Privacy Policy

Cut Lists is a tool made for school workshops. It helps students ask the workshop technician to cut materials for their projects, and it helps teachers and technicians keep track of those requests. The app is provided by Cut Lists (referred to as "we", "us", or "our" in this policy). You can contact us at any time using the details in Section 12 below.

We keep the list of information small on purpose. Here's everything we may collect:

We use your information only to make Cut Lists work for your school. Specifically:

• To create and manage your account and let you log in securely.
• To show cut list requests to the right technician at your school.
• To let students, teachers, and technicians message each other about a project.
• To send notifications — for example, when a request is completed or a new message arrives.
• To help teachers and technicians organise and prioritise work.
• To keep records for each school separate and secure (see Section 5).
• To fix bugs, improve features, and make the app easier to use.
• To prevent misuse, fraud, or unauthorised access.
• To comply with legal obligations if required.

If you're in the EU, UK, or Switzerland, the law (GDPR) says we must tell you the legal reason we process your data. We rely on these reasons:

• Performance of a contract — running the Cut Lists service you signed up for.
• Legitimate interests — keeping the service secure, fixing bugs, and improving features.
• Legal obligation — meeting any legal requirements that apply to schools.
• Consent — for optional Google Analytics and for things like push notifications. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

For students under 16, we rely on consent given by the school (and, where required, a parent or guardian).

Every school that uses Cut Lists gets its own private space. This means a student, teacher, or technician at School A can never see the requests, messages, files, or users belonging to School B. We enforce this at the technical level — every piece of data is tagged with a school ID, and the app checks this tag before showing anything. This "school isolation" is one of the most important security features of Cut Lists and helps schools meet their safeguarding and child-protection responsibilities.

Cut Lists is designed for use in schools, which means many users are students under 18. We take extra care:

• Students under 16 may only use Cut Lists if their school has set up an account and, where required by local law, a parent or guardian has given consent.
• We do not knowingly collect more data than is needed for a student to submit and track workshop requests.
• We do not show advertisements to any user, and we do not profile students.
• We do not use students' data for automated decision-making.
• If a school discovers a student under the required age is using the app without proper consent, please contact us and we will remove the account and data.

Schools are responsible for obtaining any parental consent required under their local laws (including COPPA in the US and the UK/EU age of digital consent). Cut Lists provides tools to help, including the ability to delete student data on request.

We share the minimum amount of data necessary, and only in these situations:

• Within your school — other users at your school can see information relevant to shared cut list requests and messages (e.g., a technician sees the student's name and request details).
• Service providers — trusted companies that help us run the app (e.g., hosting, email delivery, push notifications, payment processing via Stripe). These providers are bound by strict contracts and only handle data as needed to provide their service.
• Legal reasons — if we are legally required to share data (for example, by a court order or law enforcement request), we will share only what is necessary.
• School transfers — if a school closes its account, we can provide an export of that school's data to the school's administrator.

We never sell your data, and we never share it for advertising purposes.

Your data is hosted in the United Kingdom on secure cloud infrastructure, and the Cut Lists database is UK-based. All data is encrypted in transit (TLS/HTTPS) and at rest. Where a trusted sub-processor (for example, a payment or notification provider) processes limited data outside the UK, we use recognised safeguards such as Standard Contractual Clauses to ensure it is protected to the same standard required by UK and EU law. If you'd like more detail about where your data is stored, please contact us.

We use a range of security measures to protect your information:

• Encryption in transit — all data sent between your device and our servers is encrypted using TLS (HTTPS).
• Access controls — only authorised staff can access systems, and only with secure, monitored credentials.
• School isolation — each school's data is logically separated (see Section 5).
• Authentication — passwords are never stored in plain text, and we support secure login including Google sign-in.
• Regular reviews — we review our security practices and fix vulnerabilities as they are discovered.
• Payment security — payments are handled by Stripe, a PCI-compliant provider. We never see or store your full card details.

No system is 100% secure, but we work hard to protect your data. If a security breach ever occurs, we will notify affected schools and users as required by law.

We only keep data for as long as it's needed:

• Active cut lists — kept while the request is pending or in progress.
• Completed requests — automatically archived 30 days after completion, and permanently deleted 60 days after completion.
• Messages — kept for as long as the related cut list exists, then deleted with it.
• Account data — kept while your account is active. If your school closes its account, we will delete the school's data within 90 days, unless a longer period is required by law.
• Uploaded files — deleted at the same time as the request they belong to.

You or your school can request earlier deletion at any time (see Section 11).

You have the right to control your data. Depending on where you live, you may have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Correct — ask us to fix information that is wrong or out of date.
• Delete — ask us to delete your personal data (also called the "right to be forgotten").
• Restrict — ask us to limit how we use your data in certain situations.
• Object — object to us processing your data for certain reasons.
• Portability — receive your data in a format you can take to another service.
• Withdraw consent — if we rely on your consent (for example, for push notifications), you can withdraw it at any time without giving a reason.

To use any of these rights, just email us at support@cut-lists.com. We'll respond within 30 days. If you're a student and need help, ask a teacher or parent to contact us on your behalf.

If you have any questions about this privacy policy, or if you want to use any of your rights, we'd love to hear from you:

Cut Lists can send push notifications to let you know when a request is updated, completed, or when you receive a message. These notifications are sent only for app-related activity — never for marketing or advertising. You can turn notifications off at any time in your device settings, and we will stop sending them immediately. The notification tokens we use to deliver these messages are deleted when you log out or disable notifications.

Cut Lists uses a small amount of local storage on your device to keep you logged in and remember your preferences (like dark mode). Optional Google Analytics is disabled until you explicitly consent, and we do not use analytics for advertising or remarketing. If you clear your browser or app data, you'll simply need to log in again.

We may update this policy from time to time — for example, if we add a new feature or if the law changes. When we do, we'll update the "Last updated" date at the top and notify schools of significant changes. We encourage you to review this page occasionally. If you disagree with a change, you can close your account and request deletion of your data.