Privacy Policy

NODUS is a business CRM and sales operating system. Organizations use it to manage companies, contacts, leads, deals, trade fairs, meetings, tasks and the business correspondence around them. This Privacy Policy explains what information NODUS processes, why, where it is kept, who can see it and what choices you have.

We have tried to describe what the software actually does, in plain language.

NODUS is provided by Teora AI. In this policy "NODUS", "we" and "us" refer to NODUS / Teora AI.

You can reach us at info@teoraai.com about anything in this policy.

Today NODUS is used internally by the sales and operations teams of the trade-fair organizers Expoga and GEN Fuarcılık.

This policy covers the NODUS web application at noduscrm.com (including its installable web app), its public pages, and the integrations a user connects to it, such as a Google Workspace or Microsoft 365 account.

It does not cover services of other companies that you reach through NODUS (for example Google Calendar or Gmail themselves). Their own privacy policies apply to them.

NODUS is a business product. It is offered to organizations and to the people those organizations authorize (employees and similar users). It is not offered to consumers for personal use.

Most information in NODUS — the CRM records, the correspondence and the meetings — is processed for the organization that uses NODUS (the "customer organization"). For that information the customer organization decides what is recorded and why, and NODUS acts on its behalf and on its instructions (under the GDPR, as a processor; under Türkiye's KVKK, as a data processor / veri işleyen).

For a narrower set of information NODUS decides the purposes itself: operating and securing user accounts, preventing abuse, keeping the service running and improving it, and meeting legal obligations. For that information NODUS is the controller (veri sorumlusu).

Where NODUS is operated by the same company that uses it internally, both roles sit with that company. The exact allocation of roles for a given organization is set by the agreement between that organization and the operator.

• Account information — your name, work e-mail address, the role and permissions your organization gives you, your language and appearance choices. When you sign in with Google, NODUS receives your Google account identifier, name, e-mail address and basic profile information through Google Sign-In.
• Information users enter — the CRM records and content described in section 6.
• Connected-account data — data from a Google or Microsoft account that a user connects, described in sections 7 and 8.
• Activity and audit records — which user created, changed, opened or deleted what and when (for example a record change, a mailbox connection or disconnection, or an authorized person opening another user's mail). These records exist for accountability and security.
• Technical information — the cookies described in section 12, and the request information (such as IP address, browser type and time) that our hosting providers process to deliver and protect the service.
• Notifications — if you enable browser notifications, the push subscription of your device.
• Feedback — what you send through the in-app Feedback channel, including any attachments you add.

Users record business information in NODUS: companies (accounts), contacts and their business roles, leads, deals, trade fairs and editions, visitors, meetings and calls, tasks, notes, files, internal chat messages and imported data (for example from a previous CRM).

Some of this is personal data about people outside the customer organization — for example a contact's name, business e-mail address, phone number and job title. The customer organization is responsible for having a lawful basis to record it; NODUS processes it on the organization's behalf.

Who can see a record is decided by the organization's permission settings in NODUS (roles, record ownership, private records and hidden fields). These rules are enforced in the database, not only in the user interface.

This section describes the data NODUS receives from Google APIs when a user connects a Google account (for example a Google Workspace mailbox). Signing in to NODUS with Google is separate: it only gives NODUS your basic identity (section 5). A mailbox is connected only when a user — or, for a shared mailbox, an authorized administrator — chooses to connect it and grants consent on Google's own consent screen.

Access. Depending on the permissions granted, NODUS can access:

• Gmail messages (gmail.readonly) — to read the messages of the connected mailbox: message headers (sender, recipients, subject, date, message identifiers) and, when needed as described below, the message text.
• Sending e-mail (gmail.send) — to send an e-mail from the connected mailbox when the user explicitly sends one from NODUS.
• Calendar events (calendar.events) — to create, update and cancel calendar events for meetings the user schedules in NODUS, and to read the user's own calendar events when the user asks NODUS about their schedule.
• Google Meet — when the user chooses to add an online meeting to a meeting they schedule in NODUS, NODUS asks Google Calendar to attach a Google Meet link to that calendar event (Calendar conference data, under the calendar.events permission). NODUS does not read Google Meet data such as recordings, transcripts or participant activity.
• Basic account information (openid, email, profile) — to identify which Google account was connected.

