Privacy Policy - CutAssist and PixAssist
Version 1.0 | Effective from: [SALES START DATE]
This document describes what happens to data when you buy and use CutAssist or PixAssist. It describes the facts: what actually leaves your computer, not what sounds good in an advert.
1. Data controller
Dominika Kuś, a sole individual trading as an unregistered business, Poland.
Contact for data protection matters: support@buildwith.it
2. The short version
- We have no cloud of our own. CutAssist and PixAssist run on your computer.
- We collect no telemetry. No usage statistics, no automatic crash reports, no background update checks, no analytics inside the plug-in.
- Your projects, photographs and edits never reach us. Not once.
- Data leaves your computer in two directions: to the licence server (the minimum needed to check your key) and to the AI provider that you choose and pay for (Claude). We are not a party to that second relationship.
3. Buying the subscription
The seller is Lemon Squeezy, LLC (United States), acting as Merchant of Record. At checkout you give your data directly to them: email address, payment details, country and tax information. Lemon Squeezy processes it as an independent controller under its own privacy policy (https://www.lemonsqueezy.com/privacy).
As the merchant selling the product in that store, we can see in the Lemon Squeezy dashboard: the buyer's email address, country, product and variant name, subscription status and payment history (no card number). We process that data as a controller, in order to handle licences, support and accounting.
- Legal basis: article 6(1)(b) GDPR (performance of the licence agreement and handling support requests) and article 6(1)(c) GDPR (accounting and tax obligations).
- Retention: for the term of the subscription and 6 years afterwards where the data is covered by accounting obligations; otherwise up to 12 months after the subscription ends.
4. Licensing: what leaves your computer
The Software contacts the public Lemon Squeezy licence endpoint (api.lemonsqueezy.com) in three situations: activation, periodic validation (every 3 days) and deactivation. It then sends:
| Data | Note |
|---|---|
| licence key | the one emailed to you after purchase |
| random device name | not your computer's name: a random string generated on first run |
| instance identifier | issued by Lemon Squeezy at activation |
| IP address | as with any internet connection, recorded by the recipient |
- Purpose: to check whether the licence is active and to enforce the 2-computer limit.
- Legal basis: article 6(1)(b) GDPR (performance of the contract) and article 6(1)(f) GDPR (our legitimate interest in protecting the software against unauthorised use).
- Lemon Squeezy's role here: processor, under a data processing agreement (https://www.lemonsqueezy.com/dpa).
- With licensing turned off (internal builds, not the version sold) the Software does not contact the licence server at all.
What is not in there: your email address (we do not pass it to the AI model and do not store it in the licence file), your computer's name, project names, or any content of your work.
5. What stays on your computer
The Software writes the following locally, in the application data directory:
- licence file - licence key, instance identifier, date of last validation. No email address. The file is signed with a key tied to this particular computer, so copying it to another machine will not work,
- device identifier - a random string, not your computer's name,
- bridge server log - contains file and project paths, rotated once it reaches 5 MB,
- screenshots of the Adobe application window in the temporary files directory - kept for a maximum of 24 hours, then deleted,
- OCR working file - deleted after use.
None of this is sent to us. It stays with you.
Removing everything: uninstalling with the data purge option (uninstall --purge) releases the licence on the server and deletes the files listed above.
6. The AI provider you choose
The Software is a bridge between your Adobe application and an AI model that you choose and pay for (Claude from Anthropic, in Claude Code or Claude Desktop).
To the extent required by your instructions, the following reaches that provider:
- screenshots of the Adobe application window (images),
- text recognised from the interface (OCR),
- project and media file paths,
- names of sequences, compositions, layers and clips,
- dialogue and caption text, if you are working on it,
- fragments of the bridge server log,
- licence status (without your email address).
This is a relationship between you and your AI provider. We do not receive, store or have access to that data. In relation to your AI provider you are the controller of that data, on the terms of your agreement with them. Anthropic's terms: https://www.anthropic.com/legal/privacy
Practical advice: if you work on material covered by confidentiality obligations or an NDA, check the terms of your AI plan before you have the Software operate on such projects.
7. Adobe
- Some PixAssist features use Adobe's AI features, which run in the Adobe cloud on your Adobe account (for example subject selection, background removal, generative fill). You enable them yourself. Data sent to Adobe is subject to Adobe's terms and your agreement with Adobe.
- The Software reads menu names from your Adobe installation so it can show them in your language. That is a local read.
- We do not use output produced in Adobe applications to create, train, test or improve AI models.
8. Installation
Installation downloads dependencies from the public npm registry (registry.npmjs.org). The registry records your IP address in the process, as with any file download. This is a standard part of installing Node.js-based software.
9. The buildwith.it website
On the product subpages (/cutassist, /pixassist) and the welcome pages (/welcome) we use measurement tools. The first one works without cookies; the others run only after you give consent in the consent banner. You can change or withdraw your consent at any time under "Cookie settings" in the site footer.
Without consent (no cookies):
- Umami Cloud: number of visits, pages viewed, the referring page, device and browser type, country. Umami stores nothing on your device and does not keep your IP address. Legal basis: article 6(1)(f) GDPR (our legitimate interest in simple visit statistics).
