Last updated: October 3, 2026
1. Introduction
CutArc ("we", "our", "us") respects your privacy. This policy explains how we collect, use, and protect your personal information when you use our suite of browser-based design and manufacturing tools, including CutArc Plasma, Laser, Vinyl, and AI Generate (collectively, "the Service").
2. Information We Collect
2.1 Account Information
- Email address (for account creation and communication)
- Name (optional, for personalization)
- Password (stored securely using bcrypt hashing)
2.2 Payment Information
- Payment processing is handled by Stripe. We do not store your credit card number or payment details on our servers.
- We store your Stripe customer ID to manage your subscription and credit balance.
- See Stripe's privacy policy for how they handle payment data.
2.3 Usage Information
- Projects and designs you create
- Export history, AI generation history, and feature usage
- Machine usage events from the web apps when you are signed in (for example: a machine was connected, or a job was sent, completed, stopped, refused or failed), recorded with only the controller type, connection type, job type, layer or line count, job duration and an error category. These events never include your designs, file names, coordinates, IP addresses, serial numbers or other machine identifiers.
- Design check events from the plasma app, when you are signed in or using it without an account (then with a random ID stored in your browser): when you generate G-code, which design check codes appeared and how many times, whether generation was blocked, which suggested fix you chose (for example enlarge, remove or leave as is) and whether it cleared the check, which codes were still present or had been fixed when you downloaded or sent the file, roughly how long the checks took, and the job's size, controller family and units in broad ranges. These events never include your designs, shape names, coordinates, file names or setting values.
- Settings, preferences, and machine configurations
2.4 AI-Generated Content
- Text prompts submitted to AI Generate
- Images uploaded for Photo to SVG conversion (processed by our AI provider and not retained after conversion)
- Generated SVG designs (stored in your generation history)
- Messages you send to the in-app chat and the CutArc Assistant, and their replies (stored with your account)
2.5 Technical Information
- IP address (for security and rate limiting)
- Browser and device information (for compatibility)
- Session data (for authentication)
3. How We Use Your Information
- Provide the Service: Process your designs, generate G-code and machine commands, and run AI generation
- Account Management: Authentication, password recovery, and security
- Billing: Process subscription payments and AI credit purchases via Stripe
- Communication: Service updates, security alerts, and support
- Improvement: Analyze usage patterns to improve the Service
- Security: Detect and prevent fraud and abuse
4. Data Storage and Security
- Data is stored on secure servers with encryption at rest
- Passwords are hashed using industry-standard bcrypt
- All connections use HTTPS encryption
- We implement rate limiting, 2FA support, and intrusion detection
- Regular backups ensure data availability
5. Data Sharing
We do NOT sell your personal information. We may share data only:
- With Stripe for payment processing
- With our AI providers, who process requests on our behalf. We do not send them your name, email address or payment details:
- Recraft, for AI generation and photo-to-SVG conversion: the prompt or image
- Google (Gemini), when a photo is converted to line art: the image
- Anthropic (Claude), which powers the in-app chat, the CutArc Assistant and design check explanations: your chat messages and the job they are about (post-processor, cut settings, material size, the shapes in your design with their sizes, and design check results). AI generation prompts are also checked by Anthropic before they are sent to Recraft
- With service providers who assist in operating the Service (hosting, email delivery)
- When required by law or to protect our rights
- In connection with a business transfer (merger, acquisition)
6. Your Rights
You have the right to:
- Access: Download all your data via Profile > Export My Data
- Correction: Update your account information at any time
- Deletion: Delete your account and all associated data
- Portability: Export your projects and settings
7. Cookies, Local Storage, and Third-Party Services
We use:
- Authentication tokens: To keep you logged in
- Local storage: To save your preferences and auto-save projects
- Session cookies: For security and functionality
- Stripe: For secure payment processing. Stripe may set cookies for fraud prevention. See Stripe's privacy policy.
- Google Analytics: To understand how visitors use our site and improve the experience. Google Analytics may set cookies to collect anonymous usage data. Learn more at Google's privacy policy.
- Google AdSense: To display relevant advertisements that help support the free tier. AdSense may use cookies to serve ads based on your browsing history. You can opt out of personalized ads at Google Ad Settings.
