

1Who is responsible#

The controller under Article 4 (7) GDPR for this website and for Cut Remove Done is:

We have not appointed a data protection officer because the law does not require one for a business of our size (Article 37 GDPR, section 38 BDSG). For anything about your data, write to the email address above. More details are in our imprint.

2What is live and what is planned#

Cut Remove Done is new, and some parts are still being built. We want this policy to match reality, so each section below is marked:

• Live now applies today.
• Once offered applies only once that feature launches. We will update this policy before launch if anything changes.

3Visiting the website#

Live now

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that Vercel needs to deliver it: your IP address, the date and time, the page and files requested, the referring page, your browser and operating system, and the response status. Vercel processes this data on our behalf and keeps it in short-lived server logs for security, abuse prevention and troubleshooting. We do not combine it with other data or use it to identify you.

Legal basis: Article 6 (1) (f) GDPR. Our legitimate interest is delivering a secure, working website. Reading this data from your device is technically necessary for the service you asked for (section 25 (2) no. 2 TDDDG).

Fonts: our fonts (Inter and Geist Mono) are bundled with the site and served by Vercel. Your browser does not connect to Google Fonts.

Analytics: we use no analytics, advertising or tracking tools. If we ever add privacy-friendly analytics, we will update this policy first and ask for consent where the law requires it.

4Removing backgrounds in your browser#

Live now

When you remove a background on our website, the image is decoded and processed by an AI model that runs on your own device, in your browser. Your image is not uploaded to us or anyone else. The result is created on your device and only leaves it if you download or share it.

To run the model, your browser downloads these files the first time you use the editor:

• Model weights (BiRefNet lite, about 115 to 225 MB) from Hugging Face, Inc., 20 Jay Street, Suite 620, Brooklyn, NY 11201, USA (privacy policy).
• Runtime files (ONNX Runtime Web) from the jsDelivr open-source CDN (privacy policy).

These providers receive your IP address and normal browser request data, as with any download. They do not receive your images. Data may be processed in the USA. We have no data processing agreement with them because they act on their own behalf when serving public files.

Legal basis: Article 6 (1) (f) GDPR. Our legitimate interest is offering free, private background removal that does not need your images on our servers. The model files are cached on your device so you don't have to download them again. Details are on our cookies and storage page.

Import from a link: if you paste an image URL, your browser fetches the image directly from that address. We don't see the URL or the image.

5When you contact us#

Live now

If you email us, we process your email address, your name if you give it, and the content of your message to answer you. Legal basis: Article 6 (1) (b) GDPR when your message is about a contract or a request before one, otherwise Article 6 (1) (f) GDPR, our legitimate interest in answering enquiries.

We delete the correspondence once your request is settled, unless we have to keep it longer. Messages that relate to a contract or invoice are kept for the periods set by tax and commercial law (see retention). Otherwise we keep them for up to three years for follow-up questions, matching the general limitation period under section 195 BGB.

6Accounts and sign-in#

Once offered

The sign-in and sign-up pages on our website are previews. They do not send or store anything yet. Once accounts launch, we will process your email address, your name if you add it, a securely hashed password or a sign-in link, your settings, plan and credit balance, and security logs such as sign-in times and IP addresses.

Account data will be stored in a database run by Turso (ChiselStrike, Inc., USA) as our processor, in an EU location where available. Legal basis: Article 6 (1) (b) GDPR, as it is needed to provide your account. Security logs: Article 6 (1) (f) GDPR, our interest in protecting accounts from misuse.

We keep account data while your account exists and delete it within 30 days after you close it, unless we must keep billing records longer.

7Cloud HD removal and the API#

Once offered

Once cloud HD and the API launch, images you send to them will be processed on Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as our processor (Cloudflare Workers and R2 storage). We will process:

• the image you upload and the result, deleted automatically within 1 hour;
• your API keys and the settings of each request;
• usage records (time, endpoint, image size, credits used, result status), kept for 12 months for billing, support and abuse prevention.

Images may show people. We process them only to remove the background you asked for. We do not look at them, analyse who is in them, or use them to train AI models unless you clearly opt in first. You can withdraw that opt-in at any time.

Legal basis: Article 6 (1) (b) GDPR for processing your requests, Article 6 (1) (f) GDPR for abuse prevention. If you send us images of other people, you are responsible for having a legal basis to do so.

8Payments and invoices#

Once offered

Once paid plans and credit packs launch, payments will be handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter card or other payment details directly with Stripe. We never see your full card number. We receive your name, email, billing address, country, VAT ID if you give one, the products bought and the payment status.

Stripe acts as our processor for payment processing and as an independent controller for its own legal duties, such as fraud prevention and anti-money laundering checks. See Stripe's privacy policy.

Legal basis: Article 6 (1) (b) GDPR for processing your order, Article 6 (1) (c) GDPR for keeping invoices and records required by tax and commercial law, and Article 6 (1) (f) GDPR for fraud prevention.

9Service emails#

Once offered

Once accounts launch, we will send emails you need, such as sign-in links, receipts and important service notices, through Resend (Plus Five Five, Inc., USA) as our processor. Resend processes your email address, the message and delivery data such as bounces.

Legal basis: Article 6 (1) (b) GDPR. We don't send newsletters. If we ever offer one, we will only send it with your consent (Article 6 (1) (a) GDPR), and you can unsubscribe with one click.

10Service providers we use#

We only share personal data with providers who help us run Cut Remove Done. Processors may only use the data on our instructions and under a data processing agreement (Article 28 GDPR).

We may also disclose data to authorities if the law requires it, for example to tax offices.

11Transfers outside the EU#

Some providers above are based in the USA or may process data there. For US providers certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR). Where a provider is not certified, or as an additional safeguard, we rely on the EU Standard Contractual Clauses (Article 46 (2) (c) GDPR) in the provider's data processing agreement.

Hugging Face and jsDelivr serve public files on their own responsibility. When your browser downloads the model, it connects to them directly. You can check a provider's certification on the Data Privacy Framework list. Ask us if you want a copy of the safeguards we rely on.

12How long we keep data#

13Your rights#

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (Article 15);
• have incorrect data corrected (Article 16);
• have your data deleted (Article 17);
• restrict how we process it (Article 18);
• receive your data in a common, machine-readable format (Article 20);
• withdraw any consent at any time, with effect for the future (Article 7 (3)).

To use any of these rights, email contact@vexorisdev.com. We answer within one month. We may ask you to confirm your identity first.

Right to lodge a complaint

You can complain to any data protection supervisory authority (Article 77 GDPR), for example in the EU country where you live or work. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany (www.ldi.nrw.de).

14Do you have to give us data?#

You can use the in-browser tool without giving us any personal data. For accounts and paid plans, once offered, we need your email address and the details required for billing, otherwise we cannot provide them. We do not make decisions about you based solely on automated processing, including profiling, as described in Article 22 GDPR.

15Children#

Cut Remove Done is not aimed at children under 16. We do not knowingly collect data from them. If you think a child has given us personal data, please tell us and we will delete it.

16Security#

All connections to our website use TLS encryption. In-browser processing means your images never travel to us in the first place. For features that launch later, we limit access to personal data to what is needed, encrypt data in transit and at rest with our providers, and delete it on the schedule above.

17Changes to this policy#

We will update this policy when we launch new features or the law changes. The date at the top shows the latest version. If a change affects you in a meaningful way and we have your email address, we will tell you in advance.