Privacy Policy for NuDay AI
Version 2026-08-05 · Effective Date: March 8, 2026 · Last Updated: August 5, 2026
Welcome to NuDay AI (accessible at https://nuday.ai). We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and disclose information in two settings:
- Part I — the nuday.ai website: our corporate site, which anyone can visit.
- Part II — the NuDay AI platform: the product you sign in to.
The two collect different data for different reasons, so they are described separately. If you only visit the website, Part I applies to you.
Part I — The nuday.ai website
1. No Third-Party Advertising
NuDay AI is a corporate website. We do not host, display, or place third-party advertisements on our website. We do not sell your personal data to third parties for their marketing purposes.
2. Information We Collect
While we do not run ads, we do collect certain information automatically to understand how visitors interact with our site and to improve our services.
A. Analytics and Tracking Technologies
We use the following third-party services to track website usage:
- Google Analytics: We use Google Analytics to collect information about how visitors use our site (e.g., pages visited, time spent on site, browser type, and approximate geographic location). This data is aggregated and used to improve website performance.
- LinkedIn Insight Tags: We use the LinkedIn Insight Tag to track conversions, retarget website visitors, and unlock additional insights about members interacting with our LinkedIn content. This helps us measure the effectiveness of our professional outreach.
B. Cookies
We use "cookies" (small text files) to enable the tracking mentioned above. You can choose to decline cookies through your browser settings or via the cookie consent banner presented upon your first visit.
3. Legal Basis for Processing (EU & Global)
If you are visiting from the European Economic Area (EEA), UK, or Middle East (e.g., Saudi Arabia, UAE), our legal basis for collecting and using the information described above depends on the context:
- Consent: We ask for your explicit consent to use Google Analytics and LinkedIn Insight Tags via our cookie banner.
- Legitimate Interests: We process technical data to maintain the security and functionality of our website.
4. Data Sharing and Disclosure
We do not sell your data. We only share information with the following service providers to facilitate our website operations:
- Google LLC (for Analytics)
- LinkedIn Corporation (for Insight Tags)
- Cloud Hosting Providers (to host the website)
We may also disclose information if required by law, such as to comply with a subpoena or similar legal process.
5. Regional Disclosures & Rights
A. United States (CCPA/CPRA — California & Other States)
- Right to Know/Access: You may request a list of the personal information we have collected.
- Right to Delete: You may request that we delete your personal information.
- Right to Opt-Out: While we do not "sell" data in the traditional sense, the use of tracking tags may be considered "sharing" for cross-contextual behavioral advertising under California law. You can opt-out via our cookie settings.
B. European Union & UK (GDPR)
- You have the right to access, rectify, or erase your personal data.
- You have the right to object to processing and the right to data portability.
- You may withdraw your consent for tracking at any time.
C. Middle East (Saudi PDPL / UAE Data Protection Law)
- In accordance with the Saudi Personal Data Protection Law (PDPL), we ensure that your data is processed only for the purposes specified at the time of collection.
- Data may be transferred outside the region to our service providers (Google/LinkedIn) under standard contractual clauses ensuring an equivalent level of protection.
6. International Data Transfers
NuDay AI is a global entity. Information collected via Google and LinkedIn may be stored and processed in the United States or any other country where these providers maintain facilities. By using our site, you acknowledge that your information may be transferred to countries outside of your country of residence.
7. Data Retention
We retain analytics data only as long as necessary to fulfill the purposes outlined in this policy. Google Analytics and LinkedIn data are typically subject to their respective retention policies (often ranging from 14 to 26 months).
8. Security
We implement industry-standard security measures, including SSL encryption, to protect the data transmitted to and from our website.
Part II — The NuDay AI platform
This part covers the product you sign in to, rather than the website. Where Part I and Part II differ, Part II governs your use of the platform.
9. Who controls your data
NuDay AI is a business-to-business platform used by organisations. For most of what happens here, your organisation decides what is collected and why, and NuDay processes it on their instructions. But that is not true of everything, and the difference matters to you:
| Data | Controlled by | Why |
|---|---|---|
| Workspace files, chat conversations, agents, knowledge collections | Your organisation | Created inside your organisation's workspace and owned by it |
| Connected accounts (Google, Microsoft) | You | You authorise these against your own account; nobody else in your organisation can use them |
| Your sign-in identity (email, password, two-factor credentials) | You | Belongs to you, not to your organisation |
Content you create inside a workspace belongs to the organisation that owns it and remains after your account is deleted. To have that content removed, ask your organisation's administrator — see section 15.
