Independent operation and contact
Cutout Lab is an independently operated web application and HTTP API. For privacy questions, data access or erasure requests, or abuse reports, email privacy@cutoutlabs.com or support@cutoutlabs.com.
Cutout Lab is intended for users aged 13 and older (or 16 and older where required by local law, such as in the EEA or UK). We do not knowingly collect personal information from children.
Images and processing
In the web editor, a file selected from your device is previewed in your browser. Removal starts automatically and sends a copy of the image, scaled down first if it is large, directly from your browser to the Cutout Lab API (/v1.0/removebg), which processes it with Cloudflare Images segmentation. In the HTTP API, the submitted image or public image URL is processed in memory by the API worker and, for advanced output options, by our Modal GPU backend.
Application code does not write uploaded images or cutout results to a persistent image library, and uploaded images are not used to train AI models. Processing uses server memory; browser previews, brush edits, background compositing, and downloads use local browser resources.
API accounts, emails, cookies, and retention
The web editor does not require an account or set authentication cookies. Your theme preference (light or dark) is stored locally in your browser's localStorage.
If you request an API key or sign in to the API dashboard, Cloudflare Turnstile verifies the request for abuse prevention, Resend delivers the one-time sign-in email, and our Cloudflare D1 database stores your email address, API key prefix, SHA-256 hashes of your API key, sign-in token, and session token, and daily per-key image counts for quota enforcement. Signing in sets a strictly necessary HttpOnly, Secure cookie (__Host-cl_session) on the API domain.
| Data item | Purpose | Retention period |
|---|---|---|
| Sign-in token hash (magic_links) | One-time email verification | Expires after 30 minutes or upon first use |
| Session cookie & hash (__Host-cl_session) | Authenticates API dashboard access | Expires after 7 days, on sign-out, or on account deletion |
| Email address & API key hash | Issues API keys and links usage to your account | Kept while your account is active; erased when you click Delete account in the dashboard or email privacy@cutoutlabs.com |
| Daily request counts (usage_daily) | Enforces the daily quota and displays your 30-day usage chart | Historical rows older than the current UTC day are deleted on account deletion |
Image URLs and network requests
Importing a public image URL in the web editor or passing image_url to the API instructs the server to fetch that URL from its source host. The source host receives the server's request. Do not submit private, intranet, signed, or credential-bearing URLs.
Cancel stops the browser's removal request, but processing already started on the server may still finish. To enforce free web-editor limits, the API stores a daily image count per SHA-256 hash of your IP address; the raw IP address is not stored.
Subprocessors and infrastructure logs
Cutout Lab relies on Vercel (web hosting), Cloudflare (Workers, Images segmentation, D1 database, and Turnstile bot protection), Modal (serverless GPU inference), and Resend (transactional sign-in email delivery). These providers may process technical request metadata such as IP addresses, email delivery statuses, and timestamps under their respective security and retention practices.
We do not sell your personal information or share it with third parties for cross-context behavioral advertising.
Your privacy rights and deletion
Depending on your location (including under the GDPR, UK GDPR, and CCPA), you may have the right to access, correct, export, restrict, or delete your personal data. You can self-delete your API account, revoke keys, and erase your stored email address immediately at any time using the Delete account button on the API dashboard (/v1/dashboard), or by emailing privacy@cutoutlabs.com.
For support or privacy requests, visit Contact or email support@cutoutlabs.com. Read the terms of service.