Privacy Policy

1. Who we are and what this policy covers

NuSphere is operated by BPN Solutions LLC ("BPN", "we", "us"). NuSphere connects a company's email, calendars, files and other work sources so its people, and the AI assistants they choose to act for them, can find and use that information.

This policy covers the NuSphere platform and the websites, web and mobile apps, APIs, developer tools and integrations that BPN operates under this policy. These include Library at library.nusphere.app, where people sign in and use their information; Admin at admin.nusphere.app, where people connect sources and choose their settings; the public home page at nusphere.app; the former Orbit website, which forwards people to Library; the NuSphere API; and mcp.nusphere.app, which AI assistants use to connect. New NuSphere apps and features that link to or reference this policy are covered as they become available. It explains how we handle information about the people who use NuSphere and the information they connect, including data we receive from Google. Independently operated services and apps, including apps your company builds or connects, have their own privacy practices; this policy still governs how NuSphere handles information when working with them.

NuSphere is for approved companies only. People join by invitation from their company; there is no public signup. "Your company" means the approved company that invited you. Your company's owners and admins manage its NuSphere, but that role does not give them your private content.

Not every feature or integration is offered to every company at all times. The information a feature receives depends on what it does, what you or an authorized person at your company enables, and the permissions and selections that apply. Adding an app or integration does not by itself expand those permissions. Section 5 explains how we describe new integrations and changes in data handling.

2. Information we receive

• Account information: your work email address, name, provider account and directory identifiers, role and teams, the invitation that admitted you, and your company's name and verified work domain. Section 4 describes Google sign-in; Microsoft sign-in is described below.
• Content from connected work sources: email and messages; calendar and meeting records; files and documents; contacts; project, customer and other business records; and related details such as names, participants, dates, status and source identifiers. These categories describe information that may be present in the sources you or your company connects; an integration receives only what its supported features, authorization and selections allow. Section 4 gives the specific Google permissions and data, and section 5 describes other integrations and their disclosures.
• Content you add: information you or your company submits through NuSphere apps, APIs or developer tools, including uploaded files, notes, business records and app data; spaces and the items placed in them; and corrections and relationships between people and companies that you save.
• Your choices: the agreements you accept or withdraw, your sharing choices and exceptions, what you select from each source, and your switches for actions.
• Assistant activity: records of what AI assistants do for you through NuSphere; for the Library assistant, your questions, its answers and the items it used; and for actions, each request, what you reviewed and the outcome.
• Operational records: sign-in sessions, connection status, timestamps, error codes and a history of changes, used to run, secure and troubleshoot NuSphere.
• Support: what you send us when you ask for help.

Items from your sources often contain information about other people, such as the people you write to or meet with. NuSphere handles it under the same rules as the rest of your items.

Signing in with Microsoft

Where offered, Microsoft sign-in uses work or school accounts and requests only openid, profile and email. We receive the account's Microsoft Entra identifier (oid), directory identifier (tid) and issuer, and, when Microsoft supplies them, your name, email address and whether its domain is verified. We use these to verify who is signing in, match the identity to an invited membership and check which companies it may enter. Your email address alone does not authorize access. This sign-in does not request permission to read your mail, calendars or files; connecting Outlook is a separate permission described in section 5.

3. How we use information

We use information only to provide and protect NuSphere for you and your company: to sign you in and confirm your membership; to collect, store and organize the sources you connect; to let you, and the people your sharing choices and your company's settings allow, search and read them; to carry out actions you ask for; to answer requests you make to AI assistants acting for you; to keep NuSphere secure, investigate problems and abuse, and provide support; and to meet legal obligations.

NuSphere organizes the names and email addresses of the people and organizations that appear in your items into records of people and companies. Each person sees those records only through items they are allowed to open, or records they made themselves. Members of a company can also see each other's names and email addresses in its directory. A relationship you state between people or companies is visible, with your name (not your email address) and any note you add, to everyone in your company who can see both of them.

