This page explains what personal data VectoCut handles and what you can do about it. We try to keep it short and plain. It also serves as our Personal Data Treatment Policy (Política de Tratamiento de Datos Personales) under Colombian Ley 1581 de 2012 and Decreto 1377 de 2013.
1. Who is responsible
The data controller (Responsable del Tratamiento) is:
- Name: Esteban Adrian Restrepo Escobar, an individual (persona natural), not a company
- Location: Bogotá, Colombia
- Contact for anything about your data: support@vectocut.com
“VectoCut”, “we” and “us” refer to the individual who runs the website vectocut.com.
2. What we collect and why
| Data | Why we need it | How long we keep it |
|---|---|---|
| Email address and country | Create your account, sign you in with an email code, send receipts and service messages | While your account exists |
| Account identifier (Amazon Cognito user id) | Link your account to your credits and history | While your account exists |
| Lemon Squeezy order ids, purchases (amount, plan, date, refund status) | Match payments to credits, handle refunds | While your account exists (see section 5 for legal records) |
| Credit lots and credit movements | Show your balance and prevent misuse | While your account exists |
| Conversion history: date, machine profile, formats, status, and the date you agreed to start a download (withdrawal consent) | Show your history, support you, keep proof of your consent | While your account exists |
| Images you upload and the files we generate (SVG, DXF, PDF, preview) | Only to make your files | Deleted automatically after about 24 hours, at most 48 |
| Hashed IP address (a one-way code, not the IP itself) for anonymous visitors; your account id for signed-in users | Daily free-preview limits and abuse prevention | Deleted automatically within 2 days after the day it counts. It is not stored anywhere else (not on your previews) |
| Technical logs (may include a shortened hash of your IP address, request time, errors) | Keep the service running and secure | 7 days |
We do not see your card number. Payment details are entered only on Lemon Squeezy, never on vectocut.com.
3. Your images
- We use your images only to produce your files.
- We do not use them to train models, we do not sell them, and we do not share them for advertising.
- Uploaded images and generated files are deleted automatically about 24 hours after upload (the cleanup runs daily, so at most 48 hours).
- The watermarked preview picture can be opened through a link that works for about an hour. While the files exist, anyone who knows the preview’s private id can ask for a new link. Do not share it if the image is private.
- Do not upload personal data of other people unless you have the right to.
4. Who else handles data
We use these providers to run the service. They process data on our behalf, under their own security measures and terms.
| Provider | What it does | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, database, sign-in by email code (Amazon Cognito), emails | United States (us-east-1, N. Virginia) |
| Cloudflare | CDN, DNS, bot protection (Turnstile) | Global network |
| Lemon Squeezy | Payments. It is the merchant of record: it sells to you, charges you, handles VAT and sales tax, and issues receipts. Its own terms and privacy policy apply to your purchase | Provider’s own locations |
We use Umami, a privacy-friendly analytics tool, to count visits and a few anonymous usage steps (for example: image selected, preview requested, sign-in started, checkout started, download completed, pricing page viewed). Each event carries only the language and the page, with no personal data. Umami does not use cookies and does not track you across sites.
We do not sell personal data. We may disclose data if a competent authority legally requires it.
5. How long we keep data
- Images and generated files: about 24 hours (at most 48).
- Logs: 7 days.
- Hashed IP (and account id) for daily limits: deleted automatically within 2 days after the day it counts.
- Account, purchases, credits and conversion history metadata: while your account exists. When you ask us to delete your account we delete them, except records we must keep by law (for example payment and tax records, which Lemon Squeezy also keeps as merchant of record).
- Secure backups of account and purchase tables may keep deleted data for a short time (up to about 35 days) before they expire.
6. Cookies and local storage
- We use no cookies for tracking or advertising.
- Your browser’s local storage keeps your sign-in session tokens so you stay signed in, your choice on the withdrawal-consent box before downloading, and a daily preview count shown on the page. This is technically necessary for the service, so it needs no consent banner. You can clear it by signing out or clearing site data.
- Cloudflare Turnstile may use technical signals to tell humans from bots.
7. Your rights (Colombia: Ley 1581 de 2012)
As data subject (Titular) you have the right to:
- Know what data we hold about you and how we use it.
- Update and rectify it if it is incomplete or wrong.
- Ask for proof of the authorization you gave us.
- Be informed about how we have used your data.
- Delete your data and revoke your authorization, when the law allows and we have no legal duty to keep it.
- File a complaint with the Superintendencia de Industria y Comercio (SIC), after first asking us.
- Access your data free of charge.
How to use them: write to support@vectocut.com from the email of your account, say what you want, and give us enough detail to identify you. We will answer:
- Queries (consultas): within 10 business days. If we need more time we will tell you why, and answer within 5 more business days.
- Claims (reclamos: correction, deletion, revocation): within 15 business days. If we need more time we will tell you why, and answer within 8 more business days.
If your claim is incomplete we will ask you to complete it within 5 days. Deletion or revocation is not possible while you have a legal or contractual duty with us (for example, an unresolved payment).
Authorization. By creating an account and accepting this policy you authorize us to process your data for the purposes in section 2. We do not ask for sensitive data and do not need it. If you send any by mistake, answering questions about it is always optional.
International transfer. Our providers are mainly in the United States, so your data is transferred and transmitted there. The United States is on the list of countries the SIC considers to have adequate protection, and by accepting this policy you authorize the transfer.
8. Legal bases and your rights (European Union and UK, GDPR)
If you are in the EU, EEA or UK, we process your data on these legal bases:
- Contract (Art. 6(1)(b)): account, conversions, credits and purchases.
- Legitimate interests (Art. 6(1)(f)): security, abuse prevention, quotas and logs.
- Legal obligation (Art. 6(1)(c)): records we must keep by law.
- Consent (Art. 6(1)(a)): when we ask for it, and you can withdraw it at any time.
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Write to support@vectocut.com. You also have the right to complain to your local data protection supervisory authority.
International transfers. Your data is processed in the United States and by providers with global operations. Where required, transfers rely on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses offered by our providers.
9. Brazil (LGPD)
If you are in Brazil, under Lei Geral de Proteção de Dados (Lei 13.709/2018) you may ask us to confirm that we process your data, access it, correct it, anonymize, block or delete it, receive it in portable form, know who we share it with, and revoke consent. Write to support@vectocut.com. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD). Our legal bases are those in section 8, in their LGPD equivalents (contract, legitimate interests, legal obligation, consent). Data is transferred to the United States as described above.
10. United States (California and other states)
We do not sell or share personal data for advertising, and we do not use it for cross-context behavioral advertising. If you live in California or another US state with a privacy law, you may ask to know, access, correct or delete your personal data, and we will not discriminate against you for asking. Write to support@vectocut.com.
11. Children
VectoCut is not for children. You must be at least 18, or the age of majority where you live if higher. In the European Union you must be at least 16. If we learn that a younger person has an account, we will delete it. Parents can write to support@vectocut.com.
12. Security
Connections use HTTPS. Files are stored privately and deleted automatically. Sign-in uses one-time email codes, so there is no password to steal. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
13. Changes
If we change this policy in a meaningful way we will update the date above and, if the change affects your rights, tell you by email or on the website.
14. Contact
Questions, rights requests, abuse reports: support@vectocut.com. Last updated: 2026-11-04.