PRIVACY
Privacy Policy
Effective and last updated: September 27, 2026
1. What this policy covers
This policy explains how NurtureARC handles account, workspace, product-usage, support, and billing information. Each customer business is responsible for its own customer, client, prospect, and partner records and determines why that information is processed.
2. Information we process
We process account details, authentication and security events, subscription status, workspace configuration, imported and entered relationship records, files, support requests, integration settings, and technical data needed to operate and protect the service. When a workspace uses Email Capture, selected email content forwarded or BCC'd to its private capture address is processed and stored with the matched relationship record. Payment card details are handled by Stripe and are not stored in NurtureARC records.
3. How information is used
Information is used to provide and secure the service, isolate workspaces, process subscriptions, respond to support, prevent abuse, diagnose failures, maintain audit records, improve the product, and meet legal obligations. We do not sell customer workspace data.
4. Integrations and service providers
NurtureARC uses infrastructure, storage, authentication, payment, email-delivery, and managed-AI providers to operate the service. Mailgun processes messages deliberately sent to a private NurtureARC Email Capture address and provides transactional email delivery. Google or Microsoft data is accessed only after a user connects or configures the applicable service. When a user asks NurtureARC AI to analyze or work with connected records, NurtureARC may send the minimum relevant Gmail, Google Calendar, and CRM context to its managed AI provider solely to deliver that user-facing feature. NurtureARC does not use Google Workspace API data to train or improve generalized AI models, does not permit cross-customer model memory, and requests provider-side storage to be disabled where the provider supports it. Our use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
5. Built-in and external AI
NurtureARC includes a workspace-scoped AI assistant whose authority can be paused or restricted by the workspace owner. The assistant may use task-relevant CRM, Gmail, and Google Calendar context to answer questions, analyze information, and prepare content. Reading, analysis, and inline drafting do not themselves send a message or change a record. Separate authority and approval controls apply before NurtureARC sends communications, schedules events, moves money, requests signatures, or changes governed records. Workspace owners may disable managed reasoning at any time. NurtureARC does not store a customer's AI-provider key. An eligible workspace may separately create an expiring, revocable, read-only connection for an external assistant. Credentials, arbitrary database queries, and record changes remain outside that external connection.
6. Retention, export, and deletion
Workspace owners can export operational data and request account or workspace deletion. Some records may be retained for security, billing, dispute, legal, or backup-integrity purposes and then deleted or anonymized according to the applicable retention period.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. You may also withdraw consent where consent is the lawful basis. Submit a privacy request through Support in Settings; identity verification may be required before a request is completed.
8. Security
We use encrypted transport, access controls, workspace isolation, audit records, credential protection, suppression controls, backups, and production monitoring appropriate to the service. No system can guarantee absolute security. Report a suspected security issue through Support as soon as possible.
9. Children
NurtureARC is a business service and is not directed to children. Account holders must not knowingly use it to collect children's information without all permissions and protections required by law.
10. Changes and contact
Material changes will be posted here with a new effective date. Account, privacy, export, or deletion requests can be submitted from the Support & feedback area in Settings.