NuSphere's assistants act on requests from people who can open the items involved. Optional background text recognition of scanned files is separate from assistant requests; section 6 describes its controls.

We do not sell personal information, use it for advertising or share it for cross-context behavioral advertising, or use it to make credit or lending decisions.

4. Google user data

NuSphere's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Data from Google Workspace APIs is also subject to the Google Workspace API User Data and Developer Policy. This section explains, for each Google product, what NuSphere accesses, why, and how it uses, stores, shares and deletes that data.

Except for access your company's Google administrator grants (described under Gmail), each kind of Google access below is a separate request that you approve on Google's own screen. Granting one does not grant another. When you connect a source or an action, NuSphere refuses the grant if Google returns any permission other than the ones it asked for.

Signing in with Google

Google permissions: openid, email and profile. Some sign-ins, such as connecting an AI assistant at mcp.nusphere.app, ask only for openid and email.

We receive your Google account identifier, your email address and whether Google has verified it, your name, and the domain of your Google Workspace organization if you belong to one. We use them to confirm that you are the person your company invited and to keep you signed in. We never receive your Google password, and we do not use your profile photo.

Gmail

• Collecting your mail (gmail.readonly). When you connect Gmail in Admin and confirm your mailbox, NuSphere saves a copy of every message in your mailbox outside Spam and Trash, including past messages, sent mail and drafts: the complete original message, its attachments, and details such as sender, recipients, subject, date, labels and thread. It keeps collecting new and changed messages until you pause or disconnect Gmail. This permission only reads; NuSphere cannot change your mailbox with it. The copy lets you, and AI assistants acting for you, search and read your mail in NuSphere.
• Gmail actions (gmail.modify). A separate connection you can authorize in Admin under My Gmail actions. When you ask, an AI assistant acting for you can search and read your mailbox, read and save attachments, write drafts and replies, send mail, apply or remove existing labels, mark messages read or unread, star them or mark them important, archive them, mark them as spam or not spam, and move them to Trash or restore them. Writing drafts starts on; sending and mailbox changes start off, and only you can turn them on, in your own settings in Admin. When sending is on, each message is first shown to you in your browser, with every recipient (including Bcc), the body and the attachments, for your approval, unless you turn that review off. When mailbox changes are on, a change to one message happens without a review; changes to many messages at once, and moves to Trash, are shown to you for approval first unless you turn those reviews off. NuSphere never permanently deletes mail, does not create, rename or delete labels, and does not send from other addresses. Google's permission would allow sending, but NuSphere sends only when your own settings allow it. NuSphere keeps an exact copy of each draft and sent message, files you upload for drafts, and attachments you ask it to save, in your own folder of your company's private storage, along with a record of each request and its outcome.
• Access your company's Google administrator grants (gmail.readonly, gmail.compose and gmail.modify). A company that uses Google Workspace can instead authorize NuSphere for its domain in the Google Admin console ("domain-wide delegation"). NuSphere uses that authorization only for the people BPN enrolls for that company, and they are not shown a Google consent screen. For an enrolled person, NuSphere collects Gmail as described above, using only gmail.readonly, and what it collects is private to that person in the same way. Where delegated Gmail actions are set up for a person, the same kind of authorization lets an AI assistant acting for them read the mailbox (gmail.readonly), write drafts and send mail (gmail.compose) and, where the company's setting allows, make the mailbox changes above (gmail.modify); that person's own switches and reviews for Gmail actions still apply. Removing NuSphere at https://myaccount.google.com/permissions does not end access granted this way: only the company's Google administrator can remove it, in the Google Admin console.

