Privacy Policy
Nucleus is a product of HappyUFO Media (“we”). This policy explains what information we collect through Nucleus, why, and the choices you have. In short: we collect what we need to run the service, we protect it carefully, and we don't sell it.
Two kinds of information
Account information is about the people who use Nucleus: names, work email addresses, the firm's name, sign-in activity and billing details. We decide how this is used, as described here.
Customer Data is what firms bring in about their clients: vendors, transactions, W-9 forms and the like. The firm controls it; we process it only to provide the service to that firm, under our Terms of Service. Questions about a firm's handling of client information should go to the firm.
What we collect
- What you give us: your name, email, password (held by our sign-in provider, never by us) and firm name.
- Customer Data: files you upload, data read through QuickBooks Online, Zoho Books or Xero connections (we only read; see what each connection can see on the client's Connect or upload page), and W-9s uploaded by your firm or sent by vendors through a secure link.
- Security records: when and from which network address people sign in, and what they do in the account (the activity log). We use these to protect accounts and show firms who did what.
- Billing: handled by Stripe. We receive your subscription status and a customer reference, never your full card number.
Tax identification numbers
Nucleus never stores Social Security numbers or EINs as data. Tax ID columns in uploaded files are thrown away on arrival, and when a W-9 is read we record only whether a number is present. The W-9 file itself is kept, encrypted, because firms need it for their records.
How we use information
- to run the service: checking books, showing results, sending the emails you ask for;
- to keep accounts and data safe, and to investigate misuse;
- to bill subscriptions and provide support;
- to meet legal obligations.
We don't sell personal information, share it for advertising, or use Customer Data to train AI models. W-9s are read on our own servers and never sent to an outside AI service.
Who we share it with
Only the service providers needed to run Nucleus, under contracts that protect the data:
- hosting and databases (Render, Supabase), file storage (Cloudflare R2), key management (Amazon Web Services);
- email delivery (Resend) and payments (Stripe);
- Intuit or Zoho, only when your firm connects a client's account.
We may also share information if the law requires it, or to protect people's safety or our rights.
How we protect it
Data is encrypted in transit and at rest; W-9 files are encrypted with a separate key for each file before they're stored. Every person signs in with two-step verification. Each firm's data is separated at the database level, and every sensitive action is recorded in a tamper-evident activity log. No system is perfectly secure, but we work hard to keep yours safe, and we'll tell affected firms promptly about any breach that affects their data, as the law requires.
How long we keep it
- Customer Data: until the firm deletes it or closes its account, when it's deleted straight away.
- The activity log: kept as a security and audit record, including after an account closes.
- Backups: overwritten on a rolling schedule.
- Billing records: as long as tax and accounting law requires.
Your choices and rights
You can update your name, email and email preferences under My account, and owners can export or delete the firm's data at any time. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information. To use them, email privacy@trynucleus.xyz. We'll respond within the time the law requires and won't treat you differently for asking.
Cookies
We use only the cookies needed to sign you in, keep your session secure and remember a pending invitation. No advertising or tracking cookies.
Children
Nucleus is for businesses and isn't meant for anyone under 18.
Changes
We'll post any update here with a new effective date, and email account owners about important changes.
Contact
HappyUFO Media (maker of Nucleus), [Mailing address]. Privacy questions: privacy@trynucleus.xyz. Security reports: security@trynucleus.xyz.