Privacy Policy

1. Who this Policy applies to

The Service is a business tool intended for use by companies, founders, operators, and their authorized team members. In most cases:

• The organization that subscribes to Nucleus (the “Customer”) is the controller of the business data it submits or connects to the Service.
• Nucleus acts as a processor / service provider that handles that data on the Customer’s behalf and under the Customer’s instructions, except where this Policy or applicable law states that Nucleus acts as a controller (for example, for account administration, billing, security, and Service improvement).

If you are an individual using Nucleus on behalf of an organization, you represent that you are authorized to provide that organization’s data and to accept this Policy and the Terms & Conditions on its behalf.

2. Information we collect

2.1 Information you provide directly

• Account and profile data: name, email, phone number, password/credentials, company name, role, and time zone.
• Billing data: billing contact, plan, and payment information. Card and bank details are processed by our payment processor; we generally do not store full payment card numbers.
• Communications: messages, support requests, instructions you give to Nucleus agents, feedback, and survey responses.

2.2 Business and operational data you connect or submit

Because Nucleus functions as an operating system for your business, you may submit or authorize access to highly sensitive information. The integrations Nucleus currently offers are Gmail, Google Calendar, Google Drive, Slack, Asana, Notion, Calendly, Stripe, Plaid, QuickBooks, Chase, Gusto, Shopify, and HubSpot. Data available through an integration depends on the scopes and permissions you authorize. It may include:

• Google user data (Gmail, Google Calendar, and Google Drive). With your authorization, Nucleus accesses:
  • Gmail messages: reading message content and metadata. Purpose: to summarize your inbox, surface your top priorities and needed follow-ups, and prepare your daily brief.
  • Gmail messages: modifying labels. Purpose: to organize and triage messages (for example, labeling items as handled, priority, or awaiting reply) as you direct.
  • Gmail messages: composing and sending. Purpose: to draft and send email replies and follow-ups on your behalf, at your direction or under automations you configure.
  • Google Calendar events: reading event data. Purpose: to include upcoming meetings and commitments in your daily brief and to give agents the schedule context needed to prioritize your day.
  • Google Drive files: reading authorized file content and metadata. Purpose: to retrieve the business documents and context you choose to make available to Nucleus workflows.
• Financial, payroll, and commerce data: revenue, expenses, transactions, balances, runway/margin metrics, accounting records, payroll records, and commerce activity collected from Stripe, Plaid, QuickBooks, Chase, Gusto, and Shopify, based on the accounts and permissions you connect.
• Collaboration, project, scheduling, knowledge, and customer data: authorized messages, tasks, projects, pages, events, contacts, and records from Slack, Asana, Notion, Calendly, and HubSpot.
• Legal and contract data: contracts, NDAs, agreements, and related documents you submit for review.
• Operational data you submit directly: tasks, priorities, notes, and documents you provide to the Service.

We request only the Gmail, Google Calendar, and Google Drive scopes needed to provide the features you enable, and only the data those scopes return. Nucleus does not request access to other Google services unless we update this Policy and the relevant authorization experience to describe the new access.

You decide which integrations to connect and what data to share. You can disconnect an integration at any time (including revoking Nucleus's access to your Google account at any time via your Google Account permissions), which stops future collection from that source. If we add new integrations, we will update this Policy to describe them before or when they become available.

2.3 Information collected automatically

• Usage data: features used, agent interactions, actions taken, pages viewed, and timestamps.
• Device and technical data: device type, operating system, app version, IP address, identifiers, and crash/diagnostic logs.
• Cookies and similar technologies on our website and web app (see Section 9).

2.4 Information from third parties

• Connected integrations (via OAuth or API), as described above and only with your authorization.
• Service providers such as payment, analytics, and fraud-prevention vendors.

3. How we use information

We use information to:

1. Provide and operate the Service, including running AI agents that summarize data, surface priorities, draft documents and messages, review contracts, and take or suggest actions you authorize.
2. Connect and sync your authorized third-party applications and accounts.
3. Send communications, including agent-to-user notifications, reminders, status updates, and account/transactional messages, by in-app notification, email, and SMS/text (see Section 8).
4. Personalize dashboards, briefs, and recommendations.
5. Bill and administer your subscription, including usage-based pricing calculations.
6. Maintain security, prevent fraud and abuse, debug, and ensure reliability.
7. Improve and develop the Service, including analyzing usage and improving features and agents, subject to the limits in Section 4 (including no training of AI models on your connected-account content).
8. Comply with law and enforce our Terms.

We process this information based on performance of our contract with you, your consent (where required, such as for SMS and certain integrations), our legitimate interests in operating and securing the Service, and our legal obligations.

