Overview

Fundamental Research Labs is an AI research company working to build multi-agent systems. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use Shortcut, our product and related services.

Scope

This Privacy Policy applies to users of Shortcut via our websites, applications, and integrations.

Information We Collect

Consent

By using Shortcut, you consent to the collection and processing of your data as described. If you do not agree, please discontinue use of the service.

How We Use Your Information

We use your data for:

• Service Delivery: Authentication, session management, and enabling product features
• Communication: Transactional updates, incident notifications, and service alerts
• Customer Support: Troubleshooting and addressing user inquiries
• Security & Fraud Prevention: Monitoring via real-time threat detection, anomaly logging, API call monitoring, and rate limiting
• Legal & Compliance: SOC 2 Type II compliance
• Business Continuity: Backups, disaster recovery, and failover across availability zones

Model Training

Shortcut improves by learning from real work. Only individual Pro accounts have a “Help improve Shortcut” setting. While it is on, your conversations with the agent and their related artifacts may be retained by the Shortcut team to test, debug, and improve our models and products, including by training our AI models. We may also share this data with partners working with us on those improvements.

Related artifacts means what the conversation's retained session record contains, which may include: the messages and instructions you submit and the content of attachments you add to the conversation; workbook content the agent reads, writes, or displays in the conversation, such as cell values, formulas, and sheet data; the agent's responses, plans, and other outputs; and the agent's tool calls, their results, and the actions it takes on your workbooks.

The setting is on by default for individual Pro accounts. Teams and Enterprise data is never used for model training. You can turn it off at any time under Settings → Security & Privacy → Help improve Shortcut, on every Shortcut platform. Turning it off applies to conversations you start afterwards. A conversation in which any part took place while the setting was on is retained in full, including messages sent in it after the setting was turned off.

This policy is effective September 14, 2026. Retention begins when this update is deployed on our systems, which is on or after that date. Conversations that already existed when Pro-only eligibility was deployed are never retained or used for these purposes, even if they are continued later. Because deployment may follow the effective date, this also excludes conversations started on or after September 14, 2026 but before deployment.

Conversations are not retained for these purposes when they take place in the Shortcut add-on for Google Sheets, when they are imported from a share link or branched from a conversation that is excluded, when their session record is stored in storage your organization owns, or when they run through a private model gateway. The setting does not change who can access your files or workbooks and does not give any other user access to them.

Retained data is protected under the security standards described in this section, and you can request deletion of your account and its data at any time.

Data Sharing

We may share your personal data only under these conditions:

• Service Providers: Third-party hosting, deployment, and AI model API vendors (all SOC 2 or equivalent certified, vetted for security compliance)
• Enterprise Integrations: With business partners under contractual obligations
• Model Improvement Partners: Conversations and their related artifacts retained under the “Help improve Shortcut” setting, shared with partners working with us on testing, debugging, and improving our models and products, as described under Model Training
• Legal Authorities: If required by law or to comply with regulations
• Mergers/Acquisitions: As part of a legitimate transaction
• With Consent: When explicitly authorized

Data Transfers

• All data is currently processed in US-based data centers
• Customers will be notified in advance of any changes in data location
• We enforce strict security requirements for all vendors including relevant certifications and contractual data protection obligations

Data Retention & Deletion

• User session data: Retained for Pro and Teams Users
• AI model API calls: Retained by providers up to 30 days (for safety monitoring)
• Enterprise customers: Can request Zero Data Retention agreements
• Individual Pro conversations: Retained for model training if any part of the conversation took place while the account's “Help improve Shortcut” setting was on. Turning the setting off applies to conversations started afterwards, and a retained conversation is kept in full, including later messages, as described under Model Training above

Security Safeguards

We implement multiple layers of protection:

• Encryption: AES-256 encryption at rest; TLS for data in transit
• Authentication: Username/password with scrypt hashing, CSRF protection, rate limiting, encrypted session management
• Enterprise Options: Google OAuth and SAML integration (on request)
• Monitoring & Logging: Real-time threat detection, audit trails
• Backups & Recovery: Daily automatic backups via third-party provider
• Service Continuity: Automatic failover across multiple APIs, load balancing, and dedicated incident response team

Data Subject Rights

You have the right to:

• Access your data
• Request correction
• Request deletion ("Right to be Forgotten")
• Restrict processing
• Data portability
• Object to processing (including marketing)
• Withdraw consent

Requests may require identity verification.

Cookies & Tracking

Shortcut uses cookies for functionality and analytics. Non-essential cookies require your consent, which can be managed in your browser settings.

Children

Shortcut is not directed at children under 16. If we discover personal data has been collected from a child without parental consent, we will delete it promptly.

Compliance

Shortcut complies with SOC 2 Type II standards.

Updates to this Policy

We may update this policy periodically. Any changes will be posted with a new effective date. Continued use of Shortcut indicates acceptance.

Google API Services User Data

This section outlines how Shortcut accesses, uses, stores, and shares user data received from Google APIs. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.