Privacy Policy
Learn how Nucleus AI collects, uses, and protects your personal information in compliance with Singapore PDPA.
Singapore PDPA Compliant
This policy complies with the Personal Data Protection Act 2012 (PDPA) of Singapore and outlines your rights regarding your personal data.
1. Introduction and Scope
Nucleus AI ("Nucleus AI," "we," "our," or "us"), a company incorporated in Singapore, is committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore and other applicable data protection laws.
This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our AI agent platform, website, and related services (collectively, the "Services"). By using our Services, you consent to the practices described in this Policy.
This Policy applies to all users of our Services, including individuals accessing our platform through enterprise agreements. Enterprise customers may have additional data processing agreements that supplement this Policy.
2. Data Protection Officer
In accordance with the PDPA, we have appointed a Data Protection Officer (DPO) to oversee our data protection practices.
Contact Our DPO
- Email: admin@nucleusenterprise.ai
- Address: Nucleus AI, Singapore
3. Personal Data We Collect
We collect personal data through various means when you interact with our Services:
3.1 Information You Provide Directly
- •Account Information: Name, email, phone, company, job title, preferences
- •Payment Information: Billing address and payment details (via PCI-DSS compliant processors)
- •Communications: Messages, feedback, and support requests
- •User Content: Files, documents, images uploaded to the platform
3.2 Information from AI Interactions
- •Conversation Data: Messages and prompts with AI agents
- •Task Instructions: Descriptions of delegated tasks
- •Generated Outputs: Content created by AI on your behalf
- •Feedback Data: Ratings and corrections on AI outputs
3.3 Information Collected Automatically
- •Device Information: Device type, OS, browser, unique identifiers
- •Usage Data: Features accessed, actions, session duration
- •Log Data: IP address, access times, pages viewed
- •Performance Data: Error reports and diagnostics
3.4 Information from Third Parties
- •Connected Services: Data from authorized integrations (Google, Microsoft, Slack)
- •Authentication Providers: Profile info from social sign-in
- •Enterprise Administrators: User provisioning data
4. Purposes of Data Collection and Use
1Service Delivery
- • Providing and maintaining the AI platform
- • Processing requests and AI tasks
- • Managing accounts and subscriptions
- • Customer support
2Improvement
- • Analyzing usage patterns
- • Developing new features
- • AI model improvement (with safeguards)
- • Research and analytics
3Security & Compliance
- • Detecting security threats and fraud
- • Enforcing Terms of Service
- • Legal and regulatory compliance
- • Responding to lawful requests
4Communications
- • Service notifications and updates
- • Feature announcements
- • Marketing (with consent)
5. Legal Basis for Processing
Consent
Where you have given explicit consent for specific processing activities
Contractual Necessity
Where processing is necessary to perform our contract with you
Legitimate Interests
Where processing is necessary for our legitimate business interests, balanced against your rights
Legal Obligations
Where processing is required to comply with applicable laws
6. Data Sharing and Disclosure
We do not sell your personal data to third parties.
Service Providers
We engage trusted third-party providers:
- • Cloud: Amazon Web Services (AWS)
- • AI Models: OpenAI, Anthropic
- • Payments: Stripe
- • Analytics & Communications
AI Model Providers
Your prompts are sent to AI providers with agreements that prohibit training on your data (enterprise), require deletion after processing, and mandate security measures.
Legal Requirements
We may disclose data when required by law, to protect rights and safety, or to detect fraud.
7. Google User Data & Limited Use
When you connect a Google account (Gmail, Google Drive, or Google Calendar) to Nucleus AI, you authorize our AI agents to access specific Google data on your behalf, strictly to provide the features you request. You grant this access through Google's standard OAuth consent screen and can revoke it at any time.
