Last updated: 20 October 2026
This policy explains what personal data we collect when you use Barcut Pro (barcutpro.com, app.barcutpro.com and the Engine API), why we collect it, and the rights you have over it. We collect as little as we can: we do not sell personal data, we do not run advertising, and analytics are kept to what we need to understand how the product is used.
Who is responsible for your data
The controller of your personal data is Ahmed Burhan, a sole trader based in Ireland, trading as Barcut Pro.
For anything to do with privacy, including exercising your rights, email hello@barcutpro.com.
What we collect and why
Using the optimizer without an account
- A random anonymous identifier in a cookie (
bp_anon), together with a count of the optimisations you have run. This lets us apply the free-use limit. - A one-way keyed hash of your IP address. We use this to apply a wider limit per network. We never store your actual IP address, and the hash cannot be turned back into one.
Legal basis: our legitimate interest in offering free use without the free tier being abused (GDPR Art. 6(1)(f)).
Your account
- Email address and password. Your password is stored only as a secure hash by our authentication provider.
- Display name, if you choose to set one.
- Organisation membership and role, if you create or join an organisation.
Legal basis: performing our contract with you (Art. 6(1)(b)).
Your content
Cutting lists, parts, stock records, profiles, projects, saved results, allocations and the machine settings you save. This is not normally personal data, but it may contain names, such as a client's name in a project title.
Legal basis: performing our contract with you (Art. 6(1)(b)).
Subscriptions and payments
- Your subscription status, plan, trial dates and Stripe customer reference, which we store.
- Card details and billing address, which you enter directly with Stripe. We never receive your full card number.
- A one-way hash of your email address, recorded when you start a trial so that each person gets only one trial.
Legal basis: performing our contract with you (Art. 6(1)(b)). Our legal obligation to keep accounting and tax records (Art. 6(1)(c)). Our legitimate interest in preventing repeated free trials (Art. 6(1)(f)).
API keys
If you create API keys, we store a hash of each key, its name and when it was last used, so we can authenticate your requests and show you which keys are active.
Legal basis: performing our contract with you (Art. 6(1)(b)).
Product analytics
We use PostHog, hosted in the EU, to understand which features are used and where people get stuck. Examples include "an optimisation was started", "an export was completed", and the page and route on which these happened. If you are signed in, events are linked to your internal account ID, never to your email address.
We never send PostHog your cutting-list contents, names, lengths, quantities, prices, email address or payment details. Session recording, heatmaps and automatic click capture are switched off. PostHog does not set cookies or store anything on your device: its identifier is kept in memory and discarded when you leave or reload the page.
We also use Vercel Web Analytics, which counts page views without cookies and without identifying you.
Legal basis: our legitimate interest in understanding and improving the product (Art. 6(1)(f)). You can object at any time (see Your rights).
Emails
We send emails that are necessary to provide the Service, such as confirming your address, resetting your password, warning you before a trial ends, and notices about your subscription or these policies. If you ask to be notified when 2D nesting launches, we store your email address for that one notification. We delete it once the notification has been sent, or earlier if you ask us to.
Legal basis: performing our contract with you (Art. 6(1)(b)). Your consent for the 2D launch notification (Art. 6(1)(a)), which you can withdraw at any time.
When you contact us
The content of your message and your email address, so we can reply.
Legal basis: our legitimate interest in answering you (Art. 6(1)(f)).
Security and server logs
When you use the Service, our hosting provider automatically processes technical data, such as your IP address, browser type and the time of each request, to deliver pages and protect the Service against abuse.
Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f)).
We do not use your data for automated decisions that have legal or similarly significant effects on you.
Who processes your data for us
We use these service providers. Each one processes personal data only on our instructions, under a data processing agreement, except where stated otherwise.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database and user authentication | EU (Ireland) |
| Vercel | Website hosting, server functions, cookieless page-view analytics | Functions run in the EU (Dublin); global content delivery network |
| Stripe | Payment processing, subscriptions and invoices | EU and US |
| PostHog | Product analytics | EU |
| Resend | Sending account and service emails | US |
Stripe acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations. Its privacy policy applies to the data you give it directly.
Buy Me a Coffee. If you open the "Buy me a coffee" support window, it loads from Buy Me a Coffee, which is a separate company. Any payment you make there is handled entirely by them, under their privacy policy.
We may also disclose data if the law requires it, or to protect our rights or the safety of others. If the Service were ever transferred to a new owner, your data would go with it, under the same protections.
International transfers
Where a provider processes data outside the European Economic Area, mainly in the United States, the transfer is protected by the EU–US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission's Standard Contractual Clauses. You can ask us for details.
How long we keep it
| Data | How long |
|---|---|
| Account and content | Until you ask us to delete your account. If you subscribed, see the next row |
| Billing and invoice records | Six years after the end of the tax year they relate to, as required by Irish tax law |
| Trial-eligibility hash | As long as we offer free trials, so that each person gets only one |
| Anonymous identifier cookie | Up to 12 months in your browser |
| Anonymous usage counts and IP hashes | As long as they are needed to apply the free-use limits |
| Product analytics events | Up to 24 months |
| 2D launch notification email | Until the notification is sent, or until you ask us to remove it |
| Emails you send us | Up to 24 months after the conversation ends |
| Server logs | A short period set by our hosting provider, normally days to weeks |
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate;
- delete your data ("right to be forgotten"). Email us and we will delete your account and content. We keep only the billing records we are legally required to keep;
- restrict how we use your data while a concern is resolved;
- portability: receive data you gave us in a machine-readable format;
- object to processing based on our legitimate interests, including product analytics;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email hello@barcutpro.com from the address on your account. We may ask you to confirm your identity. We will respond within one month.
You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland (dataprotection.ie), or to the supervisory authority in the EU country where you live. We would appreciate the chance to resolve your concern first.
Security
Data is encrypted in transit (HTTPS) and at rest. Access to the database is restricted by row-level security, so each account can reach only its own data and data shared with it. Our own access is limited to what is needed to run and support the Service. No system is perfectly secure, but if a breach affecting your data occurs, we will notify you and the Data Protection Commission as the law requires.
Children
The Service is not intended for children, and you must be at least 16 to create an account. If you believe a child has given us personal data, contact us and we will delete it.
Cookies
See our Cookie Policy for the cookies and browser storage the Service uses.
Changes to this policy
If we make material changes to this policy, we will tell account holders by email before they take effect. The "Last updated" date above always shows the current version.