Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use the collected information for:

• Providing and maintaining our services
• Processing transactions and managing your account
• Showing connected schedules, checking availability, and managing bookings and meeting summaries
• AI-powered features including email assistance and insights
• Improving and personalizing your experience
• Communicating service updates and support
• Analyzing usage patterns to enhance our platform
• Ensuring security and preventing fraud
• Complying with legal obligations

3. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication with optional two-factor authentication
• Automated code and dependency security checks
• Role-based access controls and tenant-scoped data access
• Secure cloud infrastructure (Google Cloud Platform / Firebase)

4. Your Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under GDPR:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Portability: Receive your data in a structured format
• Right to Object: Object to certain types of processing
• Right to Restrict: Limit how we use your data
• Right to Withdraw Consent: Withdraw previously given consent
• Automated Decisions: Request human review and contest a qualifying solely automated decision

To exercise these rights, visit Settings → Privacy & Data or contact us at [email protected]. You may also complain to your local supervisory authority.

5. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the "sale" of personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

Do Not Sell or Share: Nelson OS does not sell personal information for money. You can record a do-not-sell-or-share preference in Privacy & Data; the workspace owner remains responsible for its own downstream disclosures and advertising integrations.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

• Active account and customer content, including copies of Gmail messages sent through Nelson or synced from a previously authorized inbox: retained while needed to provide the service
• Disconnecting Gmail removes Nelson's stored OAuth tokens and stops future Gmail access; it does not automatically delete email records already stored in the workspace or messages held by Google or recipients
• Imported Google Calendar events remain in Nelson after a standard disconnect; you can choose to purge imported events and calendar-source records when disconnecting or request deletion through Privacy & Data
• Export files: automatically expire after 24 hours
• Deletion requests: operational data is deleted or anonymized after confirmation; processor and backup completion is separately reviewed
• Security, transaction, and legal records: retained only for documented security, contractual, tax, or legal needs

7. Cookies and Tracking

The application uses browser storage and authentication technologies for:

• Essential cookies: Required for basic functionality
• Preference cookies: Remember your settings

Nelson OS does not enable optional advertising or analytics cookies in the application shell by default. You can manage optional preferences in Privacy & Data and through your browser settings.

8. Third-Party Services

We may share data with the following categories of third parties:

• Cloud infrastructure providers (Google Cloud Platform, Firebase)
• Payment processors (for billing purposes)
• AI service providers (for intelligent features)
• Email service providers (for communications)
• Analytics providers (with your consent)

Which providers receive data depends on the modules and integrations your workspace enables. See the current Sub-processors page for service, purpose, and optionality information.

9. Google Calendar Integration

Connecting Google Calendar is optional. Nelson identifies the connected account from its primary Google calendar. When booking and event updates are available, connecting requests permission to read calendars and manage events on calendars you can access; otherwise it requests read-only access. You choose which calendars Nelson syncs. Nelson reads the list of available calendars and imports events from enabled calendars so you can see your schedule in Nelson, keep it updated, and check availability when arranging bookings. Imported events may also appear in user-facing daily briefs, meeting summaries, and scheduling assistance. Google Calendar can send change notifications that trigger another sync.

Nelson stores your connected email address, granted permissions, connection and sync status, selected calendar names, identifiers, descriptions, time zones and sync cursors, and copies of imported events. Event copies can include titles, descriptions, locations, start and end times, time zones, recurrence identifiers, status, and Google event links. Nelson stores encrypted access and refresh tokens in server-side storage to maintain the connection. Authorized members of your Nelson workspace may see calendar information made available through the workspace's calendar and booking features.

If you grant event permission, Nelson may create events you make in Nelson on an enabled writable Google calendar, including bookings, and update or cancel those Nelson-created Google events when the Nelson record changes. Nelson may also send booking events created through public booking, voice, and approved scheduling workflows, and eligible shift events where configured. A sent event can include its title, description, location, time, attendee name and email address, and Nelson booking or event identifiers. Nelson does not use this connection to edit unrelated events that originated in Google. Attendee invitations or updates depend on Google's delivery behavior and booking configuration; an event shown in Nelson is not proof that an attendee received an invitation.

You can disconnect Google Calendar in Settings or revoke Nelson's access in your Google Account. Disconnecting deletes Nelson's stored Calendar tokens and stops future access. If you choose the purge option when disconnecting, Nelson also removes the selected calendar-source records and imported Google events for your connected user; otherwise those copies remain until deleted through the applicable privacy request or retention process. Disconnecting does not delete events from Google Calendar or remove booking records that Nelson must retain for the service or legal obligations.

Nelson uses Google Calendar data to provide and improve the user-facing schedule, availability, booking, daily brief, meeting summary, and scheduling-assistance features you use. We do not sell Google user data or use it for interest-based advertising, credit decisions, or training a general-purpose AI model. Service-provider and Nelson-personnel access is limited to providing those features with your consent, security and abuse investigation, or legal requirements. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

10. Gmail Integration

Connecting Gmail is optional. Nelson requests your Google account email address to identify the connected account and permission to send email on your behalf using Gmail. New Gmail connections do not request permission to read your inbox. Some connections authorized under an older version still have Gmail read access; for those accounts, an inbox sync can copy message headers, sender and recipient addresses, subject, body, snippet, labels, and message and thread identifiers into the Nelson workspace. Inbox sync is available only where the connected account has that permission.

When you send through Gmail, Nelson sends the message and any attachments you select to Google's Gmail API and stores a copy of the sent message, recipient details, and delivery identifiers in the workspace. Nelson stores your connected address, granted permissions, connection status, and encrypted access and refresh tokens to maintain the connection. Tokens are held in server-side storage.

Workspace email records can appear in Nelson Mail and contact timelines and can inform reply, follow-up, sales, and marketing insight features. Some requested insights may involve AI processing. Workspace members with appropriate access can view records made available to their workspace. We do not sell Google user data or use it for interest-based advertising or to determine creditworthiness. We do not use Google Workspace data to train a general-purpose AI model.

Google data is shared with service providers only as needed to operate the user-facing features you use, protect the service, or comply with law. Human access by Nelson personnel to Google data is limited to your specific consent, security or abuse investigation, or legal requirements. The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Gmail in Email Account Settings or revoke Nelson's access in your Google Account settings. To request access to, export, or deletion of records stored in Nelson, use Settings → Privacy & Data or email [email protected]. Disconnecting or revoking access does not remove copies already sent to recipients or stored in your Gmail account.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. Where personal data is transferred internationally, the applicable controller and processor must use a lawful transfer mechanism and assess supplementary safeguards. Contact [email protected] for the mechanism applicable to your service configuration.

12. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

We will respond to your request within 30 days (or sooner as required by applicable law).

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.