Use. NODUS uses Google user data only to provide the features the user sees in NODUS:

• showing the correspondence with a company, contact, lead or deal on that record (CRM correspondence history);
• mail intake: recognizing new inbound business requests from unknown senders and offering them as leads, or placing unclear messages in a review list for a person to decide;
• opening a message in NODUS so the user can read it there;
• sending a reply or an e-mail the user has written or approved;
• creating, updating or cancelling the calendar event of a NODUS meeting, sending the calendar invitation through Google if the user chooses to, and attaching a Google Meet link if the user asks for an online meeting;
• answering the user's own questions about their calendar (for example "what is on my agenda tomorrow?") in NODUS;
• showing whether a connected mailbox is healthy or needs to be reconnected.

Nothing is sent without the user. NODUS does not send e-mail, calendar invitations or calendar updates on its own. Each one is started by the user in the NODUS interface — by writing and sending a reply, or by reviewing and confirming a prepared e-mail or calendar change. Calendar invitations are delivered by Google's own invitation mechanism.

Storage. What NODUS keeps from Google, and what it does not:

• Message metadata is stored: sender and recipient addresses and names, subject, date, Gmail message and thread identifiers, the internet Message-ID, the number of attachments, a small set of technical headers used to recognize automated mail (such as List-Unsubscribe or Auto-Submitted), and NODUS's own processing result (for example "linked to a contact" or "sent to review"). Messages exchanged only between the organization's own addresses are not recorded.
• Message text is not stored in normal operation. When a user opens a message in NODUS, its text is fetched from Gmail at that moment, shown to the user and not saved. When a new inbound message from an unknown sender cannot be classified from its sender and subject, NODUS reads the opening of its plain text once, applies fixed rules (no AI) to decide whether it is a business request, and discards the text.
• Attachments are not downloaded. NODUS shows an attachment's name, size and type when a message is opened; the content stays in Gmail.
• Exception — preservation when a mailbox is offboarded. When an employee leaves, an administrator with the mail configuration right can preserve the plain text of the messages of that mailbox that are linked to CRM records, so that the business history survives the deletion of the mailbox. Only in this case is message text stored in NODUS.
• Initial history. When a mailbox is connected, NODUS reads the metadata of recent messages (by default the last 90 days). Messages from before the connection are only linked to existing CRM records; they do not create leads.
• Calendar: for a NODUS meeting, NODUS stores the Google event identifier, the organizer mailbox, the Meet link if one was created and the synchronization status. When the user asks NODUS about their calendar, the events shown in the answer (title, time and attendees) are kept with that request, visible to that user.
• OAuth tokens: NODUS stores the refresh token of a connected account encrypted (AES-256-GCM, with a key held by the application, not in the database). It is readable only by the server and never sent to a browser. Short-lived access tokens are obtained when needed and are not stored.

Who can see it inside NODUS. A mailbox's messages are visible to its owner. Messages of a shared mailbox are visible to the people the organization adds to that mailbox. Being able to see a CRM record does not by itself give access to the mail linked to it. The customer organization can give specific people a mail oversight right (by default the organization's administrators) to open other users' business mail; every such opening is recorded in an audit log.

Sharing and transfer. Google user data is shared only as needed to provide the features above:

• with our infrastructure providers that host and store NODUS (section 13);
• with Google itself, when NODUS sends an e-mail or creates a calendar event for you;
• with our AI provider only in the limited cases described in section 11 — Gmail message content is never sent to an AI provider.

We do not sell Google user data. We do not use it, or transfer it, for advertising — including retargeting, personalized or interest-based advertising — and we do not transfer it to advertising platforms, data brokers or information resellers. We do not use it to determine creditworthiness or for lending. We do not use it to build marketing profiles.

No AI training. NODUS does not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models, and does not transfer it to anyone for that purpose.

Human access. NODUS personnel do not read Google user data, except (a) with the explicit consent of the user for specific data (for example to resolve a support request), (b) when necessary for security purposes such as investigating abuse or a bug, (c) to comply with applicable law, or (d) in aggregated and anonymized form for internal operations. This concerns NODUS personnel; access by people within the customer organization is governed by its permission settings described above.

Limited Use disclosure. NODUS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Your control. You can disconnect a mailbox in NODUS at any time (section 18). You can also remove NODUS's access from your Google Account at myaccount.google.com/connections (Security → Third-party apps & services).

NODUS includes a Microsoft 365 connector (Microsoft Graph) for Outlook mail and calendar, built on the same rules as the Google connector. When an organization enables it and a user connects a Microsoft 365 mailbox, NODUS processes the same categories of data in the same way as described for Google in section 7: message metadata is stored, message text is fetched only when needed and not stored (except the offboarding preservation), e-mail and calendar actions happen only when the user starts them, refresh tokens are stored encrypted, and Microsoft data is not used for advertising or to train AI models.

