Cuttlefish · Gamma Systems Pty Ltd

Privacy policy

How Cuttlefish handles information when you use the website, console, agents and MCP connection.

Effective 22 October 2026. Gamma Systems Pty Ltd operates Cuttlefish. This notice applies to the hosted Cuttlefish service and its MCP plugin. For a self-hosted deployment, your deployment operator also determines its storage, access and retention settings. Your AI client and other independently operated providers have their own policies.

Information handled by Cuttlefish

• Account and access information: sign-in identity, organisation and project membership, roles, and the projects and permissions approved for a connected app.
• Service data: workflow definitions, run and attempt records, job logs, artifacts, runner inventory and health, and configuration needed to provide the service. Job logs and artifacts can contain personal or confidential information supplied by your workloads.
• Operational information: request timestamps, methods, correlation IDs, status, errors, latency and security or audit events. Website and network delivery can also involve IP addresses, browser information and request URLs. Do not assume request content is excluded from every diagnostic record.

Purposes and recipients

Cuttlefish uses this information to authenticate users, enforce project access, run and inspect authorised workflows, deliver logs and artifacts, diagnose problems and maintain service security. Information is processed by the identity, hosting, storage and infrastructure providers needed to perform those functions. Hosted sign-in uses Google Firebase Authentication. Workflows can send information to the external services configured by the workflow owner.

A complete current inventory of processing locations, overseas recipients and provider retention periods has not been verified in this notice. Contact us before sending information that requires a particular processing location or contractual assurance.

MCP and AI client connections

A native OAuth connection authorises an AI client to call Cuttlefish within the projects and scopes you approve, subject to your current membership. The read-only cloud plugin requests project, run, log, workflow and rig reads. It does not authorise starting jobs, changing credentials or collecting fresh diagnostics.

Tool arguments travel from your AI client to Cuttlefish; selected results are returned to that client. Depending on the tool, results can include identity, project membership, workflows, job logs and artifacts. Your client may retain prompts and responses under its own policy. Installation, an OAuth grant and a successful API read are separate states; a local CLI login does not establish access in a different cloud account.

Review the selected projects and requested permissions before connecting. To stop a client's future access, revoke its grant in Connected apps. Revocation does not erase service records or copies already returned to an AI conversation.

Retention and deletion

There is no single verified retention period covering every Cuttlefish data category. Service records, job logs, artifacts, request diagnostics, security records and backups can have different settings. An implementation default is not a guarantee about a particular deployment.

Disconnecting an assistant, revoking a token, deleting an item and closing an account are separate operations. For access, correction or deletion, contact us with the account, project and relevant record category. We may need to verify your identity and clarify live records, backup or audit exceptions and copies held by other providers before responding. No unverified deletion or response deadline is promised here.

Questions and complaints

Contact Gamma Systems Pty Ltd at ben@shorted.com.au for privacy questions, access or correction requests, deletion requests or privacy complaints. Include the service, issue and outcome sought; never send passwords, API keys, OAuth links or complete private logs. See the support guide for safe diagnostic details.

Australian privacy guidance and complaint information is available from the Office of the Australian Information Commissioner. Applicable rights depend on the law and service. This notice does not limit those rights. Changes to this notice will be dated; publishing a policy does not configure storage lifecycle rules or delete data.