Google Calendar

• Collecting your calendars (calendar.events.readonly and calendar.calendarlist.readonly). NuSphere lists your calendars so you can choose which to include; calendars you own are preselected. For each calendar you choose, it saves a copy of its events, past and future, as Google provides them: titles, times, descriptions, locations, attendees, recurrence, cancellations and links. It does not download files attached to events. "Keep adding calendars I create" starts on and adds calendars you own later; a calendar someone shares with you is added only if you choose it. NuSphere keeps collecting new and changed events until you pause or disconnect Calendar. These permissions only read; NuSphere cannot change your calendars with them.
• Calendar actions (calendar.events.owned, calendar.calendarlist.readonly and calendar.events.freebusy). A separate connection you can authorize in Admin under My Calendar actions. An AI assistant acting for you can list your calendars, read events within a window of up to 31 days, and check free or busy times. When you ask, it can create, change or cancel events on calendars you own, one occurrence at a time for a recurring event. Creating, changing, cancelling and notifying guests each have a switch that starts off. Reviews of changes, cancellations and guest notifications start on: the exact times, guests and any conflicts are shown to you in your browser for approval first. NuSphere keeps a record of each request, what you reviewed and the outcome.

Google Drive

• Collecting your files (drive.readonly). NuSphere offers My Drive, together with files others have shared with you, and each shared drive you belong to; you choose which to include. For each file in what you choose, NuSphere saves its details as Google provides them, such as its name and type, and a copy of its contents: the original file up to 15 MiB or, for Google Docs, Sheets, Slides and Drawings, an exported copy within Google's export limit. Folders are saved as details only. NuSphere keeps collecting new and changed files until you pause or disconnect Drive, and when you ask for current values it can read a spreadsheet range again. Shared drives you join later are added only if you turn that on. This permission only reads; NuSphere cannot change your Drive with it.
• Drive actions (drive). A separate connection you can authorize in Admin under My Drive actions. Google's permission covers your whole Drive; NuSphere's own switches decide what an AI assistant acting for you may do with it, and with every switch off it can do nothing. One switch lets the assistant list, find and read files and read spreadsheet cells. Four more allow creating folders, files and copies; changing files (replacing content, renaming, moving and updating spreadsheet cells); moving files to Trash and restoring them; and sharing or unsharing files with a person or group. All five start off. Reviews of creating, changing and Trash start on and show you the exact change in your browser first. A sharing change, and creating, copying or moving a file into a folder other people can open, are always shown to you for approval. NuSphere never permanently deletes files or empties the Trash, never shares with anyone who has the link or with a whole domain, never transfers ownership, and never removes your own access. NuSphere keeps a record of each request, what you reviewed and the outcome.

Your controls for Google actions

Only you can authorize Gmail, Calendar or Drive actions on your own Google account, except delegated Gmail actions your company's Google administrator authorized (described under Gmail). Only you can change your switches or approve a review, and only in your signed-in browser. An AI assistant can read your settings but cannot change them or approve anything, and your company's owners and admins cannot change them or use your connection. NuSphere tells assistants to act only when you ask, and turning a review off does not change that rule; a review is how you check a change before it happens. An approval covers only the exact change you saw and expires if it is not used. Turning a switch off or disconnecting cannot undo a change Google has already accepted.

Who can see your Google data

What NuSphere collects from your Gmail, Calendar and Drive is private to you. Being an owner or admin of your company does not let anyone read it through NuSphere; owners and admins can see whether you have connected each source, not what it contains. It becomes visible to other people in your company, owners and admins included, only in these ways:

• Spaces. You share an item by adding it to a Space yourself, or through a rule you choose for that Space after seeing what it shares. Sharing requires your current agreement to sharing into Spaces. The Space's people can open its shared items. You can keep items, labels or folders, whole sources or correspondents private, and withdraw sharing. Joining a team or connecting a work mailbox does not automatically share its contents; the former team-sharing and company Gmail sharing rules are retired.
• Defined warehouse data, where available. A Space's Managers can make it available as a warehouse source; an owner or admin can also do so for a Space everyone can open. This alone copies nothing. A developer assigned by an owner or admin defines an extraction of chosen items and fields they can read. By default, INHERIT shows each viewer only what their source permissions allow. An explicit, recorded PUBLISH choice shares the validated selection with a company data role, such as Sales, whose members or applications may not be able to open the source items. This same rule applies to governed shared data from Google and other providers. Private or unshared originals are excluded, and additional role rules can only narrow the chosen audience.

