Privacy Policy

This is a working draft. It has not yet been reviewed by a legal adviser.

1. Who we are

Cut To Media & Entertainment™ ("we", "us") produces video and media content. This policy explains what personal data we collect through this website and our client portal, why we collect it, and what rights you have over it. For anything in this policy, contact us at [email protected].

2. What we collect

When you contact us

• Your name, email address, phone number and whatever you write in the message.

When you have a client portal account

• Name, email address, phone number, and your role within your company.
• The company you belong to and your access level within it.
• Files you upload, briefs you submit, messages you send us, and comments you leave on work in review.
• Approvals and change requests, recorded with your name and the time.
• Invoices and contracts issued to your company.
• Electronic signatures on contracts. This includes your name, email, the role you gave, your IP address, your browser and device, the exact time, and a cryptographic fingerprint of the document you signed. This is what makes the signature evidence, and it is kept for as long as the agreement matters.
• A record of your activity in the portal - which pages you opened, which files you downloaded, and when - together with your IP address.

When you make a privacy choice

• What you chose, when, from which IP address, which browser, and the version of this notice that was in force at the time. We keep this because the DPDP Act requires us to be able to show that consent was given, and this is the record of it.

3. Cookies

We set the following:

• Essential. Keeping you signed in, remembering your privacy choice, remembering whether you prefer the portal in light or dark mode, and protecting forms against cross-site request forgery. These are required for the site to work and are not optional.
• Analytics. Google Analytics, only if you agree. Nothing analytics-related is loaded before you agree, and your IP address is shortened by Google before it is stored.
• Marketing. Only if you agree. Used to measure whether our campaigns reach the right people.

You can change any of this at any time using "Cookie settings" in the footer, or on the Privacy page inside the client portal. Withdrawing is as easy as giving.

4. Why we are allowed to hold it

• To perform our contract with you - running your projects, delivering work, issuing invoices.
• Your consent - analytics, marketing, and anything you have opted into. You can withdraw it at any time.
• Our legitimate interests - keeping the service secure, preventing abuse, and keeping records of who approved and signed what.
• Legal obligation - tax and accounting records.

5. Who else sees it

We do not sell your data. We share it only with providers who help us run the service:

• Our hosting provider, where the site and its database run.
• Cloudflare, which sits in front of the site and filters malicious traffic.
• Google Analytics, only if you agreed to analytics.
• Google Workspace, where our email is handled.
• Video platforms used for review copies, where a cut is hosted for you to watch.

Some of these store data outside India. Where they do, we rely on their contractual commitments to protect it to the standard set out here.

6. How long we keep it

• Project files and deliverables - for the life of the project and a reasonable archival period after it, so we can supply masters again if you need them.
• Invoices and contracts - as long as tax and company law requires.
• Signature records - as long as the agreement they relate to is capable of being relied on.
• Consent records - kept as evidence for as long as we rely on that consent, and for a period afterwards.
• Portal activity logs - a rolling period, then deleted.

7. Your rights

Under the Digital Personal Data Protection Act 2023 you may:

• Access what we hold about you. Portal users can download it directly: Account, then "Export my data". It arrives as a JSON file containing your details, your consents, your activity, and your company's invoices.
• Correct anything inaccurate. Most of it you can edit yourself under Account.
• Erase what we no longer need. Some records - signed contracts, invoices - we are required to keep.
• Withdraw consent at any time, as easily as you gave it.
• Nominate someone to exercise these rights on your behalf if you are unable to.
• Complain to us first at [email protected], and to the Data Protection Board of India if we do not resolve it.

8. Keeping it safe

Traffic is encrypted in transit. Passwords are stored hashed and are never recoverable in readable form. Client data is separated by company, and access to it is limited by role, so one client cannot see another's work. Access to signed contracts and unreleased footage is restricted to the people you have invited to your account.

9. Children

This service is for businesses. We do not knowingly collect data about anyone under 18. If you believe we have, contact us and we will delete it.

10. Changes

If we make a material change to this notice, we will ask for your privacy choices again rather than assume the old answer still stands. The version number at the top of this page is what your consent record is stamped against.