Privacy Policy

1. Overview

DirectCut (“we,” “us,” or “our”) operates an independent film marketplace at directcut.co. This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and your rights regarding it. By using the Platform you agree to the practices described here.

2. Information We Collect

Information you provide

• Account data — first name, last name, email address, bio, website URL, and film genre preferences you provide when creating a Filmmaker account.
• Content — films, thumbnails, titles, descriptions, and metadata you upload to the Platform.
• Communications — messages you send to us via email or support channels.

Information collected automatically

• Log and usage data — IP address, browser type, operating system, referring URLs, pages visited, and timestamps, collected by Cloudflare as part of serving the Platform.
• Session tokens — short-lived tokens stored server-side to authenticate magic-link sign-in sessions. We do not use persistent browser cookies for authentication.
• Rental and viewing history — records of which films a Viewer has rented or accessed.
• Bot-detection signals — Cloudflare Turnstile collects browser and interaction signals solely to distinguish humans from bots during form submission. No data collected by Turnstile is used for advertising.

Information from third parties

• Stripe — when you make or receive a payment, Stripe shares with us a transaction ID, amount, currency, and whether the transaction succeeded. We do not receive or store your full card number, CVV, or bank account details; those remain with Stripe.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Authenticate your identity via magic links
• Process payments and distribute earnings to Filmmakers
• Deliver transactional emails (magic links, rental receipts)
• Grant Viewers access to films they have rented
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Operate, maintain, and improve the Platform
• Comply with legal obligations

We do not use your personal information to serve behavioral advertising, and we do not sell your personal information to third parties.

4. How We Share Your Information

We share personal information only as described below. We do not sell your data.

Service providers

• Cloudflare — hosts and serves the Platform (Workers, Durable Objects, R2 storage, Stream video, KV, Turnstile). All data is processed on Cloudflare infrastructure. See the Cloudflare Privacy Policy for details.
• Stripe — processes all payments. Filmmakers who receive earnings connect a Stripe account and are subject to Stripe’s Privacy Policy and Connected Account Agreement.
• Resend — delivers transactional emails (magic links, receipts). Resend receives the recipient email address and email content for delivery purposes only.

Legal and safety

We may disclose personal information if we believe in good faith that doing so is necessary to: (a) comply with applicable law or a valid legal process; (b) protect the rights, property, or safety of DirectCut, our users, or the public; or (c) detect, prevent, or address fraud or security issues. We are required by law to report child sexual abuse material (CSAM) to NCMEC and relevant authorities, which may include associated account information.

Business transfers

If DirectCut is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

Public information

A Filmmaker’s name, bio, website, and uploaded films are displayed publicly on the Platform. Do not include information in your public profile that you wish to keep private.

5. Cookies and Tracking

The Platform does not use advertising cookies or third-party tracking pixels. Cloudflare may set cookies necessary for security, performance, and bot detection as part of serving the Platform. These are strictly functional and are not used for cross-site tracking or advertising.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will remove your personal information from active systems within a reasonable period, except where retention is required by law (for example, financial records related to completed transactions) or where data is contained in backups that are purged on a regular schedule.

Rental records and earnings data are retained for at least seven (7) years for tax and accounting purposes.

7. Your Rights

Depending on where you are located, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request deletion of your personal information, subject to legal retention obligations.
• Portability — request a machine-readable copy of information you provided to us.
• Objection / restriction — object to or request restriction of certain processing activities.
• Opt out of sale — we do not sell personal information, so no opt-out is required.

To exercise any of these rights, contact us at legal@directcut.co. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before fulfilling a request.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

8. Children’s Privacy

The Platform is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently collected personal information from a minor, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at legal@directcut.co.

9. Data Security

We use industry-standard technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These include encrypted connections (TLS), server-side session tokens, and access controls on our infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. International Data Transfers

DirectCut is operated from the United States. If you access the Platform from outside the United States, your information may be transferred to and processed in the United States and other countries where our service providers operate (including Cloudflare’s global network). By using the Platform, you consent to this transfer. We take steps to ensure that transfers are made in accordance with applicable law and that your information remains protected.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy with a new effective date. For material changes, we will provide additional notice (such as an email to registered Filmmakers). Your continued use of the Platform after the revised policy takes effect constitutes your acceptance.

12. Contact

Questions, requests, or complaints regarding this Privacy Policy may be directed to: