Privacy Policy

2.The short version

• There is no recording. Nuggt turns speech into text on your own computer. The audio is never uploaded or sent to anyone; the app contains no code that uploads audio.
• The words reach us as text, only during the meeting. They sit in our servers' working memory while the meeting runs and we never store transcripts.
• We keep what the product runs on: the facts Nuggt extracted, the answers it showed you, and your meeting notes. They persist until you delete them, and that memory spans all of your meetings. On the Free plan, the contents of meetings older than 30 days are hidden, not deleted, and their facts still inform your later meetings.
• An AI provider reads the conversation to write answers. Today that is OpenAI. Under its API terms it says it holds what we send it for up to 30 days and does not train on it; we do not train on your content either (section 5).
• Your data is stored in the United States.
• You can delete a meeting yourself, and you can ask us to delete your whole account from Settings; we complete that usually within 72 hours and always within 30 days.
• If we add a provider that will handle your data, we email you first.

3.What we collect, and why

3.1 Your account

When you sign in we receive from our sign-in provider (WorkOS) your email address and, where the provider shares it, your first name. You cannot have an account without an email address. During onboarding you tell us roughly how you use Nuggt (for yourself, with a team, with clients, and so on) and, optionally, your role and what your team wants from it; those answers are kept with our usage records (section 3.7). When you acknowledge the reminder about telling meeting participants you are using AI notes, we record that you did, and when.

We use this to create and secure your account, to know which organisation and plan you belong to, to send you the emails described in section 3.6, and to understand how Nuggt is used.

3.2 Your meetings

Live transcript. While a meeting is running, the words spoken are transcribed on your computer and sent to our servers as text over an encrypted connection, so that Nuggt can answer questions as they come up. It reads the whole conversation so far, not just the last sentence. The transcript is held only in our servers' memory for as long as the meeting runs, and for up to an hour after the last words arrive if the app disconnects without ending it. It is never written to a database or disk on our side: there is no transcript table to write to.

If you switch on local transcript storage in the app (it is off by default), your transcripts are saved encrypted on your own computer. That file never reaches us.

What we keep from a meeting. Nuggt keeps what it derives from the meeting rather than the meeting itself: for example the facts worth remembering (with the meeting context they came from), the answers it showed you, your notes and summary, and the meeting's title and times. These are the memory the product runs on: without them, every meeting would start from nothing. That memory is yours and spans all of your meetings: a fact Nuggt kept from one meeting can be surfaced in a later meeting of yours, whoever is in it. There is no way today to keep facts from different clients or projects apart, other than deleting a meeting, which removes its facts from that memory. Separating them is on our roadmap (see the trust page).

Meetings can touch on sensitive matters, such as someone's health or finances. We do not seek such information; if it is spoken, we process it only to provide the service described here, and for nothing else. Use Nuggt where your organisation's policies allow a service provider to handle meeting content.

3.3 Other people in your meetings

We rely on you to tell participants that you are using an AI assistant, and to obtain any consent the law where they are requires. Laws vary; some require every participant's consent. Nuggt reminds you of this before your first meeting.

Your meetings involve people who are not Nuggt users. They will not read this page; the notice they get comes from you, because you chose to use Nuggt in that meeting and it is your meeting. What we hold about them is what they said, received from you as text during the meeting, and whatever Nuggt kept from it afterwards, which may mention them by name. We process it only on your instructions, we do not use what they said for any purpose of our own, and we do not contact them. If a participant objects, stop Nuggt for that meeting.

If you were in a meeting with a Nuggt user and have a question about what was kept, the user is the one who can answer it. You can also email support@nuggt.ai with who you met and when; meeting content is not indexed by who was in the meeting, so we will pass your request to the user and help them respond.

3.4 Connected services (only if you connect them)

If you connect Notion, Nuggt can search it during a meeting. The connection is authorised by you on Notion's site. Your Notion credentials are kept on your computer; a short-lived access token is sent to our servers only for the duration of a meeting, where it is held in memory and never stored. Notion receives the search queries Nuggt makes: your question, and a few AI-generated rewordings of it. Excerpts of matching pages come to Nuggt and are handled like meeting text: used to write the answer, and sometimes quoted in it. You can disconnect Notion in the app at any time.

