Privacy Policy

Nucleus OS is used by organizations (“Customers”) to create training, deliver it to their employees, partners, or customers (“Learners”), and measure the results.

• When we act as a processor. For workspace content and learner data that a Customer puts into or generates in Nucleus OS, the Customer is the controller and we process that data on its behalf under our agreement with it. If you are a Learner, your employer or the organization that invited you decides how your data is used; please direct privacy requests to them first, and we will help them respond.
• When we act as a controller. For our website, account registration, billing, sales and support communications, and job applications, Nucleus Institute is the controller.

• Account information: name, work email, password (stored only as a salted hash by our authentication provider) or single sign-on identifiers, organization, role, and profile details such as an avatar.
• Workspace and learner content: documents, slides, videos, SOPs, and other source material you upload; courses, quizzes, and media created in the Service; and settings, branding, and integrations configured by administrators.
• Learning activity: enrollments, progress, completions, assessment responses and scores, certifications, attendance in virtual classroom sessions, and similar records about how learners use the Service. Where a Customer connects an HRIS or identity provider, we receive the directory fields it chooses to sync (for example name, email, department, manager, start date, and location).
• AI tutor conversations: questions learners ask the AI tutor, the responses generated, and feedback on those responses.
• Billing information: plan, credit balance, and transaction history. Card details are collected and stored by our payment processor, Stripe; we do not store full card numbers.
• Support and contact messages: what you send us through our contact form, in-app help, email, or demo requests, including your name, email, company, and message.
• Device and usage data: IP address, browser and device type, pages viewed, timestamps, and diagnostic logs collected to operate and secure the Service.

• Provide, maintain, and secure the Service and authenticate users.
• Run the features Customers turn on, such as AI authoring, AI tutors, adaptive learning paths, automated enrollment, certifications, and analytics.
• Process payments, meter credit usage, and prevent fraud and abuse.
• Respond to support requests, contact messages, and demo requests.
• Send service and account notices and, where permitted, product updates you can opt out of at any time.
• Evaluate job applications.
• Comply with legal obligations and enforce our agreements.

AI features in Nucleus OS generate courses, assessments, media, tutor answers, and analytics summaries from the content in your workspace. To do this, relevant content is sent to the AI model providers we use as subprocessors, solely to generate output for you.

• We do not use Customer content, learner data, or AI tutor conversations to train our own or third-party foundation models.
• We use model providers under terms that prohibit them from training on data sent through our API usage.
• AI tutor answers are grounded in the content your organization has approved. Conversation history is retained as part of the workspace so administrators can review quality and learners can pick up where they left off.

If you sign in with Google, Google shares your basic profile with us: name, email address, and profile picture. We request only these basic scopes and use them solely to authenticate you and display your profile in the Service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time at myaccount.google.com/permissions.

When you apply for a role through our careers page, we collect the information you submit: name, email, phone number, location, links such as LinkedIn or a portfolio, your resume or CV, cover letter or answers to application questions, and any notes from interviews.

• Purpose: to assess your application, communicate with you about the role, and comply with employment and record-keeping laws. We do not use AI to make automated hiring decisions.
• Access: limited to the people involved in hiring for the role and the service providers that host our applicant data.
• Retention: we keep applicant records for 24 months after the application is submitted so we can consider you for future roles, and then delete them. If you are hired, your information becomes part of your employee record.
• Your rights: you can ask to access, correct, or delete your application at any time, or withdraw it, by emailing admin@nucleusinstitute.com.

We use a small number of cookies and browser storage entries that are necessary to sign you in, keep the Service secure, and remember settings such as your theme. Our marketing site also uses the Google Ads tag to measure whether our advertising leads to actions such as demo bookings. See our Cookie Policy for the full list and how to change your choices.

We share personal information only as follows:

• Subprocessors and service providers that host infrastructure, authenticate users, provide AI models, deliver email, and process payments, under written agreements requiring confidentiality and appropriate safeguards. Our current list is on our Security page.
• Within your organization: administrators and managers in a Customer workspace can see learner activity as configured by that Customer.
• Integrations you enable, such as an HRIS, identity provider, or messaging tool, receive the data needed for that integration.
• Legal and safety: where required by law or legal process, or to protect the rights, safety, and security of our users, the public, or Nucleus.
• Business transfers: in a merger, acquisition, or sale of assets, subject to this Policy.

Nucleus Institute is based in Canada, and we and our subprocessors may process information in Canada, the United States, and other countries. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Enterprise Customers can discuss regional deployment options with our team.

We keep personal information for as long as needed for the purposes described here. Workspace content and learner data are kept for the life of the Customer’s subscription and deleted or returned after it ends, as set out in the Customer agreement. Account data is deleted when an account is closed, except where we must keep records for legal, tax, security, or dispute purposes. Applicant records are kept for 24 months, as described above.

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent. These rights arise under laws including the EU and UK GDPR, Canada’s PIPEDA and applicable provincial privacy laws, and the California Consumer Privacy Act (CCPA/CPRA).

• California residents: we do not sell or “share” personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your rights.
• If you are a Learner, we may refer your request to the organization that controls your data.
• You may complain to your local data protection authority, including the Office of the Privacy Commissioner of Canada.

To make a request, email admin@nucleusinstitute.com. We will verify your request and respond within the time required by law.

Nucleus OS is built for workplace learning and is not directed to children under 16. We do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, single sign-on support, and audit logging. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify affected Customers and individuals as required by law. Learn more on our Security page.

We may update this Policy from time to time. We will post the new version here with a new “Last updated” date and, for material changes, notify account owners by email or in the Service.

Nucleus Institute
555 Burrard St, Vancouver, BC V7X 1M8, Canada
admin@nucleusinstitute.com

You can also reach us through our contact form.