Privacy Policy
This policy describes how Nebula Nova Inc. ("we") handles information submitted through libraos.com and information processed by LibraOS Cloud, our hosted service at desk.libraos.com and its workspace subdomains. It does not govern a customer's self-hosted LibraOS deployment, where that customer controls its own data and policies.
Information we collect
When you join the Cloud private-beta list or request a demo, we collect the details you submit, such as email, name, company, business function, and deployment preference. Our server also records the request time and IP address for security and abuse prevention.
When you use LibraOS Cloud, we process your account details (name, email address, workspace), the content you and your team add to the workspace, and the data of any account you choose to connect, as described below.
We use Google Analytics to understand aggregate site usage on libraos.com, and the Libra Desk help widget may process information you choose to send through it. These services may receive technical data such as IP address, browser, device, and referring page.
Google user data
LibraOS Cloud lets a workspace member connect a Gmail account and pick files from Google Drive. Connecting is optional, is done by the account owner through Google's consent screen, and can be undone at any time.
What we access. With your permission we read the email address of the connected Google account and the messages in its mailbox (headers, bodies and attachments), and we send email from it on your instruction. LibraOS sends a message from your Gmail account only when you click Send on a reply you wrote or reviewed in LibraOS; it goes to the people in that conversation. LibraOS never sends email on its own, and it does not delete, move, label or otherwise change anything in a connected Gmail account. For Google Drive, we access only the individual files you choose in Google's file picker, not the rest of your Drive.
How we use it. We use this data only to provide and improve the user-facing features you turn on in your workspace:
- sorting your recent mail into Sales, Customer Service and Other, and summarising conversations, so you see what needs a reply;
- keeping a list of the people you correspond with — each sender's name and email address — as contacts in your workspace, so a conversation is tied to the person;
- when you turn it on, recording email activity against contacts in your workspace's CRM — the subject and a one-line summary, never the message body;
- suggesting a reply for you to review and edit, and sending it from your Gmail account when you click Send;
- attaching a Google Drive file you picked to the record you are working on, such as a contact, deal or legal matter, or to a question you ask the workspace assistant.
Sharing. To generate summaries, classifications, suggested replies and assistant answers, relevant content is sent through a zero-data-retention model gateway operated by our affiliate, to either Google's Gemini models on Vertex AI or open-weight models running on our affiliate's own servers. The gateway and the model process it transiently to return a result to us: they do not store it, it is redacted from their operational logs, and it is never used to train models. Otherwise we do not transfer Google user data to anyone except as needed to provide or improve these features, to comply with applicable law, for security purposes, or as part of a merger or acquisition with notice to you.
What we never do. We do not sell Google user data. We do not use it for advertising, including retargeting or personalised or interest-based ads. We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models, and we do not transfer it to any AI or machine-learning service that would use it to train or improve its models. We do not use it to determine credit-worthiness or for lending. Our staff do not read it unless you give us permission for specific messages (for example, in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law. These commitments apply equally to raw Google user data and to any aggregated, anonymised or derived data, such as the summaries, classifications and contacts we create from it.
Limited Use. The use of raw or derived user data received from Google Workspace APIs, including the Gmail and Google Drive APIs, and its transfer to any other app, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This includes the AI features described above: the data is used only to provide the features you turn on, and never to develop, improve or train generalised AI or machine-learning models.
Protection. Data is encrypted in transit. OAuth tokens are encrypted at rest. Each workspace runs in its own isolated environment with its own database, so its data is kept separate from every other workspace. Disconnecting a Google account in LibraOS deletes the stored OAuth tokens immediately.
Retention and deletion. A copy of the messages we read (sender and recipient addresses, subject, plain-text body, date, message identifiers, and whether it carries bulk-mail headers) is kept in your workspace so these features work. That copy, the classifications, summaries, contacts and CRM activity entries derived from your mail, and Drive files you attach stay in your workspace until you delete them or close the workspace. You can disconnect a Google account in your workspace settings, and revoke access at any time at myaccount.google.com/permissions. To have data obtained from your Google account deleted, email contact@meganova.ai; we delete it within 30 days, except where the law requires us to keep it.
Microsoft user data
LibraOS Cloud lets a workspace member connect a Microsoft account — a work or school account, or a personal Outlook.com account — so their mail can be sorted in the workspace. Connecting is optional, is done by the account owner through Microsoft's consent screen, and can be undone at any time.
What we access. With your permission we read the sign-in address of the connected Microsoft account, the email addresses its mailbox sends from, and the messages in its mailbox (headers and bodies). Through this connection we do not download attachments, and we do not access your calendar, contacts, OneDrive or any other Microsoft service. Access is read-only: LibraOS does not send, delete, move, flag, mark as read or otherwise change anything in a connected mailbox. For messages in your Junk Email, Deleted Items and Drafts folders we see only their date and folder, so they can be skipped; their content is not read.
How we use it. We use this data only to provide and improve the user-facing features you turn on in your workspace:
- sorting your recent mail into Sales, Customer Service and Other, and summarising conversations, so you see what needs a reply;
- telling the mail you sent apart from the mail you received, using the addresses your mailbox sends from;
- keeping a list of the people you correspond with — each sender's name and email address — as contacts in your workspace, so a conversation is tied to the person;
- when you turn it on, recording email activity against contacts in your workspace's CRM — the subject and a one-line summary, never the message body;
- suggesting a reply for you to review and edit. You send it yourself, from your own mail client.
Sharing. Microsoft user data is shared exactly as described for Google user data above: relevant content passes through the same zero-data-retention model gateway, to the same models, which do not store it or train on it. We do not otherwise transfer it except as needed to provide or improve these features, to comply with applicable law, for security purposes, or as part of a merger or acquisition with notice to you.
What we never do. We do not sell Microsoft user data. We do not use it for advertising. We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models. Our staff do not read it unless you give us permission for specific messages (for example, in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.
Protection. Data is encrypted in transit. OAuth tokens are encrypted at rest. Each workspace's data is kept separate from every other workspace.
Retention and deletion. A copy of the messages we read (sender and recipient addresses, subject, plain-text body, date, message identifiers, and whether it carries bulk-mail headers) is kept in your workspace so these features work. That copy, and the classifications, summaries, contacts and CRM activity entries derived from your mail, stay in your workspace until you delete them or close the workspace. You can disconnect a Microsoft account in your workspace settings, and revoke access at any time — for a personal account at account.live.com/consent/Manage, for a work or school account in your organisation's My Apps portal at myapplications.microsoft.com. To have data obtained from your Microsoft account deleted, email contact@meganova.ai; we delete it within 30 days, except where the law requires us to keep it.
How we use information
We use information to provide and secure LibraOS Cloud, respond to requests, manage beta invitations, provide support, protect the site from abuse, and improve the product and website. We do not sell personal information.
Retention and sharing
We retain inquiry records while needed to manage the relationship, meet legal obligations, and protect the service. We share information only with service providers acting for us, when required by law, or as part of a corporate transaction subject to appropriate safeguards. Google and Microsoft user data are additionally subject to their sections above.
Your choices
You may ask to access, correct, or delete your information. Analytics controls may also be available through your browser or consent settings.
Contact
Email contact@meganova.ai with privacy questions or requests. We may update this policy as the service changes and will revise the effective date above.