Privacy Policy

Last updated: October 13, 2026

Effective date: September 5, 2026

1. Introduction

This Privacy Policy sets out how Prachemur Labs LLP, operating under the name "The Nucleus" ("The Nucleus," "we," "us," or "our"), collects and processes personal data in connection with https://www.thenucleus.in/ and related applications and services (the "Service"). It also explains your rights in relation to your personal data.

The Nucleus will usually act as the controller of personal data processed in connection with the administration of the Service itself, such as account registration, billing, and support. In other cases, where our customers use the Service to manage their own contacts, candidates, or customers, The Nucleus acts as a processor on that customer's instructions, as described in Section 2 below.

This Privacy Policy affects your legal rights and obligations, so please read it carefully. By using the Service, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond this Privacy Policy, your use of the Service is also subject to our Terms of Service.

We may update this Privacy Policy from time to time, in particular to reflect changes in applicable law or in the Service. Where changes substantially affect your rights or obligations, we will take reasonable steps to notify you. Otherwise, you are responsible for periodically reviewing this Privacy Policy.

2. Our Role in Relation to Personal Data

We act as a controller of personal data about you if you:

Sign up for an account on the Service, whether for a free trial or as part of an organization's subscription.
Provide personal data to us directly, for example by contacting us, requesting a demo, or subscribing to updates.
Visit our website, in which case we automatically collect certain information about your usage (see Section 3).

We act as a processor of personal data where one of our customers (for example, a business using the Service as their CRM) uploads, imports, or otherwise processes personal data about their own contacts, candidates, or customers within their workspace on the Service. In these circumstances, we process that personal data only in accordance with our customer's instructions and the agreement we have with that customer. If you are an individual whose personal data has been processed on our platform by one of our customers, and you have questions about that data, you should contact that customer directly, since these operations are not covered by this Privacy Policy in the way that our own controller processing is.

3. What Personal Data We Collect

By personal data, we mean any information that can identify you, such as your name, email address, phone number, or IP address.

3.1 Data you provide to us

We collect personal data you provide when you:

Register for or use the Service (name, email address, phone number, organization, role).
Contact us with queries, comments, complaints, or support requests.
Apply for a job with us or provide services to us.
Subscribe to receive product updates or marketing communications.

All personal data you provide to us must be accurate, complete, and kept up to date. We may keep a record of correspondence with you, including support tickets and, where disclosed to you in advance, recorded calls.

3.2 Data we automatically collect

When you use the Service, we automatically collect information about your device and activity, including:

Technical information such as device type, browser, and operating system.
Usage information, such as which features you use and how long you use them.
Approximate location, inferred from your IP address.
Log and diagnostic information, including error reports and authentication events.

3.3 Data from connected third-party services

If you choose to connect third-party accounts to the Service, such as a Google account, we will collect data from that service as needed to provide the connected feature. This may include your profile information, and, depending on the permissions you grant, your email messages, calendar events, contacts, files, and form or spreadsheet data. Section 4 below sets out additional restrictions on our use of data from connected Google services.

We similarly connect with telephony, messaging, and notification providers to deliver calling, SMS, and WhatsApp features, and with cloud infrastructure and database providers to host and operate the Service. We do not name every individual vendor in this Privacy Policy, since our infrastructure providers may change over time, but each is bound to use personal data only to provide the relevant part of the Service to us and not for their own independent purposes. A current list of categories of processing is set out in Section 8.

3.4 Data from others

If your employer or a colleague sets up an account for you on the Service, they may provide us with your name and email address for that purpose. If our customers use the Service to manage their own contacts, candidates, or customers, personal data about you may be uploaded to the Service by that customer, in which case we act as a processor as described in Section 2.

4. Using Data from Connected Google Services

If you connect a Google account (including Gmail, Google Calendar, Google Drive, Google Contacts, Google Forms, or Google Sheets) to the Service, our use of the data obtained through that connection is subject to the following additional restrictions, regardless of anything else in this Privacy Policy. For the avoidance of doubt, we process data received from connected Google services as a processor on your or your organization's behalf, not as a controller.

We will only use access to data from a connected Google service to provide the CRM, email, calendar, drive, forms, and sheets features of the Service that are prominent in the Service's user interface, and to improve those user-facing features.
We will not transfer this data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets.
We will never use Google user data for serving advertisements of any kind.
We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.
We will not allow personnel to read this data except with your affirmative agreement for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.
To make the inbox fast, we keep a copy of the message-list information for a connected Gmail mailbox — for each conversation, its subject, the sender and participant email addresses, dates, labels, and read, starred and attachment status. We do not store the message body or the preview snippet in this copy. It is encrypted at rest, accessible only to our servers (not to browsers), used solely to display that mailbox's inbox to the people the mailbox owner has authorized, and deleted as described in Section 9.
Beyond that copy, we store only what the features need. For emails sent through the Service: the recipient addresses, subject, send time, and open and bounce status, used for campaign reports. For replies: the Gmail message and thread identifiers and the sender's address, used for reply statistics. If you sync contacts: names, email addresses, companies, and interaction counts derived from your mail and contacts. We do not keep the body of your emails, or the content of your Drive files, calendar events, forms, or spreadsheets, apart from what you yourself save into the Service (such as a message template or a file you upload as an attachment). Messages and files are retrieved from Google when you view them.
Google access tokens are stored encrypted at rest. An administrator can disconnect their Google account at any time from Profile settings, and any user can remove the Service's access at myaccount.google.com/permissions. Disconnecting from Profile settings revokes our access at Google and deletes the stored tokens.
If you use an AI-assisted feature, such as the suggestion of a CRM pipeline stage for a lead, the relevant email subjects and snippets and your own notes are sent to our AI provider, OpenAI, only to produce that result for you. This data is not used to train generalized artificial-intelligence or machine-learning models.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How We Use Personal Data