3.5 Billing

Payments are handled by Stripe. When you subscribe, your card details are entered on Stripe's pages and never pass through our systems. We tell Stripe your email address and name so it can create your customer record; Stripe also collects your billing address for tax purposes. We keep the identifiers that link your organisation to that record and to your subscription, plus which plan you are on.

3.6 Email

We send a small number of emails from our own systems: a welcome message when you first sign in; a follow-up after your first meeting; a prompt to upgrade if you hit a free-plan limit; and confirmations when you request account deletion and when it is done. The follow-up and upgrade emails carry a one-click unsubscribe link and we honour it; the others are needed to run your account. When you request deletion, our team is notified. No automated email we send contains the content of a meeting.

3.7 Product usage and security records

We record counts and events about how Nuggt is used (for example that a meeting was deleted, or that a free-plan limit was reached) and a record of significant actions on your account (who did what, when). We use these to run, secure and improve the service. Neither contains the words of any meeting.

Server logs. Like every web service, our servers log each request: your IP address, the time, what was requested and whether it succeeded. Logs are for security and troubleshooting and are kept for a short period by our hosting provider. They are designed not to contain the words of any meeting, and our production servers refuse to start if configured to log meeting content.

3.8 The app on your computer

The desktop app keeps a few settings files on your machine (for example that you have completed onboarding), your sign-in tokens encrypted by your operating system, and, if you enabled it, your local transcripts. It contains no analytics or crash-reporting library. Apart from Nuggt, it talks only to the services this policy names: the sign-in and billing pages it opens in your browser, Notion if you connect it, and, on first run, the public download service it fetches the speech-recognition model from, which sees your IP address as any download would.

4.Cookies and tracking

Our website uses no advertising cookies and does not track you across other sites. It stores your light-or-dark theme choice in your browser, and may use privacy-respecting analytics to count visits; if we ever add anything that needs your consent, we will ask for it. We do not respond to browser "Do Not Track" signals because we do not track you in the first place. Our app sets no cookies.

5.AI processing

Reading the conversation and writing answers requires an AI model. We use OpenAI's API for this. During a meeting, the transcript so far is sent to OpenAI repeatedly, as the conversation grows, along with the question being answered and any relevant facts from your earlier meetings, and once more when the meeting ends, to write your notes and extract the facts. When Nuggt searches the web to answer a question, that search is performed through OpenAI's search tool, so the question leaves via OpenAI. Nuggt decides when to search; a setting to turn web search off is on our roadmap.

We do not train AI models on your content, and we do not permit our providers to. We use only providers whose API terms commit them not to train on what is sent through the API; OpenAI's are at developers.openai.com/api/docs/guides/your-data. OpenAI states that it keeps API inputs and outputs for up to 30 days and then deletes them. If we ever change provider, this policy changes with it.

Nuggt is an AI system; its answers, facts and notes are AI-generated and can be wrong. Nuggt makes no decisions about you that have legal or similarly significant effects.

6.How we protect it

• In transit: every connection between the app, our servers and our providers is encrypted (TLS).
• At rest, twice. Our database provider encrypts its disks. On top of that, every word of meeting content we store (facts, quotes, answers, notes, summaries, meeting titles) is encrypted by our application before it is written, using AES-256-GCM, with the key kept separate from the database. Each value is tied to the organisation and record it belongs to, so it cannot be moved elsewhere and read.
• Colleagues cannot open your meetings. Every meeting, note and answer is scoped to the person who held it. Sharing an organisation with someone does not give them a way to read your meetings, and there is no administrator override in the app. An organisation that bought Nuggt for its members can ask us to export or delete a member's content.
• Our staff do not read meeting content. The only exceptions are deleting it at your request, investigating a security incident, or a legal requirement.
• Meeting content is designed to stay out of logs and email. Our production servers refuse to start if configured to log meeting content, and our automated emails never include it.

If a data breach is likely to cause you serious harm, we tell you and the relevant regulators as the law requires. Security concerns: support@nuggt.ai.

SOC 2 is on our roadmap; we have not yet completed an audit, and our trust page will say when we have.

