Your data and your rights

Privacy Statement

Version 4 October 2026 · Draft for pre-launch legal review

This statement explains how CleanCutsLab handles personal data when you visit the website, create an account, use AI Studio, upload references, share creations, participate in the community or contact CleanCutsLab.

1. Who is responsible?

CleanCutsLab, operated by Richard Wallaart in the Netherlands, is the controller for the processing described here. The Chamber of Commerce number and formal business address will be added after registration and before live sales. Privacy questions and requests: cleancutslab@hotmail.com.

2. Data we process

• Account data, including display name, email address, authentication identifiers and privacy acknowledgement.
• AI Studio data, including prompts, model and generation settings, job status, credit transactions and generated outputs.
• Reference images, videos or audio that you upload for a generation.
• Shared-creation settings, favourites, tags and comments you choose to post.
• Community data, including forum topics, posts, reports, messages and dates.
• Download records, information requests and messages you send to CleanCutsLab.
• Technical and security data such as IP address, browser information, server logs and abuse-prevention signals.

Passwords are handled by Supabase authentication and are not visible to CleanCutsLab as readable passwords.

3. AI generation and external providers

A generation may send the prompt, settings and required references to Runway or Replicate. Certain motion-video jobs use Cloudinary temporarily to prepare a file before Replicate processes it; deletion is requested after the job. Outputs are copied to private Supabase storage. Providers may apply safety and abuse checks. Do not submit confidential material, special-category data, personal data of others or content you are not authorised to use.

4. Purposes and legal bases

• Contract: create and authenticate accounts, perform requested AI jobs, reserve and debit credits, deliver outputs, subscriptions, invoices, downloads and support.
• Legitimate interests: secure the platform, prevent fraud and abuse, investigate faults, moderate shared/community content and improve reliability, balanced against user rights.
• Legal obligation: retain required financial records, respond to lawful requests and meet tax or consumer-law duties.
• Consent: only where a separate optional feature genuinely requires it; consent can be withdrawn without affecting earlier lawful processing.

Reading this statement is an acknowledgement, not consent to all processing.

5. Recipients and international transfers

Recipients may include Supabase (account, database and storage), Stripe (checkout, subscriptions and invoices), Runway and Replicate (AI jobs), Cloudinary (temporary motion-video preparation), Cloudflare Turnstile (abuse prevention), the hosting provider and professional advisers or authorities where legally required. Some recipients may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision or appropriate safeguards such as European Commission standard contractual clauses. Current safeguard information can be requested by email.

6. Sharing and visibility

Generations and uploaded references are private by default. A finished creation becomes visible to other members only when you choose Share. Sharing options determine whether other members may download it, reuse it as a reference or comment on it. Do not share content containing personal or confidential information.

7. Retention

• Account, profile, generation history, private assets and community content: while the account or content remains active, then deleted or anonymised within a reasonable operational period unless another period applies.
• Temporary Cloudinary motion files: deletion is requested after completion or failure; provider-side residual retention is governed by the provider.
• Security, fraud, moderation and failed-job evidence: normally up to 12 months, or longer when reasonably needed for an active dispute, repeated abuse or a legal claim.
• Support correspondence: normally up to 24 months after closure.
• Invoices, payments, credit purchases and records required for tax administration: generally 7 years, or 10 years where a legally applicable EU one-stop-shop retention duty applies.
• Backups: removed through the backup cycle and not restored for ordinary use after an approved deletion request.

We review whether data remains necessary and may retain less data for a shorter period.

8. Security

Reasonable technical and organisational measures are used to protect personal data, including access controls and server-side API credentials. No internet service can guarantee absolute security. Use a unique password and never share passwords, authentication codes or API keys.

9. Your rights

You may request access, correction, deletion, restriction or portability and may object to processing based on legitimate interests. Consent can be withdrawn. We normally respond within one month; an extension permitted by law will be explained. Identity verification may be required without requesting more data than necessary. You may complain to the Dutch Data Protection Authority.

10. Automated processing

Credit reservations, job status, provider safety signals and fraud controls use automated rules. They may reject a job or temporarily restrict a feature, but CleanCutsLab does not intend to make solely automated decisions with legal or similarly significant effects. Contact us for human review of a material restriction or disputed credit debit.

11. Children, changes and contact

Accounts and paid services are intended only for people aged 18 or over. Material changes will be announced where reasonably possible. Privacy requests and security reports can be sent to the contact address above.