Who is responsible
Nugget is operated by Kelvin Brown in the United Kingdom. In this notice, “Nugget”, “we” and “us” refer to Kelvin Brown. For privacy questions or requests, contact [email protected].
This notice covers the Nugget website, waitlist, application and connected features. We determine how account, website, support and security information is used. When a customer puts information about other people into their workspace, the customer determines why it is used and we process it to provide their requested service. Contact that customer first about information they control; we can help direct a request.
Nugget is a business productivity service. It is not directed at children. Integrations are optional, and their availability depends on the features enabled for your account.
Information we handle
You provide account details such as your name and email, workspace preferences, support correspondence, and any information entered into the service. Workspace content can include contacts, companies, deals, tasks, notes, files, meeting information, transcripts and messages. Other people’s information may be supplied by you, your organisation or a service you connect.
Ask handles your questions, relevant workspace context, the files or sources included in your request, and the answers it generates. Saved conversations can contain source titles, links and quoted passages. Avoid submitting information that you are not authorised to use.
We also handle connection identifiers and permissions, timestamps, request and error information, IP addresses, browser information and security audit records. These support authentication, troubleshooting, abuse prevention and account protection. The information collected depends on the feature and action you use.
Why we use information
We use account and workspace information to provide the service you request, maintain your settings, process your instructions and respond to support enquiries. For information needed to provide an account to you, the lawful basis is performance of our contract with you or steps you request before entering that contract.
We use necessary technical and security information for our legitimate interests in protecting accounts, preventing abuse, investigating faults and maintaining a reliable service. We assess those interests against the effects on the people concerned. We also process information when necessary to meet a legal obligation.
Optional waitlist and product-news subscriptions rely on your consent. Product news is a separate choice. You can withdraw that choice through the unsubscribe control in the email or by contacting us. Account-security and essential service messages are separate from marketing.
Information needed for sign-in is necessary to provide an account. Connecting another service is optional; without that connection, the feature that uses it will not be available.
Google data and connected services
A connection starts only after you authorise access through the provider’s consent flow. We use the permissions granted to provide the connected features you choose. Connection services handle authorisation credentials so the application can make authorised requests without asking for your provider password.
Google Drive access is read-only. Nugget can retrieve file and folder names, identifiers, file types, modification information, original links and the contents of supported files. This lets you find relevant documents and ask questions about them. The Drive connection does not allow Nugget to edit, delete or share files in your Drive.
Within Nugget, you choose selected files and folders or explicitly allow access to all files your connected account can open. A selected folder currently covers its direct files; nested folders require their own selection. When you include Google Drive in an Ask request, Nugget searches and reads within that saved access. It does not gain access to files your Google account cannot open.
If you separately enable email or calendar features, the permissions shown in that connection flow determine the data and actions available. Email reading can include sender, recipient, subject, body and message dates for customer context. Calendar reading can include event titles, times, attendees and meeting links. Sending a message or creating or changing an event requires the corresponding permission and an action you request or approve. Granting Drive access alone does not enable those features.
Google user data is used for the visible, user-requested features described here. It is not sold, used to target advertising, used to assess creditworthiness, or used by Nugget to train a general-purpose AI model. These restrictions also apply to information derived from Google data. Our use and transfer of Google API information follows the Google API Services User Data Policy, including its Limited Use requirements.
Ask and AI processing
When you ask a question that uses a connected source, the relevant retrieved text and metadata are sent to an AI processing service with your question and the context needed to answer it. This processing is necessary to generate summaries, answer questions and produce source citations. Connecting a source is separate from including it in an Ask request.
The Drive reader handles bounded file contents during the request. It does not create a permanent searchable copy of your entire Drive. However, the resulting answer and quoted source passages can be stored in your Nugget conversation history. Removing a source does not automatically erase those earlier conversations.
AI outputs may contain errors. Review an answer and its original source before relying on it or approving an action. Nugget provides suggestions; it does not use this feature to make decisions about individuals that have legal or similarly significant effects.
We restrict human access to connected Google content to your specific agreement, necessary security investigation or legal requirements. Google content is not made available for unrelated human review.
Who receives information
We use service providers to host the application and databases, authenticate users, store files, manage connections, process AI requests, deliver emails and protect the service from abuse. Each receives the information needed for its role. For example, a connection provider processes authorisation details and requests to the source service, an AI provider processes the context needed for an answer, and an email provider processes recipient details and message content for delivery.
Information may also be disclosed when necessary to comply with the law or protect accounts and the service. A transfer of Google user data as part of a business sale would require the user consent required by Google’s policy. We do not sell connected Google data or transfer it to advertising or data-broker services.
The original connected service continues to hold your information under its own terms and privacy notice. A request to delete information from Nugget does not delete the original file, email or calendar event from that service.
International processing
Nugget is operated from the United Kingdom. Infrastructure and processing services can operate outside the UK, including in the European Economic Area and the United States. Connecting a service or using an AI feature can involve processing in those locations.
Where a transfer requires safeguards under UK data protection law, the applicable transfer arrangements must cover the receiving provider and the processing involved. Contact [email protected] for information about the providers and safeguards relevant to your data.
Storage and retention
Account details, workspace records and saved conversations are retained while they are needed to provide your account and the content you keep in it. You can delete supported records and conversations or request account deletion. An account-deletion request starts a cleanup process; it is not a promise that every provider copy disappears immediately.
For Drive, Nugget stores the connection state, your access choice, and encrypted identifiers and names for selected files or folders. Retrieved file content is handled for the request rather than added to a permanent Drive index. Answers and quoted passages remain part of saved chats until those chats or the account are deleted.
Disconnecting stops further authorised use through that connection and starts removal of its stored authorisation. A provider failure can delay completion, so cleanup may be retried. Connection and consent records can be retained to record the withdrawal and prevent an old request from restoring access.
Security and audit records are kept separately from ordinary workspace content. Their retention depends on the security event, any open investigation, and applicable legal requirements. Recovery backups may contain older records after active copies are removed. A deletion request includes review of those copies and any reason they must be retained. Contact us for the retention information that applies to a particular request.
Subscription information is kept while the subscription remains active. After withdrawal, a limited record may remain to honour the withdrawal and prevent accidental enrolment. Enquiry correspondence is kept while the request is being handled and for any related complaint or legal requirement.
Protecting your information
Nugget uses access controls, scoped permissions, encrypted connections and security records to protect information. Connection credentials stay on server systems rather than being included in the website’s public code. Access to workspace information is restricted to authorised accounts and service operations.
No service can guarantee absolute security. Contact [email protected] if you believe your account or information has been compromised.
Disconnecting and deleting
You can change your Drive access choice, remove selected sources or disconnect the connection in Nugget’s integration settings. You can also remove Nugget’s access from your Google Account’s third-party connections settings. Revoking access stops future requests; it does not automatically delete information already saved in Nugget.
Delete an Ask conversation to remove its saved answer and source excerpts from active conversation history. For account deletion or a wider privacy request, contact [email protected]. We may ask for enough information to verify the request and identify the relevant records. Do not send us your password, provider token or other secret.
Where an organisation controls the workspace content, we may need to act with that organisation. Legal requirements and the rights of other people can affect what can be deleted or disclosed.
Your rights
Depending on the processing and applicable law, you can request access, correction, deletion, restriction or a portable copy of your personal information. You can withdraw consent where we rely on it; withdrawal does not change the lawfulness of earlier processing.
You can object to processing based on legitimate interests, and you can object to direct marketing at any time. Send requests to [email protected]. We will explain any applicable limit or exception.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first, although we welcome the opportunity to resolve your concern.
Cookies, messages and updates
The application uses necessary authentication cookies and browser storage for sign-in and preferences. The website stores appearance and motion choices. Security and bot-protection services process technical information to protect public forms. These functions are distinct from optional email subscriptions.
We may update this notice when the service or our data practices change. Material changes to Google data use require appropriate notice and renewed consent before the new use begins. Contact Kelvin Brown at [email protected] for questions about this notice.