Privacy Policy — Antrotic Nexus

1. About Antrotic Nexus

Antrotic Nexus (“Nexus”) is an internal operations platform developed and operated by Antrotic, LLC (“Antrotic”, “we”, “us”). Authorized Antrotic users use Nexus to manage people, appointment requests, scheduling, communications, permissions and online meeting workflows.

Nexus is not offered as a public consumer service and is not open for public self-registration. This Policy also covers this informational website at nexus.antrotic.com.

2. Information we collect

Depending on how Nexus is used, we may process:

• Account and identity information for authorized users, such as name, work email address, role and the access permissions Antrotic assigns.
• Operational records created in the course of Antrotic’s work, such as people records, appointment requests, schedules, communications and meeting details.
• Google information, only if a user connects a Google Account, as described in sections 3 to 5.
• Security and audit information, such as sign-in events, permission changes, Google connect and disconnect events, and error records that do not contain credentials.

This website. nexus.antrotic.com is a static informational site. It has no accounts, forms, cookies, analytics or advertising trackers. The hosting provider that serves it may process standard technical request data, such as IP address, browser type and the page requested, to deliver the site and protect it from abuse.

3. Google Account information accessed

Connecting a Google Account is optional. If an authorized user connects one, Nexus requests only the following Google permissions:

From these permissions, Nexus receives the connected account’s email address and a stable Google account identifier. Nexus does not request the Google profile name or photo, contacts, Gmail, Google Drive, Google Chat or any Google service not listed above.

4. Google Calendar data

With the calendar permissions above, Nexus may:

• read free/busy information, meaning the time ranges when the connected account is busy, to check availability and detect scheduling conflicts. Free/busy information does not include event titles, descriptions or attendees;
• create events on calendars owned by the connected account for appointments scheduled through Nexus;
• read, update or cancel appointment-related events on calendars owned by the connected account, as needed to keep them consistent with the appointment in Nexus.

Nexus may keep the references it needs to manage events it creates, such as a calendar event identifier, together with the related appointment record. Nexus does not use calendar access for purposes unrelated to its appointment and scheduling features.

5. Google Meet data

With the Meet permission above, Nexus may create Google Meet meeting spaces and may access and manage only the meeting spaces it created. This can include the meeting link and meeting code, supported meeting settings, and basic information about those spaces.

Nexus may store the meeting link and space identifier with the related appointment so that authorized participants can join. Nexus does not use the Google Meet Media API, does not access meeting audio or video, and does not access recordings or transcripts as part of the current Google integration.

6. How we use Google data

Google user data is used only to provide and improve the user-facing features the user has chosen to enable:

• to identify and maintain the connected Google Account;
• to check availability and detect scheduling conflicts;
• to create, update and cancel appointment-related calendar events;
• to create and manage Google Meet meeting spaces and provide meeting links to authorized participants;
• to keep the integration secure and working, for example by detecting failed or revoked connections.

Google user data is used only for the user-facing functionality described in this Policy and authorized by the user. It is not used for any other purpose, and it is not used to build advertising or marketing profiles. Antrotic Nexus does not use Google Workspace user data to develop, train, or improve generalized, foundational, frontier, or other non-personalized AI or machine-learning models.

7. OAuth authorization

Nexus connects to Google only through Google’s OAuth 2.0 authorization process. The user is taken to Google, where Google displays the permissions Nexus is requesting. Nexus receives access only if the user explicitly approves. If the user declines, no Google data is accessed.

The authorization flow uses Proof Key for Code Exchange (PKCE). Nexus never sees or stores the user’s Google password.

8. How OAuth credentials are stored

• Google OAuth refresh tokens are stored encrypted using AES-256-GCM.
• The encryption key is stored separately from the application database.
• Short-lived Google access tokens are designed to remain in application memory only and are not written to the database.
• Nexus does not intentionally log OAuth refresh tokens, access tokens, authorization codes, PKCE verifiers, OAuth client secrets or raw credential-bearing OAuth responses.

9. Security

We use administrative, technical and organizational measures designed to protect information in Nexus. These include access limited to authorized users, role-based permissions, encryption of stored OAuth credentials, least-privilege Google permissions, and security and audit records.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will respond and provide notifications as required by applicable law.

