Privacy notice
Version: cutpilot-2026-10-17.1
Data controller
České brány, s.r.o., Company ID 08567271
Čujkovova 1714/21, Ostrava
Privacy contact: ceskebrany@gmail.com
Data and purposes
We use your email, account ID and role to provide your account; email sign-in stores only a secure password hash. Your drawings, revisions, settings and estimates are processed to provide the requested service and take pre-contractual steps. Sessions, one-time links and rate limits protect our legitimate security interests. Accounts are not conditional on marketing or analytics consent.
Retention and account deletion
Account data is retained while the service is used. Customers can delete their own account; manufacturers can delete customer accounts. After password reauthentication, access is blocked immediately and sessions and links are revoked. Private drawings, revisions, estimates and analytics are deleted. Interrupted cleanup can be resumed while the account remains blocked. A minimal technical deletion record without email or password remains. Separate accounting or contractual records outside CutPilot are subject to their own legal retention obligations.
Security and expiry
Email sessions last at most 8 hours. Setup and recovery links expire after 30 minutes, are single-use, and only their hash is stored. Password changes and resets revoke existing sessions. Rate limit records are removed after their window, at most one hour. Only the account owner sets their password.
Recipients
Infrastructure uses ChatGPT Sites / OpenAI and Cloudflare. When email delivery is enabled, Resend processes the recipient and message for delivery. Cloudflare Turnstile processes technical browser and connection data for security checks. Libraries remain private to each account. Internal rates and traffic reports are manufacturer-only. We do not sell personal data. Providers may process data outside the EEA; ask the controller for locations and transfer safeguards.
Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction, portability and object to processing. Account data can be downloaded from My account; drawings can be exported from the editor. Optional analytics consent can be withdrawn at any time. Contact us above; we may verify identity. We normally respond within one month. You may complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů (uoou.gov.cz). Automatic indicative estimates do not themselves approve manufacturing.