Data and privacy
What data Nucleus OS stores, where it is hosted, how AI features use your content, and how to handle access and deletion requests.
What we store
| Category | Examples |
|---|---|
| Account data | Names, email addresses, sign-in identifiers |
| Organization data | Teams, managers, and attributes synced from HR or uploaded by CSV |
| Content | Source documents, generated courses, media, and versions |
| Learning records | Enrollments, completions, attempts, scores, certificates, attendance |
| AI interactions | Prompts and tutor conversations, used to provide the service |
| Billing | Billing contact and payment details (payments processed by Stripe) |
Where data is hosted
Nucleus OS runs on Google Cloud Platform, with managed services for storage, databases, and authentication. Customer data is encrypted in transit and at rest. Regional deployment is available for organizations whose compliance requirements specify where data must reside.
AI and your content
Your content is used only to provide the service to your organization. It is not used to train models for other customers. Content and prompts submitted to AI features are processed by our AI subprocessors solely to generate output for you. The current list of subprocessors is published on the Security page.
Privacy by design
Data handling is designed around GDPR principles: purpose limitation, minimization, and the rights of the people in your programs.
- Sync only what you need. Map only the HR attributes you use for enrollment and reporting. See HRIS sync.
- Tutor conversations are private by default. Managers and authors see aggregate insight, not individual conversations, unless you configure otherwise. See AI tutors.
- Role-based access limits who can see performance data. See Invite users and assign roles.
Access and deletion requests
Your organization is the controller for the personal data of your employees and learners. When a person asks to access or delete their data:
- An admin can export a person's learning records from their profile.
- Deactivating a user ends access but keeps records for compliance. If you need records deleted, contact support with the request.
- Tell us through the support form if you need help fulfilling a request.
Data processing agreement
We sign a DPA with customers. Request it through the contact form. The full Privacy Policy describes how Nucleus Institute handles personal data.