Privacy Policy

1. Who runs this service

This installation of Nook (the “Service”) is operated by OutSprout Digital Studio, Karachi, Pakistan (“we”, “us”). We decide how the information in it is used. For any privacy question or request, contact jibran.s@out-sprout.com.

2. What we collect

Only what you and your team put into the Service, and what you choose to connect:

• Account information — your name, email address, password (stored only as a secure hash), profile photo, timezone and preferences.
• Workspace content — projects, tasks, comments, CRM companies, contacts and deals, notes, chat messages, documents, invoices, quotes, expenses and anything else you create.
• Connected email (IMAP/SMTP) — if you connect a mailbox, the messages, attachments and folders we sync from it, and the emails you send through it.
• Google Calendar — if you connect Google, the events, attendees and Google Meet links of the calendars you choose.
• Zoho Books — if an administrator connects Zoho, customers, invoices, estimates, payments, taxes and items that are synced between Zoho and the Service.
• Social media — posts, captions, images and videos you plan, approval decisions and comments, and (when publishing is connected) publishing status and performance statistics.
• Files — documents, images and other files you upload or share, with their versions and comments.
• Usage and security logs — sign-ins, an activity log of changes (who did what, when), technical logs (IP address, browser, errors) and, if you allow it, push-notification subscriptions.

3. Why we use it

We use your information only to provide the features you and your workspace turn on — for example to show your tasks, sync your mailbox, send invoices you ask us to send, publish posts you approve, prepare your daily brief, keep the Service secure and fix problems.

We do not sell your data, use it for advertising, or build advertising profiles.

4. Where it’s stored

Everything is stored on the server where this Nook installation runs, which is managed by OutSprout Digital Studio. Passwords and keys for connected services (email accounts, Zoho, Google, Postiz, AI providers) are stored encrypted, and are only decrypted by the server when it needs them to talk to that service. Backups are kept on the same server or in storage chosen by the operator, and are protected the same way.

5. Other services — only when you connect them

The Service talks to another company only when someone in your workspace connects it, and only to provide that feature:

• Google (Calendar, Meet, Drive import) — to show and manage your calendar and import files you pick.
• Zoho Books — to sync invoices, quotes, customers and payments with your accounting.
• Postiz — to schedule and publish approved social posts and read their statistics.
• AI providers such as Google Gemini, Anthropic (Claude), OpenAI or OpenRouter — to draft captions, summaries, email replies and images when you use an AI feature. Administrators choose which modules may be sent to AI; invoicing data is off by default.
• Your email provider — through the IMAP/SMTP account you connect.

Each of these services handles data under its own privacy policy. We don’t share your information with anyone else except where the law requires it.

6. Google user data

The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google Calendar data is used only to show and manage your calendar and meetings inside Nook (and Google Drive access only to import files you choose).
• It is not transferred to others, except as needed to provide or improve that feature for you, to comply with the law, or as part of a merger or sale with your data protected.
• It is not used for advertising, including retargeting or interest-based ads.
• It is not used to develop, improve or train AI or machine-learning models.
• People don’t read it unless you ask us to (for example for support), it’s needed for security purposes such as investigating abuse, it’s required by law, or it has been aggregated and anonymised for internal operations.

You can disconnect Google at any time in Settings → Calendar, and revoke access from your Google Account’s security settings.

7. How long we keep it, and deleting it

• We keep your information while your account and workspace are active, or as long as the operator needs to for legal or accounting reasons (for example invoices).
• You can disconnect any integration (email, Google, Zoho, Postiz, AI) in Settings at any time; we then stop syncing it.
• You can ask us to export or delete your account and personal data by contacting jibran.s@out-sprout.com. Deleted data leaves backups as they rotate (usually within a few weeks).
• You can update your profile at any time in Settings → Profile.

8. Security

• All connections use HTTPS.
• Passwords are hashed; credentials for connected services are encrypted at rest.
• Access inside a workspace follows roles and permissions, enforced by the database for every request.
• Changes are recorded in an activity log, and the server is backed up regularly.

No system is perfectly secure. If we learn of a breach that affects you, we’ll tell you without undue delay.

9. Your choices and requests

You can ask to see, correct, export or delete your personal data, or object to how it’s used, by contacting jibran.s@out-sprout.com. If your workspace is managed by your employer or another organisation, they control the workspace content and we may need to involve them.

10. Changes to this policy

If we change this policy, we’ll update the “Last updated” date above, and tell you in the Service or by email when the change is significant. Please also read our Terms of Service.

11. Contact

OutSprout Digital Studio · Karachi, Pakistan · jibran.s@out-sprout.com