Privacy policy.

Who we are

Mulga Defense Corporation builds Spinifex, an open-source AWS-compatible cloud. Our company headquarters is in Austin, Texas, and our engineering headquarters is on the Sunshine Coast, Australia. For anything in this policy we are the data controller, and you can reach us at hello@mulgadc.com.

We are an infrastructure company, not an advertising one. The personal information we hold is almost entirely what people type into a form to talk to us or to try the product.

What we collect

Information you send us

Our forms collect only what the request needs, and each one tells you what it is asking for before you submit it.

• Contact form. Your name, email address, company (optional), the topic you pick, and your message.
• Quote and purchase enquiries. Your name, email address, company, an optional PO number, your timeline, and the hardware and software configuration you selected.
• Sandbox access requests. Your name, work email address, company, and what you want to deploy. We reject free webmail domains at this step, so the address you give us is checked against a list of consumer providers.
• Newsletter. Your email address, nothing else.

These submissions are delivered to us by email and land in our mailboxes. We use them to answer you and, where you have asked for a quote or sandbox access, to follow up about it.

Self-serve sandbox signup

Creating a Spinifex sandbox account puts your email address into a short-lived record held in Cloudflare KV, alongside a hash of your verification code and an idempotency token. The pending record expires after fifteen minutes; once you have verified, the record is replaced by one holding your email address and account ID that expires after twenty-four hours.

Your credentials CSV is parked for thirty minutes so the download link in the welcome email works, then deleted whether or not anyone clicked it. Your secret access key is never written anywhere else, and never appears in the welcome email.

To stop the flow being abused we keep approximate daily counters keyed on a hash of your email address and a hash of your IP address. Those counters expire after twenty-six hours, and the hashes cannot be read back as addresses.

Every signup outcome is also written to an event log we keep for product and abuse analysis. That row holds your email address, your IP address, your user agent, and the country, city, network operator and Cloudflare data centre that Cloudflare derives from the connection. Where an address was rejected before verification we keep only its domain. The verification code, the Turnstile token, the signup cookie and any credential are never recorded.

Information collected automatically

Cloudflare serves both sites and logs the ordinary details of every request: IP address, user agent, the URL requested, the response, and approximate location. That is standard infrastructure logging, and we rely on it to keep the sites available and to investigate abuse.

Signup pages run Cloudflare Turnstile, a privacy-preserving bot check. Turnstile scores the browser session rather than profiling you across sites.

Cookies

We set no cookies for general browsing. The cookies below appear only once you start a signup, or if you arrived from a Reddit ad, and so none of them is ever set on the documentation site.

Blocking cookies in your browser, or blocking the Reddit domains outright, leaves every part of the site working apart from the signup flow, which needs its own cookie to complete.

Analytics and advertising

Cloudflare Web Analytics runs on both sites and gives us page-level traffic figures. It is cookieless, it does not fingerprint visitors, and it does not follow anyone between sites.

Reddit advertising. We advertise Spinifex on Reddit, and we measure whether that advertising works. This runs on mulgadc.com only: the documentation site carries no advertising pixel, and its Content Security Policy blocks one from being added. The Reddit pixel records page visits, clicks on our GitHub links, sandbox access requests and completed signups. The same events are sent server-to-server through Reddit's Conversions API so that an ad-blocker does not silently distort our numbers, and Reddit deduplicates the two using a shared event ID.

Where a conversion is tied to an email address, we hash that address with SHA-256 inside our own worker and send only the hash. Your IP address and user agent are sent to Reddit unhashed, because that is how the API matches an event, along with the Reddit click ID from the ad you followed.

To opt out, block redditstatic.com and ads-api.reddit.com in your browser or network, or adjust the advertising settings in your Reddit account. Nothing on either site depends on these requests succeeding.

Who we share it with

We do not sell personal information, and we do not share it with data brokers. It reaches three categories of recipient: the processors below who run parts of our infrastructure, professional advisers bound by confidentiality, and anyone we are legally required to disclose to under a valid order.

If we are ever bought, merged, or reorganised, personal information would transfer with the rest of the business, and this policy would continue to apply until we told you otherwise.

International transfers

We operate from Australia and the United States, and our processors run global infrastructure. Personal information you give us will therefore be handled in both countries and may be processed at whichever Cloudflare location is closest to you. Where a transfer leaves the UK or the European Economic Area, we rely on Standard Contractual Clauses in our agreements with the processor concerned.

How long we keep it

Most of what the signup flow writes is deleted by an expiry we set when we write it, so deletion happens whether or not anyone remembers to ask.

Cloudflare's own request logs follow Cloudflare's retention, which is measured in days rather than months.

Legal bases

Where the UK GDPR or EU GDPR applies to you, we rely on the following grounds.

• Legitimate interests for answering enquiries, running and securing the sites, rate-limiting and abuse investigation, and measuring our own advertising in aggregate.
• Consent for the newsletter and for the Reddit advertising cookies, which you can withdraw at any time without affecting anything we did beforehand.
• Performance of a contract for provisioning and supporting a sandbox account you asked us to create.
• Legal obligation where we have to retain or disclose something under law.

Your rights

Whatever jurisdiction you are in, you can email hello@mulgadc.com and ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. We will respond within thirty days. We may need to confirm your identity first, which for most requests means replying from the address the record is keyed on.

Under the UK and EU GDPR you additionally have the right to restrict or object to processing, the right to data portability, and the right to complain to your supervisory authority, including the UK Information Commissioner's Office.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles you may complain to us first, and then to the Office of the Australian Information Commissioner if our answer does not resolve it.

Under the California Consumer Privacy Act you have rights to know, delete, and correct, and a right not to be discriminated against for exercising them. We do not sell personal information or share it for cross-context behavioural advertising as the CCPA defines those terms.

Spinifex itself

This policy covers our websites. Spinifex is open-source software licensed under the AGPLv3 and designed to run on hardware you own, so a Spinifex cluster you operate sends us nothing and we have no access to the workloads, storage or credentials inside it. That independence is the whole point of the product.

The hosted sandbox at spx3.com is the exception. It runs on our infrastructure, so anything you upload to it passes through systems we control. Treat it as an evaluation environment and keep production or classified data out of it.

Security

Both sites are served over HTTPS with HSTS, a strict Content Security Policy, and framing disabled. Secrets are held as encrypted Worker secrets rather than in source control. If you find a vulnerability, our disclosure contact is security@mulgadc.com and our security.txt gives the details.

Children

Nothing we sell is aimed at children, and the sites are not intended for anyone under 16. If you believe a child has given us personal information, email us and we will delete it.

Changes and contact

When this policy changes we will update the effective date at the top of the page, and for a material change we will say so on the site before it takes effect.

Questions, requests and complaints all go to hello@mulgadc.com, or write to Mulga Defense Corporation, Austin, Texas, United States. If you would rather start a conversation than send an email, our contact form reaches the same people.