Privacy Policy

1. Introduction

Welcome to AnyCutlist, formerly known as CAI Intake. AnyCutlist is provided by Positive Social Digital Ltd, a company incorporated in Kenya ("we," "our," or "us"), which operates the service and is responsible for this Privacy Policy. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cutlist management platform and related services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, organization name. If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Profile Information: Job title, phone number, profile picture
• Cutlist Data: Part dimensions, materials, edgebanding and machining operations, quantities, customers, and project specifications
• Production Data: Job and task schedules, machine assignments, quality-control (QC) results, operator assignments, and order-tracking status
• Uploaded Files: Photos, scans, PDFs, spreadsheets (CSV/Excel), and text you upload or paste so we can extract cutlist data from them
• Payment Information: Billing details and payment method information, collected and processed by our payment provider (Paystack). We do not store full card numbers on our servers.
• Communications: Messages you send to our support team
• Connections: When you create an API key or connect an AI assistant or an integration, its name, the permissions you gave it and when it was used. Keys and access tokens are stored only in a form that cannot be turned back into the key.

2.2 Your Customers' Information

Your organization may store information about its own customers in AnyCutlist, such as names, contact details and the cutting lists they send, including lists they submit through an intake link or a messaging integration your organization sets up. Your organization decides what it collects about its customers and why; we process that information on your organization's behalf, only to provide the Service.

2.3 Automatically Collected Information

• Usage Data: Features used, time spent, actions performed
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed, error logs
• Cookies and local storage: Cookies that keep you signed in, and settings saved in your browser (see section 8). We do not use advertising or third-party analytics cookies.

2.4 Public website measurement

On our public pages we record approved page paths, article engagement, signup clicks and signup-form progress, together with a coarse referral category (such as Google or direct). These events contain no names, email addresses, form values, customer documents, full referral URLs or search queries. They are not linked to your account or organization. The random journey identifier that groups them is held only in your browser tab’s memory for up to 30 minutes and disappears when you close the tab — nothing is written to your device, so no cookie or storage permission is required. Do Not Track and Global Privacy Control disable this collection automatically.

Events expire after 90 days and are removed by scheduled cleanup. Aggregate reports are restricted to platform administrators. You can switch measurement off at any time using Website measurement at the bottom of public pages. That choice is the one thing we do store on your device (a single local-storage entry), because it is the only way to keep honouring it. Switching off stops future collection and ends the current journey; it does not erase previously collected events. Normal hosting/security logs and temporary abuse-prevention counters remain separate from this measurement.

3. How We Use Your Information

• Provide, maintain, and improve our services
• Process your cutlists and optimization requests
• Send transactional emails (confirmations, notifications)
• Provide customer support and respond to inquiries
• Analyze usage patterns to enhance user experience
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations

3.1 AI and Automated Processing

A core part of the Service uses artificial intelligence to read your input — handwritten notes, photos, scanned PDFs, spreadsheets, pasted text, and voice — and convert it into structured cutlist data. To do this, the relevant content is sent to third-party AI providers (currently Google, OpenAI, and Anthropic) for processing on our behalf. These providers act as our processors and are contractually restricted to using the content only to return results to us; we do not permit them to use your content to train their public models. We also store your corrections to improve matching and accuracy within your own organization. AI output is an estimate and is surfaced for your review — please do not upload images or documents containing sensitive personal information you do not want processed this way.

3.2 AI Assistants You Connect

You can connect an AI assistant of your choice, such as Claude, ChatGPT or a coding tool, to your organization in AnyCutlist, by signing in from the assistant or with an API key. A connected assistant can only do what the connection allows, as shown when you connect it: read the cutting lists you give it, see your boards, edging and cut lists, save draft cut lists, and ask for quotes and machine files, which a person in your organization approves. Whatever the assistant reads is sent to that assistant's provider, which handles it under its own terms and privacy policy: you choose that provider, and it is not our processor. Only office roles can connect an assistant, organization admins can see and disconnect every connection in Settings, API & Connections, and actions taken through a connection are recorded in your organization's audit log.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers (Subprocessors): With vendors who help us operate the platform, such as hosting and data storage, payment processing, AI and document processing, and email delivery. Each processes data only as needed to provide their service to us. Customers who need a current list of our subprocessors can request one.
• Organization Members: With other members of your organization as permitted by your admin settings and assigned roles
• AI Assistants You Connect: With an AI assistant you or your organization connect (section 3.2), limited to what that connection allows
• Integrations Your Organization Connects: If an admin connects an accounting system such as Zoho Books, the customers and quotations chosen for sync are sent to your organization's account there, under that provider's terms
• Links You Share: Anyone who has a share link to a cut list, or an intake link your organization publishes, can use it as that link allows, until you turn it off
• Legal Requirements: When required by law, subpoena, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize sharing

5. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/SSL) and at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements, with each organization's data kept separate and access limited by role
• Passwords, API keys and access tokens stored only in hashed form
• Employee training on data protection
• Incident response procedures

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account deletion, we may retain certain data for legal compliance, dispute resolution, and fraud prevention for up to 7 years. Cutlist data may be anonymized and retained for analytics purposes.

Some records are removed automatically while your account is active: uploads from a public intake link that nobody claims after 2 days, export records after 7 days, uploaded files no longer attached to anything after 30 days, per-request API access logs after 30 days, parse and optimization job records after 90 days, security events after 90 days, and audit logs after a year. Your cut lists, quotes and the files attached to them stay until you or your organization delete them.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your data
• Portability: Receive your data in a structured format
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw previously given consent

If your organization stores your information as its customer (section 2.2), please contact that organization first; we will help it respond. You can also complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.

To exercise these rights, email us at admin@positivesocialdigital.com.

8. Cookies and Tracking

We use cookies only to keep you signed in and secure; the Service does not work without them. The app also saves settings in your browser's local storage, such as your layout and view choices, and your choice about website measurement (section 2.4). We do not use advertising or third-party analytics cookies. Videos on our pages load from YouTube only when you press play; YouTube then handles that view under Google's privacy policy. You can clear cookies and local storage in your browser settings; you will then be signed out.

9. International Data Transfers

Our database is hosted in the European Union (Sweden), and the application runs in the United States. Our AI, email and other providers may process data in the United States and other countries, so your data may be processed in countries other than your own. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, when transferring data internationally.

10. Children's Privacy

Our services are not intended for users under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: