Privacy Policy

Nucle.OS is a product of SP Business and Investment Group Ltd, which is the data controller for the personal data described in this policy. In this document “we” means that company, and “you” means the person or organisation using the product.

SP Business and Investment Group Ltd is a company registered in England and Wales under number 14790177, with its registered office at 86–90 Paul Street, London, EC2A 4NE. It is registered with the Information Commission (the ICO) as a data controller, registration number ZC266973.

For general enquiries, and for any request described in this policy, contact hello@getnucleos.com.

This distinction matters, because your rights differ between them.

When you use Nucle.OS yourself - your name, email, sign-in activity - we are the controller. This policy governs that data.

When you put your own clients’ details into Nucle.OS - their names, emails, phone numbers, the work you do for them - you are the controller and we are your processor. We only act on your instructions. Those terms are in our Data Processing Agreement.

Agencies and freelancers use Nucle.OS to work with their own clients and contacts. If one of them holds your details, that business is the controller and we process the data for it, under our Data Processing Agreement. Depending on what it uses, this can include:

• a booking you make on its scheduling page, with how you reached it when its link says so: the website and page you came from, the campaign tags in the link, and a Google Ads click identifier if you came from an advert. The booking page keeps these in your browser only for that visit, until you book;
• answers you give in its forms and surveys;
• proposals and agreements it sends you, and, if you sign one, your name, signature, the time and your IP address, kept as the record of signature;
• when you open a proposal it sends you: the time you opened it, how long it stayed open, how far through it you scrolled, your IP address and your browser type, which the business sees on the proposal. A random identifier is kept in your browser so that coming back to the same proposal is counted as the same visitor;
• messages and files in its client portal;
• invoices it sends you, and payments you make, which go to its own Stripe account;
• emails it sends you from Nucle.OS, including whether they were delivered, which links were clicked, and whether you replied or unsubscribed; and whether you opened them, but only where the business has switched open tracking on for that sequence (it is off unless it does).

To use your rights over that data, contact the business. If you contact us instead, we will pass your request to it and help it answer.

Account data. Your name, email address, and - if you sign in with Google - the basic profile it returns. Optionally a profile photo, timezone and display preferences.

Workspace content. Everything you create: clients, contacts, deals, projects, tasks, time entries, invoices, documents, notes, messages and files. This is your data. We do not mine it, and we do not use it to train anything.

Connected accounts. If you connect Google for email or calendar, we store an encrypted access token and sync the messages and events you have authorised. You can disconnect at any time, which deletes the token.

Security and operational records. Sign-in events, failed sign-in attempts and lockouts (to protect your account), and an audit log of significant actions within a workspace. Our hosting providers keep short-lived server logs that may include IP addresses.

Purchases. When you subscribe or buy a request pack, the payment is taken by Stripe’s merchant of record, shown at checkout as Onelink. It collects your card, billing name, address and any VAT number under its own privacy policy; we receive the plan, the amounts, your billing contact and the payment status, never your card number.

Questions asked on our website. If you use the “Ask Nucle.OS” box on our homepage, we keep the email address you give, your question, whether it was answered, and a one-way hash of your IP address (not the address itself). You do not need an account, and giving your email does not add you to a mailing list.

Invoice links. When a business using Nucle.OS sends you an invoice, the link in the email opens that invoice without an account. We do not track who opens it.

We do not collect special category data, we do not run advertising, and we do not build profiles of you.

To provide the product - performance of our contract with you. This covers your account, your workspace content, and the features you switch on.

To keep accounts secure - legitimate interests. Rate limiting, lockouts and audit logging exist to stop other people getting into your workspace.

To contact you about the service - legitimate interests for operational messages (a security notice, a change to these terms). Consent for anything promotional, which you can withdraw at any time.

To answer questions on our website - legitimate interests. We use your question to answer it, your email and hashed IP address to limit how often one person can ask and to block abuse, and the questions together to learn what people want to know about Nucle.OS. We do not use your email to market to you unless you separately ask us to.

To meet legal obligations - for example retaining financial records where the law requires it.

To understand how our website is used - your consent. If you accept analytics cookies on our public website, we use Google Analytics to count visits and see which pages people read, where they came from, and roughly where in the world they are. We use this to improve the website. We never use it inside the product, and never on pages our customers’ clients open. You can withdraw consent at any time (see Cookies).

We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

If you connect a Google account, Nucle.OS asks Google for access to your Gmail (to show your email in the product, send email you write or approve from your own address, and detect replies to your sequences) and, if you choose, your Google Calendar (to show your events and schedule meetings). Nothing else.

We use this data only to provide those features to you inside Nucle.OS. We do not sell it, use it for advertising, or use it to train artificial intelligence or machine learning models. People at Nucle.OS do not read it, except with your explicit permission for a specific message (for example, to help with a support request), where it is needed for security or to comply with the law.

If your workspace uses the AI assistant and you ask it about your email or calendar, or you use an AI button in a page that works from it (for example Write or Summarise in Email, Catch me up on a contact or company, or a follow-up email after a meeting), the relevant content is sent to the AI provider that answers that request, only to answer it: Anthropic, under our account, for the assistant use included in your plan (Anthropic does not train its models on it); or the provider your workspace connected with its own key, under your workspace’s account and terms with them. We use it for nothing else.

Nucle.OS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google at any time in Settings → Email, which deletes our access token and stops all syncing. Synced messages are deleted automatically 12 months after they were received (or after 3 or 6 months, if your workspace’s owner or an admin chooses less), together with any attachments you opened, and all of them are removed when you disconnect the account or delete your workspace.

Data we receive from Google is never sent to an AI app you connect to Nucle.OS (see the next section).

You can connect your own AI app, such as Claude or ChatGPT, to Nucle.OS through our connector (it uses MCP, the Model Context Protocol). You sign in to Nucle.OS, choose one workspace and approve the app. From then on, when you ask it to, the app can read what you can see in that workspace and make the changes you could make there. Those changes are limited to tasks and recurring tasks, notes, time, leads, contacts, companies, deals, projects, milestones, expenses and draft invoices. It can’t send anything to your clients, delete anything, or read email. It can read the transcripts only of meetings you were in (or that were shared with you by name), and the answers people gave on your forms, so it may receive personal data about your clients and other people you deal with.

What the app reads goes to that app, and from there to the AI provider behind it, under your own account and your agreement with that provider. You choose that provider; it is not one of ours, and its terms decide what it does with the data, including whether it is used to train models.

We keep which workspace each app was connected to, and when it was connected and last used, until you disconnect it. We also keep a record of each action it took (which tool, and whether it worked, but not what was asked) for 90 days. Changes it made appear in the workspace’s activity feed and audit log as made through that app. You can disconnect an app at any time in Settings → Connected apps, which also withdraws its access. A workspace’s owner or an admin can switch connected apps off for the whole workspace.

We use a small number of cookies, and every one of them is strictly necessary for the product to function:

• Session cookies - keep you signed in. Without these you would be logged out on every click.
• Share-link cookies - remember that you entered the password for a specific shared document. Scoped to that one link and expire after an hour.
• Redirect cookie - returns you to the page you were heading for after you sign in.

Our website also keeps two small things in your browser, both only because you asked for them: the light or dark theme you picked, and the email you typed into “Ask Nucle.OS”, which is forgotten when you close the tab. When you open a proposal a business has sent you, a random identifier is kept in your browser so that a return visit counts as the same visitor (see above).

Analytics cookies (website only, and only if you agree). When you first visit our public website, we ask whether you accept analytics cookies. If you choose “Reject”, or make no choice, Google Analytics is not loaded and no request is made to Google. If you choose “Accept analytics”, Google Analytics sets these cookies:

• _ga - tells one visitor apart from another with a random identifier. Expires after 13 months (Google’s default is 2 years; we shorten it).
• _ga_<ID> - keeps the state of your current visit; <ID> is our property’s identifier. Expires after 13 months (Google’s default is 2 years; we shorten it).

Google keeps the analytics data linked to these cookies for 14 months, after which it is deleted automatically. We do not use these cookies for advertising: Google signals, ad personalisation and ad-related consent are all switched off. Google Analytics does not log or store your IP address.

Your choice is remembered for 6 months in a small cookie of our own (nucleos_analytics_consent), which records only “accepted” or “rejected”. After 6 months we ask again.

Changing your mind. Use Cookie settings at the bottom of any page on our website. If you reject after accepting, we stop sending data immediately and delete the _ga cookies from your browser. You can also clear cookies in your browser settings, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

Inside the product, the client portal and every page we show to our customers’ clients, we use only the strictly necessary cookies listed above. Google Analytics is never loaded there. Our fonts are served from our own domain, so loading a page does not tell a font provider your IP address.

Our status page. status.getnucleos.com, where we report outages, is hosted for us by Better Stack under its own privacy and cookie policy. Visiting it may set Better Stack’s own cookies, including Google advertising cookies, which we do not use or receive. You never need to visit it to use Nucle.OS, and you can block or clear these cookies in your browser.

We use a small number of providers to run the service. Each receives only what it needs, and none of them may use your data for their own purposes.

• Supabase - database, authentication and file storage. Hosted in the EU.
• Vercel - application hosting. The application runs in the EU (Dublin); pages are delivered through Vercel’s global network.
• Resend - sends email on your behalf and on ours.
• Cloudflare R2 - keeps an off-site backup copy of files stored in your workspace, in the EU. Added September 2026; before it, nothing backed those files up at all.
• Stripe - our subscription billing. Purchases are sold through Stripe’s merchant of record (Onelink), which acts as a separate controller for the payment details it collects. Card details go straight to Stripe and never reach our servers. Payments a business’s clients make go to that business’s own Stripe account, under its own agreement with Stripe.
• GitHub - runs the nightly job that copies stored files to the off-site backup; files pass through it in transit and are not kept there.
• Sentry - receives error reports so we find out when something breaks, in the EU. Links containing access tokens are stripped before anything is sent.
• Better Stack - checks that the service is up and hosts our status page. It receives no customer data; visitors to the status page are subject to Better Stack’s own privacy policy.
• Daily.co - video meetings and recordings, if you use them.
• Google - only if you connect a Google account for email or calendar.
• Apollo.io - only if your workspace connects its own Apollo account for prospecting, which looks up business contact details.
• Hunter.io - only if your workspace connects its own Hunter account: finds and checks a business email address when Apollo cannot.
• Unipile - only if you connect LinkedIn or WhatsApp in Settings: it keeps that account’s session and carries its messages between the app and LinkedIn or WhatsApp. The messages are stored in Nucle.OS for as long as your workspace keeps email (12 months, or less if your workspace chose less), and are deleted when you disconnect if you choose.
• Giphy - only if you use the GIF picker in chat.
• Anthropic - answers questions asked in the “Ask Nucle.OS” box on our website (your question is sent; your email address is not), and runs the in-app AI assistant on our own account when a workspace uses the requests its plan includes: the question, the workspace records the assistant reads to answer it, any meeting transcript it is asked to summarise, and the answer. The same applies to the drafts and summaries made with the AI buttons inside pages (an email, a proposal section, a project update, a catch-up on a contact): the record the button works from and what you typed are sent, and the draft comes back for you to check. When a workspace owner uses “Research with AI” while setting up, it reads the agency’s own website and runs a few web searches about the agency to suggest its profile. Anthropic acts as our sub-processor for this, under its commercial terms.
• OpenAI - transcribes meeting recordings, on our own account, when a meeting in your workspace is recorded: the recording’s audio is sent, and the transcript comes back. OpenAI acts as our sub-processor for this, under its API terms, which do not permit training its models on this data.
• Cloudflare Turnstile - checks that a sign-in, a sign-up, a password reset or a question on our website comes from a person, not a bot, using signals from your browser.
• Open-Meteo - shows the weather in the app’s header, only if you allow your browser to share your location: your browser sends your approximate position (to about 100 metres) directly to Open-Meteo, with no name, email or account attached.
• Google (company logos) - where automatic company logos are switched on, a company’s website domain is sent to Google’s public favicon service to fetch its logo.
• AI providers on your own key - only if your workspace configures its own API key. In that case your prompts go to the provider you chose, under your own account and agreement with them, not ours.
• Google (Google Analytics) - measures use of our public website, only for visitors who accept analytics cookies. Google acts as our processor under the Google Ads Data Processing Terms, which we have accepted in Google Analytics. It receives the pages you visit, the referring site, your browser and device type, an approximate location derived from your connection (city level or coarser; GA4 does not store the IP address), and the random identifier in the _ga cookie. Google may not use this data for its own advertising, because data sharing and Google signals are switched off.

We will never sell your data, and we do not share it with advertisers. If we are ever legally compelled to disclose something, we will tell you unless we are prohibited from doing so.

Your database and files are held in the European Union, and the application runs there too (Dublin). Some of the providers above operate in the United States. Where personal data leaves the UK or EEA, those transfers rely on the UK–US Data Bridge for US providers certified to it, and otherwise on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

Google Analytics data may be processed by Google LLC in the United States and in other countries where Google operates. Those transfers are covered by the UK–US Data Bridge and the EU–US Data Privacy Framework (Google LLC is certified to both), and otherwise by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses incorporated in Google’s data processing terms.

If EU-only or UK-only processing is a requirement for you, tell us before you sign up - we would rather have that conversation early than discover it later.

Your workspace content is kept for as long as your workspace exists. Items you delete go to Trash and are permanently removed after 15 days.

If you delete your workspace, the content is removed from the service immediately, including the associated files. There is no undo, so export anything you want first.

Email synced from a connected mailbox is kept for 12 months from when it was received, or for 3 or 6 months if the workspace's owner or an admin chooses less, then deleted automatically, with any attachments you opened. Drafts left untouched for that long are deleted too.

Questions asked in the “Ask Nucle.OS” box, with the email given, are deleted automatically after 12 months. To have yours removed sooner, email us.

Your account details are kept while your account exists and deleted when you delete it from Settings. Security records are kept for a fixed time: failed sign-in attempts 90 days, sign-in history 12 months, a workspace’s activity feed 90 days, its audit log 2 years, and the record of what connected AI apps did 90 days. Billing records are kept for as long as tax law requires (in the UK, six years).

A paused workspace (a trial that ended, or a cancelled subscription) is kept for 12 months so you can come back to it, then deleted with all of its files. We email its owners and admins 30 days before. You can delete it sooner from Settings.

Backups keep deleted data for a limited time and then delete it on a schedule: database backups within 8 days, and backup copies of files within 30 days. They exist so we can recover from an outage or a mistake, and are not used for anything else.

Under UK and EU data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, object to processing based on legitimate interests, or provide it in a portable format.

You can export the main record types yourself from Settings → Export. If you want something the export does not yet cover, email us and we will get it for you - we are not going to make leaving difficult.

If you are unhappy with how we have handled your personal data, email hello@getnucleos.com with “Data protection complaint” in the subject. We will acknowledge it within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the UK regulator, the Information Commission (still known as the ICO), at ico.org.uk. We would appreciate the chance to put it right first.

Every table in our database enforces row-level security, so one workspace cannot read another’s records even if the application layer were bypassed. Credentials for connected accounts are encrypted before storage. Access to production is limited to people who need it.

We are not currently SOC 2 or ISO 27001 certified, and we are not going to imply otherwise. If you need a formal audit before you can adopt a tool, ask us and we will tell you plainly where we are.

Nucle.OS is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.

If we make a material change we will email account holders and update the date at the top of this page. We will not change it quietly.