Where we act as a controller, we use personal data to:

Provide, maintain, secure, and improve the Service.
Create and administer accounts, verify identity, and manage permissions.
Communicate with you about the Service, including support, updates, and security notices.
Process and respond to job applications.
Facilitate billing and payment where applicable.
Detect, investigate, and prevent fraud, abuse, and security incidents.
Comply with legal obligations and enforce our agreements.
With your consent, send you product updates or marketing communications, which you may opt out of at any time.

Where we act as a processor on behalf of a customer, we use personal data only to provide the Service to that customer, in accordance with their instructions and our agreement with them, including to power CRM, calling, WhatsApp, email, and related features they use.

We do not sell personal data, and we do not use personal data processed on behalf of our customers for advertising.

6. Who We Share Data With

We may share personal data with:

Infrastructure and service providers. Providers who host our application, provide database and authentication services, deliver push notifications, and support the calling, SMS, and WhatsApp features of the Service, each acting under instructions from us and, where applicable, from the relevant customer.
AI processing provider. OpenAI, which processes content only to provide the AI-assisted features you choose to use, such as CRM pipeline stage suggestions (see Section 4).
Professional advisors. Lawyers, accountants, or consultants, where necessary to obtain advice or services.
Legal and safety. Where required by law, legal process, or a valid governmental request, or where necessary to protect the rights, safety, or property of The Nucleus, our customers, or others.
Corporate transactions. An acquirer, successor, or assignee in connection with a merger, acquisition, financing, reorganization, or sale of assets.
With consent. Any other third party, with your consent.

We do not name every individual infrastructure or processing provider in this document, since the specific vendors we use for hosting, database, communications, and AI processing may change as the Service evolves. Where required by law, a current list of sub-processors is available on request.

7. International Data Transfers

Personal data may be stored or processed in countries other than the country where you live, depending on where our infrastructure and service providers operate. Where required by applicable law, we use appropriate safeguards for such transfers. Please contact us using the details in Section 13 if you would like further information about a specific transfer mechanism.

8. Security

We use reasonable technical and organizational measures designed to protect personal data, including encrypted transport (HTTPS with HSTS), secure session cookies, encryption at rest of Google access tokens, access controls, and authentication safeguards appropriate to the nature of the information. No system can be completely secure, and we cannot guarantee the absolute security of personal data.

9. Retention

We retain personal data for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Following closure of an account or an organization's workspace, we retain the associated personal data for 90 days, after which it is deleted or de-identified from our production systems. This period does not by itself guarantee immediate deletion from routine backups, which are retained and cycled out on a separate schedule, or from third-party providers who independently control data you connected or sent through them.

The copy of Gmail message-list information described in Section 4 is deleted automatically if it has not been refreshed for 90 days, and is deleted together with the connected mailbox owner's account.

When an administrator disconnects their Google account from Profile settings, the stored Google tokens are revoked at Google and deleted immediately.

Where we act as a processor, personal data is retained in accordance with the instructions of the relevant customer.

10. Your Rights

Depending on your location and applicable law, including India's Digital Personal Data Protection Act, 2023, you may have rights to:

Access the personal data we hold about you.
Correct inaccurate or incomplete personal data.
Request deletion of your personal data, subject to legal and operational exceptions.
Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Lodge a complaint with an applicable data-protection authority.

You may exercise these rights by contacting us using the details in Section 13. If we process your personal data as a processor on behalf of one of our customers, you should contact that customer directly to exercise your rights; if you contact us instead, we will notify the relevant customer and assist them in responding to you.

11. Children's Privacy

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal data from children under 18 years of age. If you believe a child has provided personal data to us, please contact us using the details in Section 13.

12. Third-Party Platforms

The Service may include links to, or integrations with, third-party websites and applications. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policy of every third-party service you connect to or visit.

13. How to Contact Us

You can contact us with any questions or comments about this Privacy Policy, or any other privacy-related enquiries, at:

Prachemur Labs LLP (operating "The Nucleus")

Email: info@thenucleus.in

Website: https://www.thenucleus.in/

Registered address:

22-8-156/2B, Upadaya Nagar,

Tirupati - 517 501, Andhra Pradesh, India

Governing law and jurisdiction: This Policy is governed by the laws of India. Subject to applicable law, courts at Tirupati, Andhra Pradesh shall have jurisdiction over any disputes arising from this Policy.