Privacy Notice

Version 1.3 - last updated 2 November 2026

This notice explains how KUZUB LTD uses personal data in connection with CutMeter, the service available at cutmeter.com, and the rights you have. Words with capital letters, such as Customer Content, Files, Technical Statistics and Usage Events, have the meanings given in our Terms of Service.

1. Who we are and how to contact us

1.1 KUZUB LTD is a private limited company registered in Scotland with company number SC890997, whose registered office is at Suite 2/3, 48 West George Street, Glasgow, G2 1BP, United Kingdom ("KUZUB", "we", "us" and "our").

1.2 For any question about personal data, or to exercise your rights, write to privacy@cutmeter.com or to our registered office. We have not appointed a data protection officer because the law does not require us to; messages to privacy@cutmeter.com reach the person at KUZUB who is responsible for data protection.

2. Our two roles

2.1 We are the controller of the personal data that we collect for our own purposes: data about visitors to the website, Accounts, Pro subscriptions, Usage Events, support requests, marketing consent, reports of illegal content, order requests sent through CutMeter Orders and the verification of Partner Shops. Section 3 describes this data.

2.2 We are a processor of personal data contained in Customer Content when a business uses the Service. Drawings and Quotes can contain names, signatures and contact details, for example of a Client's engineers or of the person who ordered a part. We process that data only on the business's behalf and on its instructions, under our Data Processing Agreement. The business that uploaded the data is the controller and decides how it is used. If a business uses the optional Pro intake helper, which reads a message from its Client that the business pastes into the Service, the text of that message is Customer Content: we remove email addresses and telephone numbers from it, send it to Anthropic only to extract the order details, and do not store it; Anthropic does not use it to train its models and deletes it within 30 days, unless it must keep it longer by law or to enforce its usage policies.

2.3 If your name appears on a drawing. If a business has uploaded a drawing or created a Quote that contains your details, that business is responsible for your data, and you should contact it first. If you contact us, we tell you whether we hold any data about you and, where we can identify the business, we pass your request to it and help it to answer. Files are deleted 24 hours after upload unless the business saves them in a Saved Order, and we never use personal data from Files for our own purposes: Technical Statistics contain no personal data, and before a File is added to our Engineering Library we remove all text, title blocks and file properties.

3. What we collect, why, on what legal basis and for how long

3.1 Visiting the website and using the Free Tools. When you open a page or upload a File, our hosting provider Cloudflare processes your IP address, browser and device information and the pages requested, so that the pages can be delivered and the Service can be protected against attacks and abuse. We use the country of your network connection, derived from your IP address, to apply the restrictions in clauses 3.3 and 3.4 of the Terms of Service and to record it in Usage Events. Legal basis: our legitimate interests in providing and protecting the Service, and our legal obligation to comply with sanctions law. Security logs are kept for no longer than 90 days. We do not record IP addresses in Usage Events or Technical Statistics.

3.2 Personal data in Files used for personal purposes. If you use the Free Tools for purposes outside any business, we are the controller of personal data in your Files and use it only to produce the Results you asked for. Legal basis: our legitimate interests and yours in processing the File you uploaded. Files are deleted as stated in section 7. If you use the Service for a business, section 2.2 applies instead.

3.3 Your Account. We process your email address and, if you sign in with Google, the name, email address, profile picture link and Google account identifier that Google sends us; the business name, logo, currency, language and country that you enter; sign-in times; and your Account settings, including your choices about contribution and marketing. We use this data to open and run your Account and to send you emails needed to provide the Service, such as sign-in links, security notices, renewal reminders and notices of changes to our terms. Legal basis: performance of our contract with you. We keep it until your Account is deleted.

3.4 Pro subscription and payments. Paddle sells Pro and processes your payment as a controller in its own right under its privacy notice; we never receive your full card details. We send Paddle your Account email and internal identifiers of your Account so that your subscription is linked to it. Paddle sends us the customer and subscription identifiers, plan, status, dates, amounts and currency, your billing country and address, and your business name and tax number if you gave them. We use this data to activate and manage Pro, to keep accounting and tax records, to prevent fraud and to apply the restriction in clause 3.3 of the Terms of Service. Legal bases: performance of our contract with you; our legal obligations under accounting and tax law; our legitimate interests in preventing fraud and in limiting where Pro is sold. We keep this data for 6 years after the end of the financial year in which your subscription ends.

