Privacy
This explains what Roll & Cut collects when you use it, who else sees it, and how long it is kept. It is written in plain language on purpose. If anything here is unclear, write to support@rollandcutlabs.com and we will explain it.
Last updated: September 14, 2026. Roll & Cut is operated from the United States.
What we collect
Your account
Your email address, and your name and profile picture if the service you signed in with gave us one. If you signed up with a password we store a one-way scramble of it, never the password itself. If you signed in with Google or GitHub we store which service it was and the account identifier they gave us, so we can recognize you next time.
What you make
The prompt you write, the settings you choose, and everything the pipeline produces from them: the script, the images, the voices, the music and the finished film. We also keep a record of what each stage cost, so your credit balance can be explained rather than asserted.
Payment
Payments are handled entirely by Stripe on Stripe’s own pages. We never see or store your card number. We keep the customer identifier Stripe gives us, and your subscription status.
If you claim the free tier’s one-time credit grant, we also keep a fingerprint of the card — a short code Stripe derives from it, which is the same for the same card and cannot be turned back into card details. That is how we make sure the free grant is given once per person rather than once per email address.
Technical
Ordinary web server records, and your IP address for a couple of hours at a time so we can stop somebody hammering the sign-up and password-reset forms. We use Sentry to collect error reports when something breaks, with a filter that strips credentials and personal detail before the report leaves our servers.
Who else sees it
Roll & Cut is an orchestration layer over other companies’ models. To make your film, the words you write and the material the pipeline generates are sent to the model providers a production uses. Today those are OpenAI, Anthropic, Google, xAI, Runway, Black Forest Labs and ElevenLabs. Which ones are involved depends on the settings you pick. Each has its own terms and its own privacy policy, and each applies its own content filtering to what it receives.
We also rely on these companies to run the product: Vercel and Fly.io host it, Supabase stores the database and the files, Upstash runs the job queue, Resend sends email, Stripe takes payment, and Sentry collects error reports. OpenAI and Mistral screen prompts for content we are not willing to produce.
We do not sell your personal information, and we do not use your prompts or your films to train anything. We will hand over information if the law requires it.
Content you are shown, and content you make
Prompts are screened before they reach a model. Films we produce carry embedded metadata marking them as AI-generated, which is standard practice and, in some places, law.
How long things are kept
Your account and its productions are kept while your account exists. The files a production makes are kept for at least 14days after it finishes or stops — including a production left waiting for your review — and are then deleted. We email you a week before and again the day before. The production itself stays in your account, with its prompt, script and cost.
Two records deliberately outlive a deleted account, and we would rather you read it here than discover it:
- The free-grant record. A one-way scramble of the email address and the card fingerprint, with no name, no address and no way to recover either from it. Without this, deleting an account and signing up again would collect the free credit grant a second time, and the free tier would have no floor.
- The email log.Which kind of message was sent and when, against a one-way scramble of the address. The link to your account is removed when the account is. It exists so that “did the password reset actually send?” has an answer.
Stripe keeps its own payment records for as long as its own obligations require, and that is outside our control.
Cookies
One cookie, to keep you signed in, plus a small preference for whether the sidebar is collapsed. No advertising cookies and no third-party tracking.
Your choices
You can change your name, your email preferences and your password in Settings. Every notification email can be switched off there except the ones an account cannot work without: password resets, confirmation links, and the warning before a paused production closes for good.
To get a copy of what we hold about you, correct it, or have it deleted, write to support@rollandcutlabs.com. Deleting an account removes it and its productions, with the two exceptions named above.
Children
Roll & Cut is not for anyone under 13, and we do not knowingly collect anything from them. If you believe a child has an account here, write to us and we will remove it.
Changes
If this policy changes in a way that matters, the date at the top changes and we will say so by email before it takes effect.