7.Who else handles your data

Anything that reaches Nuggt may be handled by the providers we use to run it, only as needed to run it, under their standard data-processing terms. Today they are:

• OpenAI, our AI provider: the live transcript, your questions, stored facts, web-search queries and excerpts of connected documents (section 5).
• Notion, only if you connect it: your search queries and your Notion authorisation (section 3.4).
• Providers for sign-in, payments, hosting, the database, email delivery and website hosting, which see the data needed for that job (for example your email address for sign-in and email, or your payment details, which you enter directly with the payments provider).
• Internal tools we use to operate the service (for example our support mailbox), which see what you send us and internal identifiers, never meeting content.

All are US companies. We can tell you who they are on request. If we add a provider that will handle meeting content, we will email account holders before it starts. We do not sell personal information, and we do not share it with anyone for advertising. We may disclose it if the law requires (and we will tell you about a legal request for your data unless the law forbids it or telling you would endanger someone or obstruct an investigation), to protect Nuggt or its users, or as part of a sale or restructure of the business, in which case we will tell you before your data is transferred.

8.Where it is stored, and transfers

Nuggt Pty Ltd is an Australian company. Our servers and our providers are in the United States, so your information is stored and processed there, wherever you are.

• If you are in Australia, this is a disclosure of personal information overseas. Our providers handle it under contracts that require them to protect it, and we remain responsible to you for how they do.
• If you are in the European Economic Area or the United Kingdom, we rely on our providers' published data-processing terms, which include the European Commission's Standard Contractual Clauses (with the UK addendum), and on the EU-US Data Privacy Framework (and its UK extension) where a provider is certified. A copy of the safeguards is available on request.

9.How long we keep it

10.Your choices and rights

Delete a meeting. In the app, delete it from your history. Its notes, answers and every fact Nuggt remembered from it are removed at once. Answers written in later meetings stay with those meetings, including any that drew on a fact from the deleted one.

Delete your account. In the app, open Settings and choose Delete account (you will be asked to sign in again to confirm), or email support@nuggt.ai from your account address. We cancel any subscription, delete everything we hold about you except the records section 9 says we keep, remove you from our sign-in provider, and send you a confirmation. We complete this usually within 72 hours, and always within 30 days. If you are the only owner of a shared organisation we will ask you to transfer it first. Database backups expire within our provider's fixed retention window, and OpenAI says it deletes its copies within 30 days.

See or correct what we hold. Your meeting content is visible in the app, and we can export it for you on request. For a copy of your account details, or to correct them, email support@nuggt.ai. We will respond within 30 days.

Stop non-essential email. Use the unsubscribe link in any such email.

Disconnect Notion in the app at any time.

If you are in Australia

We follow the Australian Privacy Principles. You can ask us for access to or correction of your personal information using the routes above. If you think we have breached the Australian Privacy Principles, email support@nuggt.ai and we will investigate and reply in writing within 30 days.

If you are in the EEA or the UK

Legal basis. For your account, billing and usage data we rely on our contract with you, on legal obligations (billing records), and on our legitimate interests in running, securing and improving the service and telling existing customers about it. For meeting content, including what other participants say, the legal basis is yours or your organisation's as controller; we process it only on your instructions.

Your rights. You can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time. Use the routes above; we respond within one month. You can also complain to your national data protection authority; in the UK that is the Information Commissioner's Office (ico.org.uk).

If you are in the United States

We do not sell your personal information and do not share it for cross-context behavioural advertising. You can access, correct and delete your information using the routes above, and we will not treat you differently for doing so. If your state's privacy law gives you further rights, email support@nuggt.ai and we will honour them.

11.Age

Nuggt is for people aged 18 or over, using it for work. We do not knowingly collect personal information from anyone under 18; if you believe we have, email support@nuggt.ai and we will delete it.

12.Changes to this policy

When we change this policy we will update the date at the top. If a change materially affects how we handle your data, for example a new AI provider or a new category of data, we will email account holders before it takes effect. Our trust page describes the current state of the product in plain terms; this policy is the document that binds us, and if the two ever disagree, tell us and we will correct the trust page.

13.Contact

Nuggt Pty Ltd · 7 Pine St, Randwick NSW 2031, Australia · support@nuggt.ai