3.5 Usage Events. The Service records Usage Events as described in clause 8.7 of the Terms of Service: which function was used and when, file size, processing time, success or error code, the number of drawing entities and of problems found, sign-ups, the start of Pro, the creation of Quotes and the country of your network connection. When you arrive from another website, they also record whether it was a search engine, an AI assistant or another website, the name of the search engine or assistant if it is one that we list, and the page that you opened, but never the address of the page that you came from. Usage Events contain no content of Files and no IP address, and they are recorded without cookies and without third-party analytics software. When you are signed in, they are linked to your Account. We use them to understand how the Service is used, to fix problems, to improve functions and to plan capacity. Legal basis: our legitimate interests in running and improving the Service. When your Account is deleted, the link between your Usage Events and your Account is removed; all Usage Events are deleted 24 months after they are recorded.

3.6 Technical Statistics. The Service derives anonymous Technical Statistics from each processed File, limited to the fields listed in clause 8.6 of the Terms of Service. They contain no personal data, no content of the drawing and no identifier of you or your Account. Deriving them is itself an operation on the File, which may contain personal data; we carry it out to keep the Service reliable, compatible and secure. Legal basis: our legitimate interests in the reliability and security of the Service and, for business Customers, the Customer's instruction in the Data Processing Agreement.

3.7 Support requests. When you write to us, we process your name, email address, the content of your messages and any attachments, to answer you. If you send a File to support under clause 9 of the Terms of Service, we process it on the Customer's behalf only to answer the request and correct the fault; only support staff bound by confidentiality can open it, each access is logged, and it is never used for training. Legal basis: performance of our contract with you and our legitimate interests in answering enquiries. We keep support correspondence for 24 months after the request is resolved; Files sent to support are deleted within 30 days after we tell you that the request is resolved. A File with a commercial confidentiality marking cannot be sent to support (section 9.2).

3.8 Contributions to the Engineering Library. Contribution is optional and switched off by default (clause 10 of the Terms of Service). Before a Contributed File is stored, the Service removes all text, title blocks, attributes, images, file properties, author data and names of layers, blocks and styles, and keeps only the cutting geometry, so the Engineering Library is designed to contain no personal data. A File with a commercial confidentiality marking cannot be contributed (section 9.2). We check samples of the Engineering Library for any personal data that remains and delete any that we find. We keep a record of each contribution: the Account, a reference to the File, your confirmation of its source, the date and the version of the Terms of Service. Legal bases: performance of our contract with you and our legitimate interests in being able to prove our rights in the Engineering Library. We keep contribution records for 6 years after the geometry of the File is deleted from the Engineering Library.

3.9 Marketing emails. We send you marketing emails only if you tick the separate box, which is not ticked in advance, when you open your Account. That box covers emails about other KUZUB tools for workshops, such as MALVA production planning. Legal basis: your consent. You can withdraw consent at any time with the unsubscribe link in every such email or in your Account settings, without affecting the Service. We keep your marketing preference while your consent applies, and a record of the consent and of its withdrawal for 5 years after withdrawal, to show that we acted lawfully. Without your consent we send you only the emails described in section 3.3, which are not marketing.

3.10 Reports, complaints and legal matters. If you report content under clause 19 of the Terms of Service or make a complaint, we process your name, email address and the content of your message to deal with it. We may also process personal data where this is necessary to establish, exercise or defend legal claims or to comply with an order of a court or authority. Legal bases: our legal obligations, and our legitimate interests in operating a safe service and protecting our rights. We keep reports and complaints for 24 months after our decision, and data needed for a legal claim until the claim is finally resolved.

3.11 Order requests through CutMeter Orders. When you send an order request to a Partner Shop under clause 24 of the Terms of Service, we process your name, email address, telephone number, city, choice of delivery, desired date and comment, the Files and the details of the parts, and the history of the request. We send them to the Partner Shop that you choose, which receives them as a controller in its own right and is responsible for its own use of them; we email you and the Partner Shop about the progress of the request. Before a request is sent, Cloudflare Turnstile checks that it comes from a person and not from an automated program; for this check Cloudflare processes your IP address and information about your browser and device. Legal bases: taking the steps that you ask for before a contract and performing our service to you; our legitimate interests in protecting the Service and the Partner Shops from automated abuse. We keep the Files for 90 days after the request is sent, and the request with its history for 2 years after its last change.