10. What the platform collects, and why
A. Your account
- Email address — to identify you at sign-in and send you service email.
- Display name and avatar — to attribute your activity in the product.
- Password — stored only as a cryptographic hash. We never store your actual password and cannot recover it.
- Two-factor credentials (authenticator secret, passkeys) — to protect your account.
B. Security and audit records
- Sign-in history — time and outcome. Retained 180 days.
- Action history — what was changed and by whom. Retained 90 days.
- Deployed-application access records — retained 180 days.
C. Content you create
Workspace files, chat conversations, agents, evaluations and knowledge collections. Two things about this are easy to assume wrongly, so we state them plainly:
- Your conversations are sent to third-party AI model providers to generate responses. Which provider depends on how your organisation has configured the platform. This is inherent to how the product works.
- This content belongs to your organisation and survives your account being deleted (section 9).
11. Connecting a Google account
Connecting Google is optional and per-user. The platform works without it. If you do connect, you choose which of these to grant, and each means:
| Permission | What it allows |
|---|---|
| Google Drive | Read, create, modify and delete files across your entire Google Drive |
| Gmail | Read, compose, send, and organise or delete mail in your mailbox |
| Google Contacts | Read and manage your contacts |
| Calendar, Sheets, Docs, Tasks | Read and write your calendars, spreadsheets, documents and tasks |
What happens to that access:
- Agents can act on your Google account on your behalf. When you run an agent that your organisation has configured, it uses your connection to read or write your Google data. You are granting the platform's agents — not only yourself — the ability to act on your account.
- Your Google credentials are encrypted at rest, resolved on our servers at the moment of use, and are never sent to your browser and never returned by our API.
- Your connection is never shared with other members of your organisation. Another member running the same agent uses their own connection, or none.
- You can disconnect at any time from the Connectors page, which revokes the stored credentials.
Limited use
NuDay AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use your Google data only to provide features you have asked for.
- We do not use it to train or improve generalised AI models.
- We do not sell it, and we do not use it for advertising.
- We do not allow humans to read it, except with your explicit permission, for security purposes, to comply with law, or where the data is aggregated and anonymised.
12. What we do not do
- We do not use your Google data to train AI models.
- We do not sell personal data or share it for advertising.
- We do not run advertising in the platform.
- We do not share your connected accounts between members of an organisation.
13. Who we share platform data with
- AI model providers — to generate responses (section 10C).
- Cloud infrastructure providers — to host the platform.
- Email delivery providers — to send service email such as password resets and security alerts.
- Your organisation — administrators can see the content and activity within their own workspace.
We may also disclose data where required by law.
14. How long we keep platform data
The security and audit records in section 10B are deleted automatically on the schedules stated there (90 or 180 days). Chat attachments are removed after 30 days. Everything else is kept for as long as your account and your organisation's subscription remain active, and is removed when they end.
15. Your rights in the platform
Where they apply to you, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. How to exercise each here:
- Delete your account — from your profile, at any time. It requires your password. This removes your user record and your connected accounts. It deliberately does not remove content you created inside a workspace, which belongs to your organisation (section 9).
- Disconnect a Google or Microsoft account — from the Connectors page, at any time.
- Workspace content — contact your organisation's administrator, who controls it.
- Access, correction or a copy of your data — contact us at the address in section 18. There is no self-service download of all your data.
You also have the right to complain to your local data protection authority.
16. Platform security
Data is encrypted in transit and at rest. Connected-account credentials are additionally encrypted with per-organisation keys. Access is controlled by role, and administrative actions are logged. The platform is assessed annually against the OWASP Application Security Verification Standard.
17. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page will reflect the most recent changes.
When Part II changes materially we will update the version at the top and ask you to acknowledge it the next time you sign in to the platform.
18. Contact Us
If you have questions about this Privacy Policy or your data rights, please contact us at:
- NuDay AI
- Website: https://nuday.ai
- Email: info@nuday.ai
- Privacy enquiries, or to exercise a right that is not self-service: privacy@nuday.ai