Privacy notice
Last updated 26 July 2026
The short version: we collect your email if you ask to be notified at launch, and — if you install the app — the minimum Shopify data needed to write alt text. Your product images are processed on our own hardware in Europe. Nothing is sold, nothing is used to train models, and there are no advertising or analytics trackers on this website.
Who is responsible
Cutline is built and operated by Hugo Rodrigues, a sole trader based in Portugal, acting as data controller for this website and as data processor for the merchant data handled by the Shopify app. Contact: hello@cutline.software.
This website
If you submit your address to the early-access list, we store the address itself and the date you submitted it. If you ask for a bulk quote, we also store what you typed in that form — how many images, which languages, which platform — because otherwise we would have to email you back asking for it. That is all: no name, no IP-based profiling, no cookies, no analytics service, no advertising pixels, no fonts or scripts loaded from third parties.
The live demo on the home page sends the image address you paste to our own server so the model can look at it. The image is not stored and the result is not logged — it is generated, returned to your browser, and forgotten.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address, submission date | To write to you once, when the app is available | Consent (Art. 6(1)(a) GDPR) | Until launch plus 3 months, or until you ask us to delete it |
| Quote request: catalogue size, languages, platform | To answer your request for a bulk price with an actual number instead of asking you again | Steps prior to a contract (Art. 6(1)(b) GDPR) | 12 months, or until you ask us to delete it |
| Product image URLs you send us for a bulk job | To produce the alt text you ordered | Performance of a contract (Art. 6(1)(b) GDPR) | Deleted once the job is delivered and accepted |
| If we contacted you first: company name, business email and shop URL, taken from your own publicly published contact page | To write to you once about a service related to what your business does | Legitimate interest (Art. 6(1)(f) GDPR) | 6 months without a reply, then deleted; immediately if you ask, and your address is kept on a do-not-contact list so it does not happen again |
| Standard web server logs (IP, request, user agent) | Security and abuse prevention | Legitimate interest (Art. 6(1)(f)) | 14 days |
The Shopify app
When a merchant installs Cutline, the app receives an access token for that store and reads only what it needs to do its job:
- Product images and product metadata (title, type, vendor, tags) — used to generate a description for each image, and written back as alt text.
- Shop domain and installation details — to keep your settings and your subscription straight.
Cutline does not request, and cannot see, your customers’ personal data, your orders or your payment information. Billing is handled entirely by Shopify; we never receive card details.
Where the AI runs
This is the part most alt-text tools are vague about, so we will be exact. Images are processed by a vision model running on our own dedicated server in Europe. Your images are not sent to OpenAI, Google, Anthropic, or any other third-party AI provider, and they are never used to train any model. Images are held only for as long as the description takes to generate, plus a short cache so that re-running a job does not re-download your catalogue; generated alt text and the reference to the image are retained while you are a customer so the app knows what it has already covered.
Who else touches your data
- Shopify — the platform the app runs on and through which it is billed.
- Our hosting provider (server located in the European Union) — provides the machines; does not process your data for its own purposes.
There are no other subprocessors, no data brokers and no transfers outside the European Economic Area.
If we emailed you and you never asked us to
We occasionally write to businesses whose contact address is published on their own website, about a service related to what they do. If that was you: you can tell us to stop in one line and we will, permanently — no form, no login, no "manage preferences" maze. We keep your address on a do-not-contact list precisely so that nobody here writes to you again by accident, and we never sell or share it. You can also object at any time under Art. 21 GDPR, and we will not ask you why.
Your rights
Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to processing, or withdraw consent at any time. Write to hello@cutline.software and you will get a human answer, normally within a few days and always within one month. If you install the app, uninstalling it triggers Shopify’s mandatory data-erasure webhooks and we delete the store’s data on receipt. You also have the right to complain to the Portuguese supervisory authority (CNPD) or the authority where you live.
Security
Traffic is encrypted in transit (TLS). Access tokens are stored on our server and never exposed in the browser. The service runs with least-privilege system users and only the minimum Shopify scopes the feature set requires. If a breach ever affects your data, we will tell you and the authorities within the deadlines the GDPR sets, without burying it.
Changes
If this notice changes in a way that matters, the date at the top changes and anyone on the list or using the app is told by email. We do not make quiet edits.