3.12 Partner Shops. To verify a Partner Shop under clause 24.9 of the Terms of Service, we process the name, registration number, address and telephone number of the business and of the person who acts for it, and the other information that Article 30 of the Digital Services Act requires where it applies. We publish the shop profile that the Partner Shop enters, except its registration number and address, to Buyers. Legal bases: performance of our contract with the Partner Shop; our legal obligations; our legitimate interests in showing Buyers only genuine businesses. We keep verification information for 6 months after the business stops being a Partner Shop.

3.13 Pro pre-orders. If you leave your email address to hear when Pro becomes available, we process the email address, the page and language from which you left it, and the date and version of your consent, to send you one email when Pro becomes available. No payment is taken and no Account is opened. Legal basis: your consent. You can withdraw it at any time by writing to privacy@cutmeter.com, and we then delete your email address.

4. Where personal data comes from

We receive personal data from you; from Google, if you sign in with Google; from Paddle, about your Pro subscription; from Cloudflare, which tells us the country of your network connection; from Buyers, who send us their details with an order request; and from businesses that upload Customer Content containing personal data about other people.

5. Who receives personal data

5.1 We share personal data only with:

• Cloudflare, Inc., which hosts the Service, runs our software, stores Files in the European Union and protects the Service against attacks;
• Supabase, Inc., which provides our database and sign-in system, with data stored in the European Union;
• Resend (Plus Five Five, Inc.), our email delivery provider, which sends sign-in links, emails about order requests and other emails on our behalf;
• Anthropic, PBC, which provides the language model behind the optional Pro intake helper described in section 2.2 and receives only the text of the pasted message, without email addresses and telephone numbers;
• the Partner Shop to which you send an order request under clause 24 of the Terms of Service, which receives your request as a controller in its own right;
• Paddle, which sells Pro and processes payments as a controller in its own right;
• Google, if you choose to sign in with Google, which acts as a controller in its own right for your Google account;
• our professional advisers, such as solicitors and accountants, who are bound by confidentiality;
• courts, regulators and other authorities, where the law requires us to share data; and
• a company that takes over the Service under clause 22.2 of the Terms of Service.

5.2 Cloudflare, Supabase, Resend and Anthropic process personal data only on our instructions and under written data processing terms. We do not sell personal data, and we do not share it with advertisers or advertising networks.

6. Transfers outside the United Kingdom and the European Economic Area

6.1 KUZUB is established in the United Kingdom, and we store Files and our database in the European Union. Transfers from the United Kingdom to the European Economic Area are covered by United Kingdom adequacy regulations, and transfers from the European Union to the United Kingdom are covered by the European Commission's adequacy decision for the United Kingdom.

6.2 To process a File, Cloudflare runs our software in its data centre nearest to you, so processing may take place in your own country or a neighbouring one. Cloudflare, Supabase, Resend and Anthropic are companies based in the United States of America. Where they, or their own sub-processors, may access personal data from a country without an adequacy decision, the transfer is protected by their data processing terms, which incorporate the European Commission's standard contractual clauses and the United Kingdom's International Data Transfer Addendum, or by their certification under the EU-US Data Privacy Framework and its UK Extension. If any other transfer from the United Kingdom or the European Economic Area to such a country takes place, we protect it in the same way. You can ask us for a copy of the safeguards at privacy@cutmeter.com.