What NuSphere collected privately from your Google sources can be read by an AI assistant acting for you only after you accept "AI assistants acting for you". That acceptance does not govern two other kinds of reading, which section 6 describes: an assistant you connect can read your live Google data through Gmail, Calendar or Drive actions you authorize, and items shared in the ways above can be read by AI assistants acting for the people who can open them. If your company uses Google Workspace, its Google administrator can also limit or block NuSphere's access in Google's own admin console.

Limited Use of Google user data

• We use Google user data only to provide and improve the user-facing features described in this policy, which you can see and use in NuSphere.
• We transfer Google user data only to provide those features (to people in your company as described above and AI assistants acting for them, to AI assistants you connect, to applications your company connects as section 7 describes, and to the service providers in section 7 that run NuSphere for us), for security purposes such as investigating abuse, to comply with applicable law, or as part of a merger, acquisition or sale of assets after first obtaining your explicit consent.
• We do not sell Google user data, and we do not transfer it to advertising platforms, data brokers or information resellers. We do not use or transfer it to serve ads, including retargeting, personalized or interest-based advertising, or to determine credit-worthiness or for lending purposes.
• We do not use Google user data, including data from Google Workspace APIs, to develop, improve or train generalized or non-personalized AI or machine-learning models, and we do not transfer it for that purpose. NuSphere does not train AI models on it at all. Processing for assistant requests and optional text recognition follows the controls in section 6.
• Nobody at BPN reads your Google user data unless you first agree that we may view specific messages, files or other data (for example, to help with a support request); it is necessary for security purposes, such as investigating a bug or abuse; it is necessary to comply with applicable law; or it is aggregated and anonymized and used for internal operations in accordance with applicable law. Our employees, agents and contractors must follow these rules.
• Before NuSphere uses Google user data in a new way or for a new purpose, we will update this policy and ask for your consent.

5. Connected services and new integrations

NuSphere connects to work services through supported integrations. A connection may belong to your own account or, where supported, be authorized for your company by someone entitled to grant that access. Authorization to connect a source is separate from permission to share its information or take actions in it. The specific Google consent, delegated access and sharing rules remain as described in section 4.

Before an integration is enabled, its disclosures in this policy, the connection flow or linked integration documentation describe what information it accesses, why, whether it can make changes, and the relevant selection and sharing controls. We maintain those disclosures as integrations change. The following entries describe current non-Google sources; they are not a promise that every provider or category of business system is supported.

• Microsoft Outlook, where offered: mail from the account you connect under its own permission. Its captured items follow the same private-source and governed Space-sharing rules.
• GitHub: through NuSphere's GitHub App, issues, pull requests and their discussions and review comments from repositories you select. NuSphere does not copy code files or full commit history, although review comments can quote code.
• Granola: with a personal API key you enter, the meeting notes, summaries and transcripts that Granola makes available to you. NuSphere only reads from Granola.
• Discord: one member connects Discord for the whole company, and a server administrator installs NuSphere's bot separately. NuSphere collects messages and attachments from the channels that member chooses and can already read. Other members can see that Discord is connected.

What these sources collect is private to the person who connected them, except as the sharing described in section 4 allows. New integrations may support additional providers for communications, meetings, documents, project or customer records, and other business systems. A new provider is subject to the applicable account or company authorization, the purposes and protections in this policy, and its own integration disclosures.

Before introducing collection or processing that this policy does not cover, we will update this policy and the relevant integration or feature disclosures, give any required notice, and obtain any required consent or authorization. The same applies when a new NuSphere app changes the data collected, its use, who receives it or how long it is kept. Accepting this policy or connecting one service does not by itself authorize new provider permissions, a new purpose or wider sharing. The Google-specific rules in section 4 continue to apply to Google user data wherever NuSphere uses or shares it.