4. AI processing, automated decision-making, and Google API Limited Use

4.1 How AI is used

Nucleus uses artificial intelligence, including large language models and AI agents, to process your data and generate outputs such as summaries, drafts, contract flags, and recommended actions. To do this, relevant data, which may include the content of connected accounts, such as your Gmail messages and Google Calendar events, is processed by our AI models and by the third-party AI providers we use to power these features.

4.2 AI outputs are not professional advice

AI outputs may be inaccurate, incomplete, or unsuitable for your situation. They are informational and operational aids only and are not legal, financial, tax, accounting, or investment advice. You are responsible for reviewing AI outputs before relying on them or allowing an agent to act. See the Terms & Conditions for full disclaimers.

4.3 AI providers are our service providers

The third-party AI and infrastructure providers we use to deliver these features (for example, model providers and cloud hosts) act as our contracted service providers and sub-processors, acting on Nucleus's behalf. They are contractually bound to process your data, including Google user data, only to deliver the user-facing Nucleus features you request, on our behalf and under our instructions, and not for their own purposes. A current list of material sub-processors is available on request at privacy@nucleusos.co.

4.4 No model training on your data; limited human access

We do not sell your data. We do not use, and we do not permit our AI, model, cloud, or infrastructure service providers to use, the content of your connected accounts, including any Google user data, to train, retrain, or improve generalized, foundation, or third-party AI/ML models. This commitment is unconditional and does not depend on any provider's default settings or opt-out mechanisms. Google user data processed by Nucleus is used solely to provide and improve the user-facing features you request.

We do not allow humans, whether Nucleus personnel or our service providers' personnel, to read your Google user data, except in the limited cases permitted by the Google API Services User Data Policy: (a) with your affirmative consent; (b) as necessary for security purposes (such as investigating abuse or a bug); (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized so that it no longer identifies you or your organization. Subject to these limits, we may use de-identified and aggregated data that no longer identifies you to operate, secure, and improve the Service.

4.5 Google API Services: Limited Use

5. How we share information

We share information only as described here. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• Service providers / sub-processors: hosting, storage, AI/model providers, payment processors, analytics, communications/SMS providers, and security vendors, each bound by confidentiality and data-protection obligations and permitted to process your information only to provide services to Nucleus.
• Connected integrations: with the third-party services you direct us to connect, and only to provide the functionality you request.
• Within your organization: with other authorized users and administrators of your Nucleus account, who may be able to view or manage data and agent activity.
• Legal and safety: when required by law, subpoena, or legal process, or to protect the rights, property, safety, or security of Nucleus, our users, or the public, and to investigate fraud or abuse.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy.
• With your consent: for any other purpose disclosed to you.

6. Data retention

We retain information for as long as your account is active, as needed to provide the Service, and as required for our legitimate business purposes (such as security, billing, dispute resolution, and legal compliance). When data is no longer needed, we delete or de-identify it. You may request deletion as described in Section 7; some data may be retained where required by law or for legitimate business records.

7. Your rights and choices

Depending on where you live (e.g., under GDPR/UK GDPR, CCPA/CPRA, or similar laws), you may have rights to:

• Access, correct, or delete your personal information;
• Port your data;
• Object to or restrict certain processing;
• Withdraw consent (including for SMS, see Section 8);
• Opt out of “sale” or “sharing” (we do not sell or share as those terms are defined);
• Not receive discriminatory treatment for exercising your rights.

To exercise these rights, contact privacy@nucleusos.co. We will verify your request and respond within the time required by applicable law. If you are an end user whose data was submitted by a Customer organization, we will generally direct your request to that organization (the controller). You may also have the right to lodge a complaint with a supervisory authority.

8. SMS / text messaging

• With your consent, Nucleus sends agent-to-user text messages (including notifications, reminders, status updates, and operational prompts) to the mobile number you provide.
• Message and data rates may apply. Message frequency varies.
• You can opt out at any time by replying STOP to a Nucleus text, or by adjusting notification settings; reply HELP for help. Opting out of SMS may limit certain proactive features.
• We do not share mobile information with third parties for their own marketing. Mobile opt-in/consent data is not sold.

9. Cookies and analytics

Our website and web app use cookies and similar technologies for authentication, preferences, security, and analytics. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required, we present a cookie banner and honor recognized opt-out signals (e.g., Global Privacy Control).

10. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, and monitoring. No system is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and for the security of the third-party accounts you connect.

11. International data transfers

We may process and store information in the United States and other countries that may have different data-protection laws than your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

12. Children's privacy

The Service is for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can delete it.

13. Third-party services

The Service links to and integrates with third-party products. Their use of your information is governed by their privacy policies, not ours. We are not responsible for the practices of third parties. Review the privacy terms of every service you connect.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (such as email or in-app notice). Your continued use of the Service after the effective date constitutes acceptance.

15. Contact us