Cuttlefish separates on-device work, hosted account records, and requests to approved systems and model providers. Our Data Processing Agreement sets out how covered personal data is handled for your organization. Request a signed copy for your reviewers.
A Data Processing Agreement is the contract that sets out how a vendor handles personal data for a customer. It is the document procurement and security teams ask for during review.
The DPA defines the agreed processing roles, covered data, security obligations, transfers, retention, and rights. It sits alongside the applicable service terms and is reviewed and signed for your organization. Your executed agreement governs contractual commitments; this page is a summary.
Teams subject to GDPR, UK GDPR, or CCPA usually require a signed DPA before rolling Cuttlefish out. So do organizations whose security or procurement process gates new tools on a data agreement. If that is you, request the signed copy and route it through your reviewers.
Email our legal team and tell us your company, your work email, and any review deadline. We send the current signed DPA for your counsel to review and execute. If you have security-specific questions, those can run in parallel through our security and subprocessor routes.
The short version: much of Cuttlefish runs on your machine. The DPA covers the backend data we do handle, including account information, the conversation history and memories saved to your account, and encrypted cloud provider keys, summarized here.
Your organization’s signed DPA identifies the controller and processor roles for customer content and service operations. Moguls Inc processes covered customer data for the agreed purposes and instructions. Other account or business records may have a different legal basis, as described in the Privacy Policy and applicable agreement.
The hosted service handles account and session information, approved configuration, conversation history, memories, encrypted cloud-provider credentials, and records of governed work. Conversation history includes exchanges with on-device models. Original files remain on your device, but authorized excerpts, attachments, and action evidence can be included in conversations or saved work records.
Your model, your choice. Run a model on your own machine and your prompts and its answers are processed there, with no AI provider involved; the conversation is still saved to your account in Cuttlefish's hosted service. When you use a cloud AI provider, your request is relayed through Cuttlefish's hosted service to that provider under your own key, over encrypted connections.
Hosted data is encrypted at rest and protected in transit with TLS. Signed governance records support integrity checks and attribution of the recorded action. Supporting content and external results have their own access, storage, and verification requirements. The signed DPA sets out the protections and obligations that apply to your organization.
The backend that handles this limited data runs in the United States, where retained storage and backups from our former hosting are also held. The signed DPA sets out the transfer protections that apply to customers in the EU, the UK, and other regions, so cross-border processing is covered by recognized safeguards.
Retention depends on the record category and the signed agreement. Removing a conversation from visible history does not immediately erase its stored record. Stored account history, memories, and other personal data can be requested for erasure through our legal team. Governance records have the separate retention obligations described in the Privacy Policy and your signed DPA.
The DPA carries the data-subject rights set out in our Privacy Policy. You can exercise them by contacting our legal team.
Ask what personal data we hold about you, and request that anything inaccurate be corrected.
Request deletion of your data, or a portable copy of it, within the limits of the audit-record retention period.
Object to or restrict how we process your data, and withdraw consent at any time without losing your other rights.
We do not sell personal information, and you are never penalized for exercising any of these rights.
Email our legal team and we will send the current signed agreement for your counsel to review and execute.