7. How long we keep personal data

• Files, and the previews, Results and links derived from them: they expire 24 hours after upload unless the Customer adds them to a Saved Order, and are then permanently deleted from storage, normally within the following 24 hours.
• Saved Orders, Rate Cards, logos and other Customer Content in an Account: until the Customer deletes them or the Account is deleted.
• Account data: until the Account is deleted. An Account that has had no sign-in for 24 months and has no active Pro subscription may be deleted after we notify you by email at least 30 days in advance.
• After an Account is deleted: its data is deleted within 30 days, and copies in our encrypted backups are overwritten within a further 30 days.
• Subscription and payment records: 6 years after the end of the financial year in which the subscription ends.
• Usage Events: unlinked from the Account when the Account is deleted, and deleted 24 months after they are recorded.
• Technical Statistics: they are anonymous and are kept without a time limit.
• Security logs: no longer than 90 days.
• Support correspondence: 24 months after the request is resolved. Files sent to support: deleted within 30 days after we tell you that the request is resolved.
• Contribution records: 6 years after the geometry of the File is deleted from the Engineering Library.
• Marketing consent: while it applies; the record of consent and of its withdrawal for 5 years after withdrawal.
• Reports and complaints: 24 months after our decision; data needed for a legal claim until the claim is finally resolved.
• Files attached to an order request: 90 days after the request is sent. Order requests and their history: 2 years after their last change.
• Verification information about Partner Shops: 6 months after the business stops being a Partner Shop.
• Pro pre-order email addresses: deleted after the one email that Pro is available has been sent, or 12 months after they were left if Pro has not become available by then, or as soon as you withdraw consent.

8. Your rights

8.1 Under data protection law you have the right to: obtain a copy of your personal data and information about how we use it; have inaccurate data corrected; have your data erased; restrict our use of it; receive data that you gave us, and that we process on the basis of contract or consent by automated means, in a structured, machine-readable format, and have it sent to another organisation; object to our use of your data on the basis of legitimate interests, in which case we stop unless we have compelling legitimate grounds or need the data for legal claims; object at any time to direct marketing, in which case we stop; and withdraw consent at any time, without affecting the lawfulness of earlier use.

8.2 You can change your Account data, export Customer Content and delete your Account yourself in the Account settings. For anything else, write to privacy@cutmeter.com. To protect your data, we may ask you to confirm a request from the email address of your Account. We reply within one month. If a request is complex or you have made several requests, we may extend this by up to two further months, and we tell you within the first month if we do so. We do not charge a fee unless a request is manifestly unfounded or excessive.

8.3 If your request concerns personal data that we process as a processor (section 2.2), we pass it to the Customer concerned and help it to answer.

8.4 If you are unhappy with how we use your data, please tell us at privacy@cutmeter.com. We acknowledge your complaint within 2 Business Days and send a full reply within one month. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner's Office; in the European Union, the supervisory authority of the member state where you live or work or where you believe the infringement took place (list of authorities); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.

9. Automated decisions

9.1 If the billing address recorded for a purchase of Pro is in the United States of America, our system automatically cancels the subscription and has the price refunded, as clause 3.3 of the Terms of Service states. The decision uses only the billing country. If you believe that the country was recorded wrongly, write to privacy@cutmeter.com and a person will review the decision.

9.2 The Service automatically checks each File for markings, as clause 7.6 of the Terms of Service describes. A File with a state or defence security classification marking is blocked and deleted at once. A File with a commercial confidentiality marking, such as CONFIDENTIAL, PROPRIETARY, DO NOT COPY or TRADE SECRET, is processed normally, but it cannot be sent to support or contributed to the Engineering Library. These checks examine the File, not you, and do not evaluate you in any way.

9.3 We do not use personal data for profiling.

10. Cookies

We use only cookies and similar technologies that are strictly necessary to provide the Service you request and to keep it secure. We do not use analytics or advertising cookies. Our Cookie Policy lists them.

11. Security

We protect personal data with encryption in transit and at rest, separation of each Account's data, access limited to the staff who need it and protected by multi-factor authentication, logging of every staff access to Customer Content, logs that never contain the content of Files, and automatic deletion of Files. The Data Processing Agreement describes these measures in more detail. If a personal data breach occurs, we notify the supervisory authority and the people affected as the law requires.

12. Children

The Service is for people aged 18 or over. We do not knowingly collect personal data from children. If we learn that we hold personal data of a child, we delete it.

13. Changes to this notice

We publish each new version of this notice on the Service with its version number and date. If we start to use personal data for a new purpose, or change a legal basis, a retention period or a category of recipient described in this notice, we tell Account holders by email before the change applies.