Legal

Privacy Policy

Last updated: October 3, 2026

Short version: we only collect what you type into our order form so we can make your video. We don't sell your data, we don't run ads or tracking cookies on this site, and you can ask us to see or delete your data any time.

Who we are

PunchCut Media ("we", "us") makes short-form video ads. This policy covers punchcutmedia.us. Contact: [email protected].

What we collect

When you place an order, we collect what you enter in the form:

Your email address and, if you give it, your name.
Your business name, website and social media handles.
What you sell, your target customers, city or area, your story or script, style choices, song requests, deadline and notes.
The package and add-ons you picked, and the price.
Your agreement to our Terms, this Privacy Policy and our Refund Policy, with the date and time you agreed.

We also record a little technical information to stop spam and fraud: a one-way scrambled (hashed) version of your IP address (we don't store the IP itself), your browser's user-agent string, and the country your request came from.

If you pay with PayPal, the payment happens on PayPal's site. PayPal shares the payment status, your name and email with us. We never see or store your card or bank details.

Why we use it

To make and deliver your video, and to talk to you about your order (our legal basis: performing our contract with you).
To prevent spam, abuse and fraud (legitimate interests).
To keep records for tax and accounting (legal obligation).

We do not sell or rent your personal information, and we don't use it for advertising.

Cookies and local storage

We don't use advertising or tracking cookies. The site uses:

Your browser's session storage to remember your order form answers until you submit or close the tab.
Local storage to remember your cookie choice (Accept or Essential only).
Cloudflare Web Analytics, a cookieless, privacy-first visitor counter. It shows us totals like page views and which pages are popular. It doesn't use cookies, doesn't build a profile of you and doesn't follow you across other websites.
Cloudflare Turnstile, a security check on the order form that tells humans from bots. It may set strictly necessary cookies. See Cloudflare's privacy policy.

Because we only use essential storage and cookieless statistics today, "Accept" and "Essential only" currently work the same way. If we ever add cookies for analytics or ads, we'll update this page and only turn them on if you click Accept.

Who processes your data for us

Supabase stores our order database (hosted in Canada, ca-central-1).
Cloudflare hosts the website, runs the order form backend, keeps a backup copy of orders, provides cookieless visitor statistics and the Turnstile bot check.
Google (Gmail) for email with you.
PayPal if you choose to pay with PayPal.

These companies process data on our behalf under their own security and privacy terms. Some of them may handle data outside your country, including in the United States.

How long we keep it

We keep order records for as long as we need them to deliver your work and handle revisions, and up to 7 years for tax and accounting records. Spam-protection data (the hashed IP for rate limiting) expires within about an hour. You can ask us to delete your data sooner, unless we have to keep it by law.

Your rights

Depending on where you live (for example under the GDPR in the EU/UK, the CCPA/CPRA in California, or PIPEDA in Canada), you can:

Ask what personal information we hold about you, and get a copy.
Ask us to correct it.
Ask us to delete it.
Object to or limit how we use it, or withdraw consent.
Ask for your data in a portable format.
Complain to your local data protection authority.

We don't sell or "share" personal information for targeted advertising as those terms are defined under California law. We won't treat you differently for using your rights. To make a request, email [email protected]. We'll reply within 30 days.

Security

Orders are sent over HTTPS and stored in a database that blocks public access. Only our team can read them. No system is perfectly secure, but we take reasonable steps to protect your data.

Children

Our services are for businesses. We don't knowingly collect information from anyone under 16.

Changes

If we change this policy, we'll update the date at the top of this page.

This page is a plain-English template written for a small business. It is not legal advice. Questions? Email [email protected].