6. AI assistants and text recognition

What NuSphere collected privately from your sources can be read by an AI assistant acting for you only after you accept "AI assistants acting for you" in Your data and AI, and only while that acceptance is current. You can withdraw it at any time. That acceptance does not govern two other kinds of reading:

• Your Google actions. If you authorize Gmail, Calendar or Drive actions (section 4), an assistant you connect can use them to read your live mailbox, your calendars' events and free or busy times and, if you turn on the Drive switch for reading files, your Drive files and spreadsheet cells, whether or not you have accepted.
• Shared items. Items shared in the ways section 4 describes can be read by AI assistants acting for the people who can open them, including you.

Optional background text recognition (OCR). Where available, NuSphere can send scanned files from connected sources to a configured Google Cloud Document AI processor for text recognition. This runs in the background, without an assistant request, and is off by default. It requires your company to turn on its OCR switch and you to accept the current agreement containing the OCR disclosure with at least one purpose: "AI assistants acting for you" or "sharing into Spaces". Recognized text can be wrong and keeps the source item's permissions; OCR does not give another person access to a private item.

NuSphere works with two kinds of AI assistant:

• Assistants you connect. You can connect an AI assistant application you choose, such as Claude, to NuSphere by signing in at mcp.nusphere.app. NuSphere then gives that assistant what it asks for on your behalf and you are allowed to see, including items from your Google sources and, if you authorized them, the Gmail, Calendar and Drive actions in section 4. NuSphere sends it data only in answer to its requests on your behalf, never to train a model. What NuSphere sends to that assistant is then handled under its provider's terms and privacy practices, which BPN does not control.
• The Library assistant. Where BPN has enabled it for your company, the Library assistant answers your questions in Library using Anthropic's Claude models, which NuSphere uses through Google Cloud's Vertex AI. It sends the model your question, the conversation so far, any Library document you add to it and, when you ask about your work, the titles, snippets and text of relevant items you are allowed to open, which can include items from your Google sources. NuSphere sends this to answer your question, never to train a model. Conversations expire after a period set for your company, no longer than 90 days, and are then deleted. You can clear your history sooner.

These providers process information to produce the answer, under their service terms. This policy does not promise that a provider keeps no copy of what it processes.

NuSphere tells assistants to treat text inside your items, such as an email's wording, as information and not as instructions. Such text cannot change your permissions or approve an action: only you can, in your signed-in browser. An assistant could still be misled by it, so check what an assistant proposes; where a review is on, you see the exact change before it happens.

7. Who receives information

• People in your company: as your sharing choices and your company's settings allow (sections 4 to 6), including through AI assistants acting for them. Owners and admins manage membership and see status, such as whether you have connected a source or accepted an agreement, not the content of your private items.
• Service providers that run NuSphere for us: Google Cloud hosts NuSphere and its databases and file storage, and provides Vertex AI and Document AI for optional text recognition. Anthropic's Claude models run through Vertex AI for the Library assistant. Resend delivers invitation emails, which contain the invited person's email address, the inviter's name, the company's name and a link to join. These providers process information for us under their service agreements.
• Assistants and applications: AI assistants you connect receive what section 6 describes. An application using INHERIT queries acts for the signed-in viewer and receives only the source data that viewer can open. Your company can also authorize an application or service to read an explicitly published warehouse selection through its data role, as section 4 describes. That role audience can be broader than the source audience. Private or unshared originals are not warehouse sources.
• Legal and safety: we may disclose information when the law requires it, or when necessary and permitted by law to protect people, NuSphere or our legal rights. The Limited Use rules in section 4 still apply to Google user data.

8. Retention, disconnection and deletion

NuSphere keeps information while your company uses NuSphere, subject to the rules below. There is no single age-based deletion schedule for every copy. A removed member's private source data has a 90-day hold; shared Space items and the files supporting them follow the Space's retention and permissions.