A user can remove NODUS's access from their Microsoft account (for work accounts, at myapps.microsoft.com or through their administrator).

• to provide NODUS to the customer organization and its users, as configured by the organization;
• to sign users in, keep sessions secure and apply the organization's permissions;
• to deliver notifications the user has turned on;
• to keep audit records, detect and prevent misuse, and investigate security incidents;
• to answer support requests and feedback;
• to maintain and improve NODUS, using information about how the service works (for example error and performance information), not the content of Google or Microsoft user data;
• to comply with legal obligations.

We do not sell personal information and we do not use the information in NODUS for advertising.

NODUS links correspondence, meetings and activities to the companies, contacts, leads and deals they concern, so that an organization keeps one history of each business relationship. For example, a meeting is shown on the timeline of each participant's company as of the date of the meeting.

NODUS can also enrich company records with publicly available information, such as a company's own website or public news about trade fairs and companies the organization follows. This uses public sources, not Google or Microsoft user data.

Leads may be created from inbound business e-mail as described in section 7. NODUS does not create deals automatically from e-mail.

Some NODUS features use an AI model. Today the AI provider is Anthropic (Claude models), used through its commercial API. These features are:

• @Nodus assistant in chat — when a user addresses @Nodus, it may send the request, recent messages of that conversation, and names of colleagues and of CRM records the user can see, to understand the request (including a request to schedule, change or cancel a meeting, which then also covers its title, time and the names of the people to invite), to summarize a conversation or to draft an e-mail the user asked for. To change a pending calendar action in words, it may also send that action as shown to the user (title, time and attendee names).
• Company and trade-fair research — classifying companies and summarizing public information from public websites and news.
• Drafting help in some administration tools (for example report definitions and import mappings).

What is not sent to AI: Gmail and Outlook message content (subject and text) is not sent to an AI provider. The mail intake classification uses fixed rules, not AI. When @Nodus answers a question about the user's calendar, the events are read and listed by NODUS's own code.

AI output can be wrong. NODUS shows AI output as a suggestion or a draft; anything that leaves NODUS (an e-mail, a calendar invitation or update) is sent only after the user reviews and confirms it.

NODUS does not use Google user data to train AI models. NODUS uses AI providers under commercial terms; we choose providers whose terms do not allow them to train their models on the data NODUS sends.

NODUS uses only cookies needed for the service to work. It does not use advertising or third-party analytics cookies.

• Session cookies of our authentication provider (Supabase Auth), which keep you signed in;
• nodus-remember — whether you chose to stay signed in on this device;
• nodus-locale — your language;
• nodus-appearance — your appearance choices, so the first screen is drawn correctly.

If you enable browser notifications, your browser's push service delivers them. The notification content is encrypted for your device; the push service (for example Google, Apple or Mozilla) cannot read its title or text.

NODUS relies on the following providers to run the service. They process information only to provide their service to NODUS.

• Vercel — application hosting and delivery; the application runs in Vercel's Frankfurt (EU) region.
• Supabase — database, authentication and file storage; the NODUS database is hosted in Supabase's eu-central-2 region (Zurich, Switzerland).
• Anthropic — AI model provider for the features in section 11.
• Google — Google Sign-In, and Gmail, Google Calendar and Google Meet for users who connect a Google account.
• Microsoft — Microsoft 365 (Outlook mail and calendar) for users who connect a Microsoft account, when enabled.
• Browser push services (Google, Apple, Mozilla) — delivery of encrypted notifications, if enabled.
• GitHub — receives a developer report when an administrator chooses to forward a feedback item for development.

We will update this list when providers change.

Besides the providers above, we share information only:

• within the customer organization, according to its permission settings in NODUS;
• with a third party the user deliberately addresses — for example the recipient of an e-mail or the invitee of a meeting;
• when required by law or by a valid request from a public authority, or to protect the rights, security and safety of users and others;
• in a merger, acquisition or sale of assets, with notice and, for Google user data, only with the user's explicit prior consent.

NODUS keeps business records for as long as the customer organization keeps them in NODUS, because the purpose of a CRM is a lasting business memory. NODUS does not currently delete CRM records or stored mail metadata automatically after a fixed period.

• Disconnecting a mailbox deletes its stored OAuth token immediately, so NODUS can no longer access the mailbox. The metadata already recorded stays as part of the organization's correspondence history.
• Message text is not stored in normal operation; preserved offboarding text is kept with the CRM records it belongs to.
• User accounts of people who leave are deactivated, not erased, so that the organization's history keeps its authors and audit trail.
• Audit records are kept for accountability and security.

