Privacy Policy

At XCut.AI, we take your privacy seriously. This Privacy Policy explains how we collect, use, protect, and share your information when you use our canvas-based AI workspace.

1. Information We Collect

1.1 Personal Information

When you create an account or use our service, we collect:

• Contact Information: Name, email address
• Account Information: Username, password (encrypted), profile details
• Billing Information: Payment details, billing address (processed through secure payment providers)
• Communication Data: Support messages, feedback, and correspondence

1.2 Usage Data

We automatically collect information about how you use XCut.AI:

• Platform Activity: Features used, time spent, content processed
• Technical Data: IP address, browser type, device information, operating system
• Performance Metrics: Processing times, error logs, system performance
• Analytics: Usage patterns, feature adoption, user engagement
• Session replay: anonymised recordings of how pages are used (see section 15.3)

1.3 Content and Canvas Data

When you use our visual workspace and research nodes:

• Research Nodes: URLs, competitor profiles, videos, and media you add for analysis
• Generated Strategy: AI-created content briefs, scripts, and outlier reports
• Context Data: Canvas structure, group connections, and custom text nodes
• Social Media Data: Connected account information (when you choose to integrate)

2. How We Use Your Information

2.1 Service Provision

• Process competitor data, profiles, and research nodes using specialized AI agents
• Generate platform-specific scripts and detect performance outliers
• Provide customer support and technical assistance
• Maintain and improve service functionality

2.2 Account Management

• Create and manage your user account
• Process payments and maintain billing records
• Send service-related notifications and updates
• Authenticate users and prevent unauthorized access

2.3 Service Improvement

• Analyze usage patterns to enhance features
• Train and improve AI algorithms (using anonymized data)
• Conduct research and development
• Optimize platform performance and reliability

2.4 Communication

• Send important service announcements
• Provide customer support responses
• Share feature updates and product news (with consent)
• Respond to inquiries and feedback

3. Legal Basis for Processing (GDPR)

We process your personal data based on: Contract Performance: To provide XCut.AI services you've subscribed to, Legitimate Interests: To improve our service, ensure security, and conduct analytics, Legal Compliance: To meet regulatory requirements and legal obligations, Consent: For marketing communications and optional features (withdrawable anytime)

4. Information Sharing and Disclosure

4.1 We DO NOT Sell Your Data

XCut.AI does not sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Service Providers

We share information with trusted third-party providers for:

• Cloud Infrastructure: Google Cloud for data processing, canvas storage, and AI agents
• Payment Processing: Dodo Payments, our merchant of record, processes card and wallet payments. We never see or store your full card details.
• Analytics: Anonymized usage data for service improvement
• Customer Support: Help desk and communication platforms

4.3 Social Media Platforms

When you connect social media accounts:

• We access only necessary permissions for content publishing
• Platform-specific data handling follows their privacy policies
• You can revoke permissions at any time through your account settings

4.4 Legal Requirements

We may disclose information when required by law:

• Court orders, subpoenas, or legal processes
• Protecting rights, property, or safety of XCut.AI or users
• Preventing fraud, abuse, or illegal activities
• Complying with regulatory investigations

5. Data Security and Protection

5.1 Security Measures

• Encryption: Data encrypted in transit and at rest
• Access Controls: Limited employee access on need-to-know basis
• Secure Infrastructure: Industry-standard cloud security practices
• Regular Audits: Security assessments and vulnerability testing

5.2 Canvas & Research Data Security

• Canvas workspaces and research data are processed in secure, isolated environments
• Temporary analysis files are automatically deleted
• Uploaded assets and node data are securely stored and encrypted
• No human review of your canvas content except for explicit support requests

5.3 Payment Security

• We don't store complete credit card information
• Payment data handled by PCI DSS compliant processors
• Billing information encrypted and securely stored

6. Data Retention

6.1 Account Data

• Personal information retained while your account is active
• Account data deleted within 30 days of account closure
• Billing records retained for tax and legal compliance (up to 7 years)

6.2 Content Data

• Free Plan: Canvas data deleted after 30 days of inactivity
• Paid Plans: Canvas workspaces and data available based on plan features
• Source Materials: Securely stored while associated with an active canvas
• Analytics Data: Anonymized usage data retained for service improvement

6.3 Communication Data

• Support conversations retained for 2 years for quality assurance
• Marketing communications stored until you unsubscribe

7. Your Privacy Rights

7.1 Access and Control

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Export your data in a standard format
• Restriction: Limit how we process your information

7.2 Marketing Preferences

• Opt-out of marketing emails at any time
• Unsubscribe links included in all marketing communications
• Account notifications cannot be disabled (essential for service)

7.3 Cookie Preferences

• Essential cookies required for service functionality
• Analytics cookies can be disabled through browser settings
• No advertising cookies used

8. International Data Transfers

8.1 Global Service

• XCut.AI operates globally and may transfer data internationally
• Primary data centers located in secure facilities
• Transfers comply with applicable data protection laws
• Appropriate safeguards implemented for international transfers

8.2 Data Localization

• EU users' data processed in accordance with GDPR
• Specific data localization available for enterprise customers
• Cross-border transfers use approved mechanisms (Standard Contractual Clauses)

9. Children's Privacy

9.1 Age Restrictions

• XCut.AI is for people aged 18 and over. It is not directed at children
• We don't knowingly collect personal information from anyone under 18, and never from children under 13
• You may not create an account or use XCut.AI if you are under 18

9.2 If a Child Has Used XCut.AI

If we learn that we have collected personal information from someone under 18:

• The account will be suspended
• Their personal information will be deleted promptly
• A parent or guardian can ask us to delete it by emailing support@xcut.ai

10. Third-Party Links and Services

10.1 External Links

Our service may contain links to third-party websites:

• This Privacy Policy doesn't apply to external sites
• We're not responsible for third-party privacy practices
• Review privacy policies of linked sites before providing information

10.2 Social Media Integration

When connecting social media accounts:

• You grant us limited permissions to publish content
• Social platforms' privacy policies apply to their services
• We don't control how platforms handle your data

10.3 Connecting XCut AI to AI Assistants (MCP Server and Plugins)

You can connect your XCut AI account to AI assistants such as ChatGPT, Claude, Grok, Meta Muse or Gemini through our MCP server (https://mcp.xcut.ai/mcp, or https://mcp.xcut.ai/claude/mcp in Claude), either directly or by installing the XCut AI plugin for ChatGPT, Codex or Claude Code. The plugin only adds the connection and written instructions for the assistant; it collects nothing beyond what the MCP server does. When you connect:

• What we collect: the account you connect, which app connected, which XCut AI tools it called, when, how long each call took and whether it succeeded. These usage records do not contain what you asked or what the tool returned.
• What we do not receive: your chat history with the assistant, its memory or your files with that assistant. We only receive the request for the tool it calls.
• What we save: posts, profiles, websites, ads and notes you ask it to import or add are saved to your XCut AI canvas. Requests to XCut AI's writing tools and their replies are saved as a chat on your canvas, the same as a chat you type in the app.
• Why: to run the tools you ask for, to charge credits at our normal rates, to show you your usage in Settings → Connected apps, and to prevent abuse.
• Who receives it: XCut AI and the service providers listed in section 4.2. Tool results are returned to the assistant you connected; that assistant's own privacy policy then applies.
• Retention: usage records are deleted after 90 days. A connection lasts until you disconnect it. Content saved to your canvas stays until you delete it.
• API keys: if you create a personal API key for an app that can't sign in, we store only a secure hash of it, never the key itself. You can revoke it at any time.
• Your controls: disconnect any app or revoke any key in Settings → Connected apps. New access stops immediately and an app's current session ends within 15 minutes.

11. Data Breach Notification

11.1 Security Incidents

In case of a data breach:

• We'll investigate and contain the incident promptly
• Affected users notified within 72 hours when required by law
• Appropriate authorities notified as legally required

11.2 Breach Response

Our response includes:

• Immediate containment and assessment
• User notification with clear information about the incident
• Steps taken to prevent future occurrences
• Cooperation with regulatory investigations

12. Privacy Policy Updates

12.1 Changes and Notifications

We may update this Privacy Policy:

• Material changes communicated via email and website notice
• Continued use constitutes acceptance of updates
• Previous versions archived and available upon request

12.2 Review Schedule

• Privacy Policy reviewed annually or as needed
• Updates reflect changes in law, service features, or data practices
• User rights and protections maintained or enhanced

13. Contact Information

13.1 Privacy Questions

For privacy-related inquiries, contact us at:

• Email: info@xcut.ai
• Subject Line: Privacy Inquiry
• Response Time: Within 5 business days

13.2 Data Protection Officer

For GDPR-related requests:

• Email: info@xcut.ai
• Address: XCut.AI, India

13.3 Regulatory Complaints

EU users can file complaints with their local supervisory authority if unsatisfied with our response.

14. Regional Privacy Information

14.1 California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we don't sell data)
• Right to non-discrimination for exercising privacy rights

14.2 European Union (GDPR)

EU users have enhanced rights under GDPR:

• Lawful basis for processing clearly identified
• Right to object to processing
• Right to data portability
• Right to lodge complaints with supervisory authorities

14.3 India (Personal Data Protection)

Indian users are protected under applicable Indian privacy laws:

• Data processing complies with Indian regulations
• Local data storage for sensitive personal data when required
• Rights to access, correction, and deletion honored

15. Cookies and Tracking

15.1 Cookie Types

We use the following cookies:

• Essential Cookies: Required for service functionality
• Analytics Cookies: Understand how users interact with our service
• Preference Cookies: Remember your settings and preferences
• Advertising Cookies and Pixels: We use the Meta Pixel (Facebook and Instagram), the TikTok Pixel and the Google Ads tag to measure whether our ads lead to signups and purchases, and to show our ads to relevant people. These tools may set cookies and receive your IP address, browser details and the pages you visit on our site.

15.2 Cookie Management

• Essential cookies cannot be disabled
• Optional cookies can be controlled through browser settings
• You can limit ad tracking through your browser settings, your Meta and Google ad settings (facebook.com/adpreferences and adssettings.google.com)

15.3 Session Replay

We record anonymised product usage sessions (session replay) to improve XCut; inputs are masked. A recording shows how a page was used: clicks, scrolling, page changes and what was on screen. It is used only to find bugs and confusing screens. We use PostHog to record and store it.

• Masked: everything typed into a form field (passwords, emails, payment details, search boxes), the messages you type to the AI, text you write in editors, and email addresses shown anywhere on a page. Masked text appears as asterisks; we never see it
• Not recorded: the contents of network requests, and payment pages run by our payment provider
• How to opt out: turn on Global Privacy Control or "Do Not Track" in your browser. While either is on, we do not record sessions or collect product analytics from that browser. You can also block analytics with a browser extension, or email support@xcut.ai with questions

16. Business Transfers

In case of merger, acquisition, or asset sale:

• User data may be transferred to new entity
• Users will be notified of any ownership changes
• Privacy protections will be maintained or enhanced
• Option to delete account before transfer provided