Who we are
What The Cuts is an AI content studio and video editing service run by Faizul Rahman N as a sole proprietor in Tamil Nadu, India. What The Hook is the free AI-powered Instagram audit made by What The Cuts. In this policy “we”, “us” and “our” mean What The Cuts.
We decide why and how your personal data is used. That makes us the “data fiduciary” under India's Digital Personal Data Protection Act 2023 (the DPDP Act) and the “controller” under the UK GDPR and the EU GDPR.
Contact: madeby.whatthecuts@gmail.com or WhatsApp +91 78679 98416.
The short version
- The What The Cuts website has no sign-up, no tracking cookies and no analytics.
- What The Hook asks for an Instagram username and your email address. Your name and mobile number are optional.
- It reads only public Instagram data. It never asks for your Instagram password and does not use any Instagram or Meta login or API.
- We use your email to send your report, and we may contact you about What The Cuts services. You can stop this at any time.
- We do not sell your personal data.
What we collect on the What The Cuts website
- The brief form. “Send via WhatsApp” and “Send via email” open your own WhatsApp or email app with your brief filled in. Nothing is sent to or stored on our website. If you then send the message, we receive it like any other WhatsApp message or email.
- Messages you send us. Your name, phone number or email address and what you write. We use them to reply, prepare a quote and run your project.
- Technical data. Our hosting provider, Cloudflare, processes basic technical data to deliver the site and protect it from attacks, such as your IP address, browser type and the page you asked for. We do not use it to identify or profile you.
What we collect through What The Hook
When you use What The Hook we collect:
- The Instagram username you type in.
- Public data of that account, as Instagram shows it to anyone who is not logged in: profile name, bio, follower, following and post counts, business category and any public contact details or address the account shows, and recent posts and reels (captions, likes, comments, views, dates, length and thumbnails).
- The same kind of public data for a few similar public accounts that the tool finds as competitors.
- Your email address (required), and your name and mobile number with country code if you choose to add them.
- Your time zone, read from your browser, so the report shows times in your local time.
- Your IP address, used to apply the daily free limits and to stop abuse.
- The report itself: scores, AI-written analysis and suggestions, and a simple log of each step (for example “PDF built”, “email sent” or an error) so we can fix problems.
We do not collect Instagram passwords, private messages, content from private accounts, payment details, or sensitive data such as health or financial information. Please do not type sensitive information into the name field. You may use a nickname there.
How we use it, and our legal basis
- To produce and email the report you asked for. Basis: your consent, given on the form (DPDP Act); for UK and EU visitors, taking the steps you asked for (contract).
- To let the owner know a new audit was run. The owner receives an email alert with the username, your name, email, mobile number and a copy of the PDF. Basis: your consent.
- To contact you about your report or What The Cuts services, by email or, if you gave your number, by WhatsApp. Basis: your consent, which you can withdraw at any time.
- To apply fair use limits, prevent abuse and keep the tool secure. Basis: legitimate uses under the DPDP Act; legitimate interests under the UK and EU GDPR.
- To check and improve the accuracy of the tool. Basis: legitimate interests. This stays inside What The Cuts.
- Public Instagram data of the audited account and its competitors. The DPDP Act does not apply to personal data that a person has made publicly available themselves. For the UK and EU GDPR our basis is our legitimate interest in giving you an audit of public content, and we use only what the report needs.
- To meet legal duties, for example tax records or a lawful request from an authority.
International transfers
Our providers run servers outside India, including in the United States and the European Union. Your data may therefore be processed outside India, the UK, the EU or Australia.
The DPDP Act allows this, except to countries the Government of India restricts; none of our providers is in a restricted country at the time of writing. For UK and EU visitors we rely on the safeguards our providers offer for these transfers, such as standard contractual clauses, where they offer them. For Australian visitors, we take reasonable steps to make sure overseas providers handle your data in line with the Australian Privacy Principles.
How long we keep it
- Audit records (username, email, name, mobile number, time zone, IP address, report data and logs): up to 24 months after your audit, then deleted, unless you ask us to delete them sooner or the law requires us to keep them longer.
- Report and lead alert emails in our Gmail account: up to 24 months, the same as audit records.
- The PDF is built when your report is ready and sent by email. We do not keep a separate stored copy of the file, but we keep the report data it was built from.
- Project messages and invoices for What The Cuts clients: as long as the project needs, and then as long as Indian tax and accounting law requires.
Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and how we use it (access);
- correct, complete or update it;
- delete it;
- withdraw your consent (this stops future use for that purpose; it does not undo what was done before);
- stop contacting you about What The Cuts services (reply “unsubscribe” or “stop” to any email or WhatsApp message from us, or email us);
- in India, nominate another person to use these rights for you if you die or become unable to act.
If you are in the UK or the EU, you can also ask us to restrict or stop processing (objection) and to give you your data in a portable format.
How to ask: email madeby.whatthecuts@gmail.com with the subject “Privacy request”, ideally from the email address you used. We may ask you to confirm it is you. We will reply within 30 days.
Grievances and complaints
Grievance contact: Faizul Rahman N, What The Cuts, Tamil Nadu, India. Email madeby.whatthecuts@gmail.com. We aim to resolve every grievance within 30 days.
If you are not happy with our answer you can complain to:
- India: the Data Protection Board of India, after using our grievance process first;
- UK: the Information Commissioner's Office (ico.org.uk);
- EU: the data protection authority in your country;
- Australia: the Office of the Australian Information Commissioner (oaic.gov.au).
Australian visitors
We follow the basics of the Australian Privacy Principles: we collect only what we need, tell you how we use it, let you access and correct it, and take reasonable steps to keep it secure. You can use a nickname instead of your real name in What The Hook. We need a real email address to send your report.
Children
Our website, services and What The Hook are not meant for anyone under 18. Please do not use What The Hook or send us personal data if you are under 18. If we learn that we hold personal data of someone under 18, we will delete it.
Security
The sites use HTTPS. Audit data is stored in a Cloudflare database that only the owner can access. Service keys are kept secret on the server and never in the website code. We collect only what we need and apply daily limits to stop abuse.
No system is perfectly secure. If a data breach affects you, we will tell you and the authorities as the law requires.
Cookies
- What The Cuts website: no cookies of our own, no analytics and no advertising or social media trackers. Fonts and videos are served from our own site, not from Google Fonts or YouTube.
- What The Hook: no cookies, no analytics and no trackers. The page checks one item in your browser's local storage that only the owner's admin login uses; it is never set for visitors.
- Cloudflare may set a strictly necessary security cookie, for example to check that a visitor is not a bot. It is not used to track you across sites.
- Links to Instagram, WhatsApp, LinkedIn and Pinterest take you to those sites, which use their own cookies under their own policies.
Because we use no optional cookies, there is no cookie banner.
Instagram and Meta
What The Cuts and What The Hook are not affiliated with, endorsed or sponsored by Instagram or Meta. Instagram is a trademark of Meta Platforms, Inc.
Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change matters for how we use your data, we will say so on the site, and by email if we have your address.
Governing law
This policy is governed by the laws of India, and the courts of Tamil Nadu have jurisdiction. This does not take away any rights you have under the privacy laws of the country where you live.