• Pausing a source stops collection and hides what the source collected until you resume.
• Disconnecting a source stops collection and deletes NuSphere's stored credential for it. What it collected is hidden from you and from everyone it was shared with, shared copies are then removed, and the readable text NuSphere made from it is deleted. Original files remain in private storage until a separate storage-deletion process or a verified deletion request removes them. Disconnecting alone does not establish that those files have been erased.
• Disconnecting Gmail, Calendar or Drive actions deletes NuSphere's stored credential for them. It does not undo changes already made in your Google account, and the record of past requests is kept.
• Deleting or moving something in Google does not delete the copy NuSphere already saved. Where NuSphere learns of the change, such as a message moved to Spam or Trash, it stops showing that item, but it does not learn of every deletion.
• Leaving your company's NuSphere ends your access and revokes your source and action connections. Items a Space could read under your current sharing agreement at removal are kept for that Space's people, subject to its permissions. Your private captured data is hidden from everyone in the company and held for 90 days before becoming eligible for deletion in bounded cleanup steps, unless a company owner places a legal hold. Pages and uploads you created are held separately. Retained files supporting shared copies are kept; other original and action files require a separate storage-deletion run. The 90-day hold is not a promise that stored files or backups are physically erased on that day.
• Removing NuSphere from your Google account at https://myaccount.google.com/permissions revokes, at any time, the access you granted NuSphere yourself, for collection and for actions; to connect again, you approve again on Google's screen. If more than one NuSphere entry appears there, remove each one. It does not sign you out of NuSphere, and it does not end access your company's Google administrator granted (section 4). Disconnecting inside NuSphere does not remove NuSphere from that list.

To ask us to delete information, including the original copies collected from your sources, email support@bpnsolutions.com. Your company can also ask us to delete its whole workspace. We verify that the request comes from you or from someone with authority over the records, and we coordinate requests about company records with your company's owners. When we handle a deletion request, we will explain anything we must keep, such as limited security, legal or backup records. Copies in our backups remain until those backups expire on their own schedule. We do not promise a fixed deadline.

9. Security

Each company has its own database and private file storage. Permissions are checked in the database on every request, so a company's people cannot reach another company's data, and a member's private items are closed to other members, including owners and admins. Credentials for Google and other sources are encrypted before they are stored, and people who use NuSphere, including owners and admins, cannot read them. Connections to NuSphere and to Google use HTTPS, and our hosting provider, Google Cloud, encrypts stored data by default. NuSphere records a history of changes and actions. No service can guarantee perfect security; contact us if you believe your information is at risk.

10. Cookies and browser storage

NuSphere's web apps use cookies to keep you signed in and may keep small preferences in your browser, such as a prompt you chose to hide. NuSphere does not use advertising or third-party analytics trackers. This policy page sets no cookies.

11. Your choices and rights

• In Admin you can choose which sources to connect and what each includes, pause or disconnect them, keep things private, manage or withdraw sharing into Spaces, withdraw "AI assistants acting for you", and turn each action switch on or off.
• You can remove the access you granted NuSphere to your Google account at https://myaccount.google.com/permissions. Access your company's Google administrator granted can be removed only by that administrator (section 4).
• Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to restrict or object to its use, or to withdraw consent. Email us to use them. We may need to verify your identity and coordinate with your company. We will not penalize you for exercising privacy rights the law protects, and you may also contact your local privacy regulator.

12. Where information is processed

BPN is based in the United States, and NuSphere is hosted on Google Cloud in the United States. Service providers may process information in other places where their services operate; for example, AI processing may use a Google Cloud endpoint that does not promise a particular region. This policy does not promise a particular data-residency boundary.

13. Children and changes to this policy

NuSphere is a business service and is not directed to children under 13. Contact us if you believe a child has provided information that should be removed.

When we change this policy, we will post the new version here with its effective date and keep earlier versions at their own dated addresses. We will notify affected companies of material changes and provide any additional notice or consent process required for affected people. New integrations and apps follow the disclosure and authorization process in section 5. Before NuSphere uses Google user data in a new way or for a new purpose, we will ask for your consent.

14. Contact and support

Privacy requests and support: support@bpnsolutions.com. BPN Solutions LLC, 11989 Windpointe Pass, Carmel, IN 46033, USA. Please do not email passwords or API keys when asking for help.