10. How Google data is shared

We do not share Google user data with third parties except in these limited cases:

• With Google, as part of providing the integration, for example when Nexus asks Google Calendar to create an event.
• With authorized participants, where sharing is the purpose of the feature being used, such as providing a meeting link or appointment time to the people taking part in that appointment.
• With service providers that host or operate infrastructure for Antrotic, under confidentiality and security obligations, and only as needed to run Nexus.
• For legal reasons, when required to comply with applicable law, legal process or a lawful request, or to protect the rights, safety and security of Antrotic, our users or others.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to this Policy and with notice where required.

Antrotic personnel do not read Google user data unless the user has given permission for specific data, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

11. No sale and no advertising

We do not sell Google user data. We do not use Google user data for advertising, including personalized, retargeted or interest-based advertising. We do not share Google user data with advertisers, advertising networks, data brokers or other information resellers, and we do not use it for marketing unrelated to Nexus.

12. Data retention

• OAuth credentials are kept only while the Google connection is active. Active stored credential material is removed when the user disconnects Google in Nexus.
• Access tokens are short-lived and designed to be held in memory only.
• Free/busy information is used for the scheduling operation for which it was requested.
• Google-derived references stored with appointments, such as event identifiers, meeting space identifiers and meeting links, are kept for as long as the related appointment record is needed for Antrotic’s business, legal or accounting purposes, and are then deleted or anonymized.
• Non-secret audit, security and operational records may be retained where reasonably necessary for security, accountability, dispute resolution and legal compliance.

13. Disconnecting Google

A user can disconnect their Google Account from within Nexus at any time. When a user disconnects:

• Nexus requests that Google revoke the OAuth access it was granted;
• active stored Google OAuth credential material, including the encrypted refresh token, is removed;
• Nexus stops performing further authorized Google Calendar and Google Meet operations for that account.

Disconnecting does not necessarily delete Google Calendar events, Google Meet spaces or other Google resources that were already created in the user’s Google account. Those resources may remain until they are deleted separately, either by the user in Google or through an applicable cleanup workflow.

14. Revoking access through Google

Users can also revoke Nexus’s access directly from their Google Account at any time by visiting Google Account permissions and removing Antrotic Nexus. After revocation, Nexus can no longer access that account’s Google data, and the user must authorize the connection again before Google features can be used.

15. Audit and operational records

Nexus keeps non-secret audit, security and operational records, such as when a Google Account was connected or disconnected, which user performed an action, and whether an operation succeeded or failed. These records are designed not to contain OAuth tokens, authorization codes or other credentials. They support security, troubleshooting and accountability, and may be retained after a Google Account is disconnected where reasonably necessary.

16. Your rights and choices

Subject to applicable law, you may ask us to access, correct or delete personal information we hold about you, or to restrict or object to certain processing. You can also:

• choose not to connect a Google Account;
• disconnect Google in Nexus, or revoke access through your Google Account, at any time;
• ask us to delete Google-derived data associated with your account by writing to contact@antrotic.com.

Because Nexus is an internal business system, some information may need to be retained for Antrotic’s legitimate business, legal or security purposes. If we cannot fully meet a request, we will explain why. We will respond within the time required by applicable law.

17. Third-party services

Nexus integrates with Google services, including Google OAuth, Google Calendar and Google Meet. Google’s handling of your information is governed by the Google Privacy Policy, and meetings held in Google Meet are subject to Google’s terms.

This website is served by a static hosting provider, which processes technical request data to deliver the site. This website does not load third-party analytics, advertising or tracking scripts.

18. Children’s privacy

Nexus is a business platform for authorized users and is not directed to children. We do not knowingly collect personal information from children under 13, or under the minimum age set by applicable law, through Nexus or this website. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

19. Changes to this Policy

We may update this Privacy Policy as Nexus or legal requirements change. We will revise the “Last Updated” date and, for material changes, give notice through Nexus or another appropriate channel. Before using Google user data in a materially different way, we will ask for the user’s consent where the Google API Services User Data Policy requires it.

20. Contact

For questions about this Privacy Policy, requests about your information, or to report a privacy or security concern, contact:

21. Google API Services User Data Policy and Limited Use

Antrotic Nexus’s use and transfer to any other application of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In line with the Limited Use requirements, Nexus:

• uses Google user data only to provide or improve the user-facing functionality described in this Policy and authorized by the user;
• transfers Google user data only as necessary to provide or improve those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
• does not use or transfer Google user data for serving advertisements, including personalized, retargeted or interest-based advertising;
• does not sell Google user data or transfer it to data brokers or information resellers;
• does not allow humans to read Google user data except as described in section 10;
• does not use Google Workspace user data to develop, train, or improve generalized, foundational, frontier, or other non-personalized AI or machine-learning models.