After consent to analytics:
- Google Analytics 4: traffic sources, on-page behaviour (scrolling, button clicks, video plays, FAQ opens), moving on to checkout. It runs in Consent Mode v2: without consent the script is not loaded.
- Microsoft Clarity: session recordings and click maps, so we can see where the page is unclear. Anything you type on the page is masked and does not appear in recordings.
After consent to marketing:
- Meta Pixel (Facebook, Instagram): page and product view events and clicks on a plan button.
- Meta Conversions API: after a purchase, Lemon Squeezy notifies our server, and the server sends Meta a trial-started or subscription-paid event. We send: the event name and time, its identifier (so Meta does not count the purchase twice), your email address in hashed form (SHA-256), Meta cookie identifiers (
fbp,fbc), your IP address and browser information, the order value and currency, and the product name. If there was no marketing consent at the time of purchase, the server sends nothing to Meta.
Legal basis for the tools that run after consent: article 399 of the Polish Electronic Communications Law (storing information on your device) and article 6(1)(a) GDPR (consent).
Data passed to checkout. When you click a plan button, we pass to Lemon Squeezy, together with the order: your consent choices, an event identifier, campaign parameters from the page address (e.g. utm_source) and the page you came from. Meta and Google identifiers are passed only with the matching consent. This data is used to link the purchase to the ad that led to it.
Retention: statistical and advertising data is kept for no longer than 14 months; the tool providers may apply shorter periods (see their policies).
Website hosting: the site runs on Vercel Inc. infrastructure, which records the IP address of each visit in technical server logs (article 6(1)(f) GDPR: security and operation of the site).
The controller of measurement data on the plug-in subpages is Dominika Kuś. The site's technical operator, Nicolas Woroszyło, processes this data on her behalf as a processor, under a written data processing agreement.
10. Recipients - summary
| Recipient | What they receive | Role |
|---|---|---|
| Lemon Squeezy, LLC (USA) | purchase and payment data; licence validation data; data passed to checkout (section 9) | independent controller (sale), processor (licensing) |
| Nicolas Woroszyło (Poland) | measurement data and purchase notifications, for the technical operation of the site | processor |
| Vercel Inc. (USA) | technical server logs of the site | processor (sub-processor of the site operator) |
| Upstash, Inc. (data stored in the EU, Frankfurt) | one-time discount codes and the founding-price seat counter | processor (sub-processor of the site operator) |
| Google (Gmail) | messages sent to support@ and security@ | processor (sub-processor of the site operator) |
| Slack Technologies (Salesforce group) | subject and sender of messages sent to support@ (no message content) | processor (sub-processor of the site operator) |
| Umami Software, Inc. | cookie-less visit statistics | processor |
| Google Ireland Ltd. | traffic statistics (GA4), after your consent | processor |
| Microsoft Ireland Operations Ltd. | session recordings and click maps (Clarity), after your consent | under the Microsoft Clarity terms |
| Meta Platforms Ireland Ltd. | advertising and purchase events, after your consent | joint controller for collecting and transmitting the data, independent controller afterwards |
| Your AI provider (Anthropic) | the data in section 6 | your relationship with the provider; we are not a party |
| Adobe Inc. | data from Adobe AI features you enable yourself | your relationship with Adobe |
We do not sell data and we do not share it with data brokers.
11. Transfers outside the European Economic Area
Lemon Squeezy and Vercel are established in the United States; Umami, Google, Microsoft and Meta may also process data outside the EEA. Transfers rely on:
- Commission Implementing Decision (EU) 2023/1795 on adequacy (the EU-US Data Privacy Framework), which is in force. The General Court upheld it in its judgment of 3 September 2025 in case T-553/23 (Latombe); appeal C-703/25 P is pending and, as at today's date, no court has annulled the decision,
- standard contractual clauses used by these providers as an additional basis, or as the only basis where a provider is not certified under the Data Privacy Framework.
If the adequacy decision ceases to apply, transfers will rely on the standard contractual clauses together with a transfer impact assessment.
12. Your rights
You have the right to: access your data, have it corrected or erased, have processing restricted, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing carried out beforehand).
Send requests to support@buildwith.it; we reply within one month.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. If you live in another EEA country, you may complain to your local authority.
13. Automated decisions and children
- We do not profile you and we do not take decisions about you based solely on automated processing that would produce legal effects.
- The product is intended for people doing professional work and is not directed at anyone under 18. We do not knowingly collect children's data.
14. Security
The local bridge server is protected by an access token stored in a file readable only by your user account, and connections originating from web pages are rejected. The licence file is signed with a key tied to your computer. Report vulnerabilities to security@buildwith.it - we respond within 72 hours.
15. Changes to this policy
We will give notice of material changes at least 14 days before they take effect, by email to the address linked to your purchase or on the product page. Version history remains available on this page.
Controller: Dominika Kuś, Poland Contact: support@buildwith.it | Security: security@buildwith.it
The English version is binding. For consumers living in Poland, the Polish version applies.