Privacy Notice

1. Who we are

CutCulator is operated by TUVOTECH PTY LTD ("TUVOTECH", "we", "us"), trading as CutCulator. TUVOTECH PTY LTD is the data controller for the personal data described in this notice — we decide what data is collected and why. You can reach us about anything in this notice at privacy@cutculator.com.

2. Personal data we collect and why

• Account data (name, email address, login credentials, authentication identifiers) — to create and secure your account and let you sign in. Legal basis: performance of our contract with you.
• Business profile data (business name, address, VAT/registration details, logo, banking details you choose to store) — to generate your quotes, invoices and PDFs. Legal basis: performance of our contract.
• Content you enter (customers, suppliers, materials, blanks, quotes, orders, payment records and any files you upload such as payment proofs) — to provide the service and store your workspace. Legal basis: performance of our contract.
• Support messages — to answer your questions and resolve issues. Legal basis: legitimate interests in supporting customers.
• Usage and telemetry data (pages viewed, feature usage, error reports, device identifiers, browser type, IP address) — to keep the service secure, diagnose faults and improve the product. Legal basis: legitimate interests in operating a secure, reliable service.
• Subscription status (plan, status, renewal date, provider customer/subscription identifiers) — to grant the right level of access. Legal basis: performance of our contract and legal obligation.

Payment card details are never collected or stored by us. Payments are handled by our Merchant of Record, Paddle, under their own privacy notice.

3. Who we share data with

• Service providers / subprocessors — hosting, database, storage, email delivery and error-monitoring providers who process data on our instructions.
• Merchant of Record — Paddle.com Market Ltd, for the sale of subscriptions, subscription management, payments, tax compliance, invoicing and refunds.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose data by law or to establish, exercise or defend legal claims.

We do not sell your personal data.

4. International transfers

Our providers may process data outside the country where you live, including outside the UK/EEA and South Africa. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with technical measures like encryption in transit.

5. Retention

We keep account and workspace data for as long as your account is active. If you close your account, we delete or anonymise your personal data within 90 days, except where we must keep records longer for tax, accounting, fraud-prevention or legal-claim purposes (typically up to 5 years for transaction records). Backups age out on a rolling schedule.

6. Your rights

Depending on where you live, you may have the right to access your personal data, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent where processing is based on consent. Under South Africa's POPIA you may also object to processing and complain to the Information Regulator; under UK/EU GDPR you may complain to your local supervisory authority.

Email privacy@cutculator.com to exercise any right. We respond within one month.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls that scope data to your workspace, restricted administrative access and audited storage policies. No system is perfectly secure, but we work to protect your data and will notify you and the relevant regulator of a qualifying breach as required by law.

8. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in, remember your workspace preferences and secure checkout. We may use analytics cookies to understand aggregate usage, and third-party advertising scripts (Google AdSense) may set marketing cookies on public pages. You can block or delete cookies in your browser settings, and manage Google ad personalisation at adssettings.google.com. Blocking essential cookies will stop sign-in from working.

9. Changes to this notice

We may update this notice as the service evolves. Material changes will be signalled by updating the date at the top of this page.