8. Data Retention
- Account data is retained while your account is active
- AI generation history is retained while your account is active
- Images uploaded for Photo to SVG are processed in memory and not permanently stored
- Upon account deletion, data is permanently removed within 30 days
- Backups are retained for up to 90 days for disaster recovery
9. International Users
The Service is hosted in the United States. By using the Service, you consent to data transfer to the US. We comply with applicable data protection regulations including GDPR for EU users.
10. Children's Privacy
The Service is not intended for children under 13. We do not knowingly collect information from children.
11. CutArc Machine Connect Chrome Extension
The "CutArc Machine Connect" browser extension bridges CutArc to CNC controllers on your local network via WebSocket. Regarding this extension:
- No data collection: The extension does not collect, store, transmit, or share any personal data, browsing history, or usage information
- Local network only: The extension communicates exclusively between the CutArc web application and your CNC controller on your local network. No data leaves your network
- No analytics or tracking: The extension contains no analytics, telemetry, or tracking code
- No remote servers: The extension does not connect to CutArc servers or any third-party services. All communication is directly between your browser and your local machine
- Permissions: The extension only activates on CutArc web pages (cutarc.io) and requires no special browser permissions beyond connecting to your local network
12. CutArc Connect Mobile App (iOS & Android)
The "CutArc Connect" mobile application provides remote access to your CutArc account and connected CNC machines. In addition to the data practices described above, the mobile app:
- Camera access: Used solely to capture photos for conversion to SVG cut files via AI vectorization or image tracing. Photos are processed through the CutArc API and are not stored on our servers after processing is complete
- Photo library access: Used solely to select existing images for conversion to SVG cut files. We do not access, scan, or upload any photos beyond those you explicitly select
- Authentication tokens: Login credentials are stored securely on your device using encrypted storage (iOS Keychain / Android EncryptedSharedPreferences). Tokens are used to authenticate API requests to cutarc.io
- Machine control: The app communicates with your CNC machine through the CutArc server using your authenticated session. Machine status data (position, state) is polled in real time but is not stored or logged by the app
- No background data collection: The app does not collect data in the background, track location, or access contacts, microphone, or other device sensors
- No third-party advertising: The mobile app contains no ads, ad tracking, or third-party analytics SDKs
- Theme preferences: Your display theme preference (dark, light, system) is stored locally on your device and is not transmitted to our servers
13. CutArc iOS App
The CutArc app for iPhone and iPad ("CutArc: Plasma CNC CAD/CAM") runs the CutArc plasma app on your device and uses the same CutArc account, so the practices above apply to it, with these differences:
- Purchases through Apple: Subscriptions and AI credits bought in the app are processed by Apple; we never see your payment details. To grant Pro or credits, our server receives and verifies the App Store transaction (the product, transaction IDs, purchase and expiry dates, and an account token that ties it to your CutArc account) and keeps it as your purchase history. You manage or cancel an App Store subscription in your Apple account settings.
- Camera: Used only when you choose Take Photo: to trace a drawing or part into a cutting design, turn a photo into line art, or attach a photo to a support request. The photo is sent only for that purpose (for AI conversion, to the AI providers in section 5).
- Photos: Choosing an existing photo uses Apple's photo picker, so the app only receives the photo you pick. The app saves to your photo library only when you choose Save Image.
- Usage events: The machine usage and design check events described in section 2.3 are also recorded in the app. When you use it without signing in, they carry a random ID stored on your device, which is linked to your account if you later sign up.
- Sign-in: The app signs in with your CutArc email and password. Your session is kept in the app's private storage on your device.
- No advertising or tracking: The app contains no ads and no advertising, analytics or crash-reporting SDKs, and does not track you across other companies' apps or websites. The Google Analytics and Google AdSense described in section 7 are not part of the app.
- No other device data: The app does not use your location, contacts, microphone or Bluetooth.
- Links: Web pages you open from the app (for example help pages or Apple's subscription settings) open in an in-app Safari view, which does not share data with the app.
14. Changes to This Policy
We may update this policy periodically. Material changes will be communicated via email or Service notification. Continued use after changes constitutes acceptance.
15. Contact Us
For privacy-related questions or to exercise your rights, please reach out through our contact form.