An organization can ask us to delete its data or specific data (section 19). Retention periods required by law, or set in the agreement with an organization, take precedence.

We use measures appropriate to a business application, including:

• encrypted connections (HTTPS/TLS) between your browser and NODUS and between NODUS and its providers;
• OAuth refresh tokens encrypted with AES-256-GCM using a key held by the application, readable only on the server;
• access rules (row-level security) enforced in the database for every record, field and mailbox, with hidden fields kept out of reach of users who may not see them;
• separate environments for development, testing and production;
• audit records of security-relevant actions, such as opening another user's mail.

No system is perfectly secure. NODUS does not currently hold an external security certification (such as SOC 2 or ISO 27001). If we learn of a security incident affecting personal data, we will notify the affected organization and, where required, the competent authority.

• Users can see and change their own language and appearance settings, and see their connected mailboxes on the Mail page.
• Organization administrators control roles, permissions, hidden fields, shared mailboxes, mail oversight rights and the deactivation of users.
• Users and administrators can correct or delete CRM records within their permissions.

Connect or reconnect: on the Mail page in NODUS, choose to connect your Google (or Microsoft) account and grant the permissions on the provider's consent screen. If a mailbox needs to be reconnected, for example after a permission was removed, NODUS shows this on the Mail page and on the home screen.

Disconnect: on the Mail page, the mailbox owner (or an administrator with the mail configuration right) can disconnect a mailbox. NODUS then deletes the stored token and stops synchronizing that mailbox.

Revoke at Google: you can also remove NODUS's access at any time in your Google Account at myaccount.google.com/connections. Disconnecting inside NODUS does not by itself remove the grant in your Google Account; revoking it there ensures Google will not issue new tokens to NODUS.

NODUS does not currently offer a self-service "delete my data" button. To request deletion:

• If you use NODUS through your organization, ask your NODUS administrator, write to us at info@teoraai.com, or send the request through the in-app Feedback channel. Your organization can delete CRM records and deactivate accounts, and can ask us to delete data that it cannot remove itself — for example the correspondence metadata of a disconnected mailbox.
• If you are a contact of an organization that uses NODUS (for example a customer or business partner of that organization), please contact that organization: it decides what it records about you, and we will support it in answering your request.
• Google user data specifically: disconnect the mailbox in NODUS and revoke access in your Google Account; then request deletion of the stored metadata at info@teoraai.com.

We will confirm when a deletion has been carried out, unless the law requires us to keep the information.

The NODUS database is hosted in Switzerland and the application runs in the European Union. Some of our providers (for example Vercel, Supabase, Anthropic, Google and Microsoft) are companies based in the United States or have global operations, so personal data may be accessed from or processed in other countries, including the United States.

Where personal data from the EU, the EEA or Türkiye is transferred to a country without an adequacy decision, we rely on the transfer mechanisms that the applicable law recognizes, such as standard contractual clauses offered by our providers, and — for transfers from Türkiye — the mechanisms set out in Article 9 of the KVKK.

Where the GDPR or the KVKK applies and NODUS is the controller, we rely on:

• performance of a contract — to provide NODUS to the organization and its users;
• legitimate interests — to secure the service, prevent misuse, keep audit records and improve NODUS;
• legal obligations — to comply with the law;
• consent — where we ask for it, for example when you connect a Google or Microsoft account or enable notifications. You can withdraw consent at any time, as described in section 18.

Where NODUS processes data on behalf of a customer organization, that organization determines the legal basis.

Depending on the law that applies to you, you may have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw consent, and to lodge a complaint with a supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK); in the EU, the data protection authority of your country. Under Article 11 of the KVKK you may also ask whether your data is processed and to whom it has been transferred.

Where we act for a customer organization, we will forward your request to that organization and help it respond. To exercise a right where NODUS is the controller, use the contact route in section 25.

NODUS is a business service for adults acting for their organization. It is not directed at children, and we do not knowingly collect personal data from children.

We will update this policy when NODUS changes the way it handles information. The date at the top shows the latest version. For material changes — in particular any change to how Google user data is used — we will inform users in NODUS before the change takes effect and, where required, ask for consent again.

For questions or requests about privacy, including requests about Google user data, write to info@teoraai.com.

Users of NODUS can also raise privacy questions through the in-app Feedback channel or with their NODUS administrator. People whose data an organization keeps in NODUS can also contact that organization.