Limited Use Commitment
Nucleus AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Scopes We Request and Why
| Google scope | What it lets Nucleus AI do — only when you ask |
|---|---|
| gmail.readonly | Read your email messages and attachments so the agent can search, summarize, and answer questions about your mail. |
| gmail.send | Send emails you have drafted or asked the agent to send on your behalf. |
| gmail.modify | Organize your mailbox (labels, read/unread, archive) when you request inbox actions. |
| drive.readonly | Open and read documents in your Drive so the agent can find, summarize, and work with files you reference. |
| drive.file | Create files and access files you open with Nucleus AI, so the agent can save its outputs back to your Drive. |
| drive.metadata.readonly | Read file names and metadata to list and locate the right files. |
| calendar.readonly | Read your calendar so the agent can answer scheduling questions and check availability. |
| calendar.events | Create and update calendar events when you ask the agent to schedule on your behalf. |
What we will never do with Google data
- • We do not use Google user data to train, improve, or develop generalized AI/ML models.
- • We do not sell, rent, or transfer Google user data to third parties for advertising or any unrelated purpose.
- • We do not allow humans to read your Google data, except with your explicit consent, where required for security or to comply with applicable law, or where the data has been aggregated and anonymized.
- • We transfer Google user data only as necessary to provide or improve the user-facing features you requested, to comply with applicable law, or as part of a merger or acquisition with continued protection of this policy.
Processing, retention & revoking access
Google data is accessed in real time to fulfill your request and is not retained beyond what is necessary to provide the feature (for example, transient processing and short-lived caches). You can disconnect a Google account at any time from Nucleus AI's connector settings, or revoke access directly at myaccount.google.com/permissions. Revoking access immediately stops all further processing of your Google data.
8. AI-Specific Data Practices
Model Training Policy
Enterprise Plans
Your data is NOT used to train AI models unless you explicitly opt-in
Free/Individual Plans
Anonymized data may improve services, subject to consent preferences
AI Input/Output Data: Stored to provide service and maintain conversation history. Content filtering detects harmful content. AI outputs are not guaranteed accurate.
Automated Decision-Making: AI assists but does not make fully automated decisions with significant effects without human oversight.
Safety Measures: Content moderation, rate limiting, abuse detection, regular audits, and human review processes.
9. Data Security
Encryption
TLS 1.3 in transit
AES-256 at rest
Access Control
RBAC & MFA
Least privilege
Compliance
SOC 2 Type II
Regular audits
Breach Response: We notify PDPC within 3 business days and affected individuals as soon as practicable.
10. Data Retention
| Data Type | Retention Period |
|---|---|
| Account Data | While active + 30 days after deletion |
| Conversation History | While active (deletable anytime) |
| Usage Logs | 90 days |
| Payment Records | 7 years (regulatory) |
| Support Tickets | 3 years after resolution |
11. International Data Transfers
Your data may be transferred to and processed in countries outside Singapore, including the United States.
Transfer Safeguards
- • Standard Contractual Clauses (SCCs)
- • Data processing agreements with all providers
- • Verification of adequate protection standards
- • PDPA compliance for overseas transfers
Enterprise customers may request data residency options for specific geographic regions.
12. Your Rights Under the PDPA
Access
Request access to your personal data and how it was used
Correction
Request correction of inaccurate or incomplete data
Withdraw Consent
Withdraw consent for consent-based processing
Portability
Request data in machine-readable format
Deletion
Request deletion subject to legal obligations
To exercise your rights: Email admin@nucleusenterprise.ai or use account settings. We respond within 30 days.
14. Children's Privacy
Our Services are not intended for individuals under 18. We do not knowingly collect data from children. Parents should contact us immediately if they believe a child has provided personal data.
15. Third-Party Links
Our Services may link to third-party websites. This Policy does not apply to them. Review their privacy policies before providing any personal data.
16. Changes to This Policy
We may update this Policy periodically. Material changes will be notified via email or prominent notice. The "Last updated" date indicates the latest revision. Continued use constitutes acceptance.
17. Complaints and Disputes
Contact us first at admin@nucleusenterprise.ai. We will investigate and attempt to resolve complaints.
Singapore PDPC
If unsatisfied, lodge a complaint with the Personal Data Protection Commission:
www.pdpc.gov.sg | info@pdpc.gov.sg
18. Contact Us
For questions about this Privacy Policy or our data practices:
Email: admin@nucleusenterprise.ai
Address: Nucleus AI, Singapore