1. Who this policy covers
This Privacy Policy applies to Nuluno’s website, private workspaces, AI marketing agents, and account connections. “Nuluno,” “we,” and “our” refer to the Nuluno service. For privacy questions, contact support@nuluno.com.
2. Information we collect
We collect the account information you provide or authorize, including your email address and identity record; the brand URLs, goals, markets, notes, files, instructions, conversations, approvals, and feedback you add to a workspace; and the research, campaign drafts, designs, evidence, run records, cost records, and audit history created for that workspace.
When you connect a third-party account, we receive the account identifier, display label, granted scopes, access credentials, and records needed to perform the action you requested. OAuth credentials are encrypted and kept separate from AI model prompts.
For a new platform account, Nuluno Access may ask for a username, true birthday or other required age information, and your agreement to that platform’s current rules. These details are used for that account setup. Private registration details and generated platform credentials are encrypted on the server and are not included in agent task payloads.
We also process essential technical information needed to protect and operate the service, such as session cookies, request time, network address, browser information, error records, and security events. Nuluno does not currently use this information for behavioural advertising.
3. How we use information
We use workspace information to authenticate you, keep each user’s work separate, research public sources, generate and improve the marketing work you request, maintain the brand knowledge base, show agent progress, enforce approvals, connect the services you choose, prevent abuse, troubleshoot failures, and provide export and deletion controls.
We do not sell personal information, use Google Workspace data for advertising, or let the agents publish, send, spend, delete, or change an external account without the approval required for that exact action.
4. Google user data
Nuluno’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google Sheets
If you connect Google Sheets, Nuluno may create, read, update, or organize spreadsheet content only when you direct a mission to use the selected Google account. This supports the campaign plans, targets, results, and reports you request. Sheets content is not used for advertising or generalized AI training.
Gmail sending
The separate Gmail sending feature requests identity information and permission to send email. Agents draft messages inside Nuluno. The recipient, subject and body are sent through Gmail only after you approve that exact message. This sending feature does not create drafts inside Gmail.
Gmail verification in Nuluno Access
When you explicitly connect Gmail for account verification, Access requests your verified account identity and Gmail read-only permission. Google’s permission covers the connected mailbox; Access restricts its own requests to registered platforms, the verified recipient and the short verification window of your authorized task. The server retrieves a bounded set of candidate messages, checks their cryptographic signatures and parses the code or confirmation link. It sends that verification material only to the selected platform’s fixed verification endpoint to complete the account task you requested.
Message bodies, raw messages, verification codes and confirmation links are processed in server memory. Access does not put them in AI model prompts, agent responses, application logs or its persistent verification ledger. The ledger stores opaque fingerprints, scope identifiers, timestamps and task status for replay protection and auditing. Gmail messages are not used to select sales prospects, target advertisements, create marketing profiles, improve campaigns for other customers or train generalized AI models.
Storage, sharing, and human access
Google OAuth credentials are encrypted in Nuluno’s server-side database and bound to the user, workspace, mission and provider. Encryption keys are managed separately. Hosting and database providers process the data needed to operate these features. The cloud continuation service receives an encrypted, scoped Access key and task metadata, not Gmail credentials or message contents. Google-connected workspace content is sent to an AI processor only for the specific feature you request; Access verification messages and their codes are excluded.
Human access to Google user data is limited to your explicit permission, necessary security or abuse investigations, applicable legal requirements, or aggregated and de-identified internal operations permitted by Google’s policy. Google user data is not sold, transferred to data brokers, used for credit decisions, used for advertising or used to train generalized AI models.
Your controls
You can disconnect Gmail in Nuluno or revoke its permission in your Google Account. Disconnecting clears the locally stored Gmail credential ciphertext. Revoking an Access key prevents further operations with that key; it does not itself disconnect the entire Google account or remove past audit records. Workspace deletion and security-record retention are described in section 7.
5. AI and public research
Nuluno sends the mission instructions and relevant workspace context to its managed AI provider to create the requested research and marketing work. Public website and search sources may be opened and saved as evidence. Account passwords and OAuth credentials are not placed in model context. Google Workspace content is sent to an AI processor only when it is necessary for the Google-connected feature you asked Nuluno to perform.
6. Service providers and connected platforms
We use service providers to run Nuluno, including identity, cloud hosting, database, security, and AI processing providers, plus the third-party services you choose to connect, such as Google, Meta, Threads, and X. Each connected platform also processes information under its own terms and privacy policy. Vendor details required for privacy or legal review are maintained in Nuluno’s current subprocessor record.
7. Retention, export, disconnection, and deletion
Workspace records remain while your account is active so the agents can use the same evidence, decisions, approvals, and audit history. Provider tokens remain until you disconnect the provider, delete the workspace, the token expires, or the provider revokes it. You can export your workspace from Nuluno, disconnect a provider from the dashboard, revoke Google access from your Google Account, or delete the workspace and its private Nuluno records. Security and transaction records may be retained only as long as reasonably required for fraud prevention, legal compliance, dispute resolution, and system integrity.
8. Security
We use encrypted credential storage, server-owned sessions, CSRF protection, per-user and per-workspace authorization, exact-payload approvals, redacted logs, and audit records. No online service is risk-free. Report a vulnerability to support@nuluno.com without including passwords, tokens, or customer content.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, export, object to, restrict, or delete personal information. Email support@nuluno.com from the account address so we can verify and respond to the request.
Public campaigns and payment processing
Campaign sharing is optional. Only the fields and publication links you explicitly approve become public. You can revoke a public link; copies already adapted by others may remain. Directory listing requires review. Private brand knowledge, messages, contacts and results are not automatically shared.
Where paid checkout is enabled, Stripe processes payment, invoices and subscription management under its own terms. Tax calculation depends on the merchant’s Stripe Tax settings and registrations. Nuluno stores subscription identifiers and verified billing status, not your card details.
10. Changes
We may update this policy when the product, processors, or legal requirements change. The updated date will appear at the top, and material changes will be communicated through the service or account email when appropriate.