Privacy policy.
Plain language wherever the law allows it. Last updated: 23 September 2026. Connecting a Google account? Section 4 sets out exactly what Google user data Nordbase accesses, how it is used, stored, shared and deleted.
This Privacy Policy describes how Agenthub AB, a company registered in Sweden under organisationsnummer 559585-2665, which trades under the name Nordbase ("Nordbase", "we", "us" or "our"), collects, uses and shares personal information when you visit nordbase.ai, contact us, or use the Nordbase platform.
1. When this policy does not apply — customer data
When your employer or organisation uses the Nordbase platform, the content your organisation and its agents process ("Customer Data") is controlled by that organisation. We process Customer Data as a processor on their behalf, under a data-processing agreement — not under this policy. Questions about Customer Data belong with your organisation's administrator.
One exception, so nothing is left unsaid: data we obtain from an account you connect yourself — including Google user data — is described in section 4, and that section applies whether we act as a controller or as a processor for your organisation.
2. Personal information we collect
We collect:
- Contact information you give us — for example when you email us or book a demo: name, email address, company, and the content of your message.
- Account information when your organisation sets you up on the platform: name, work email, role, and sign-in identifiers from your identity provider.
- Usage and log data from the platform: actions taken, timestamps, device and browser information, and IP addresses — the same audit trail the product shows your organisation.
- Connected-account data from services you link to the platform yourself — Google Workspace, Microsoft 365, Slack, GitHub and others — accessed only with your authorisation and only for the features you enable. Google user data is described in full in section 4.
- Website data: standard server logs (IP address, requested page and user agent) are retained briefly for security and operations. Sentry receives technical fault data if the site encounters an error. Google Analytics also collects page views, inbound links, scroll behavior, referrer, device and browser information, and a generated browser identifier.
3. How and why we use personal information
- To provide and operate the platform, including authentication, audit logging and support (performance of contract).
- To respond when you contact us, and to arrange demos (legitimate interests).
- To secure our services: abuse prevention, incident investigation, access logging (legitimate interests / legal obligation).
- To improve our services using aggregate, de-identified usage information (legitimate interests).
- To understand how the marketing website is used and improve it through Google Analytics.
- To meet legal obligations, such as accounting and tax record-keeping (legal obligation).
We do not sell personal information, and we do not use it for third-party advertising.
4. Google user data
Nordbase lets you connect your own Google account so that agents you or your organisation configure can do work in it on your instruction. Access is granted through Google OAuth for the Google features you choose, one user at a time. We access nothing until you complete Google's consent screen, and you can withdraw that consent at any time (see 4.6).
4.1 What Google user data we access
We request only the scopes needed for the tools and triggers you select. The table below is the complete set Nordbase can request in production; each connection or access extension requests only the applicable subset.
| Google product | OAuth scopes requested | Google user data accessed, and why |
|---|---|---|
| Gmail | https://www.googleapis.com/auth/gmail.readonlyhttps://www.googleapis.com/auth/gmail.metadatahttps://www.googleapis.com/auth/gmail.sendhttps://www.googleapis.com/auth/gmail.composehttps://www.googleapis.com/auth/gmail.modifyhttps://www.googleapis.com/auth/gmail.labels | Messages, threads, drafts, labels, attachments and the mailbox's email address — so an agent you configure can search and read mail, apply labels, archive, mark read or unread, move messages to trash, and create, update and send drafts and replies on your instruction. |
| Google Drive | https://www.googleapis.com/auth/drive.file | File and folder metadata, the content of files the agent opens or downloads, and sharing permissions — so an agent can find, read, upload, copy, move, rename, share and trash the files you point it at. |
| Google Calendar | https://www.googleapis.com/auth/calendar.calendarlist.readonlyhttps://www.googleapis.com/auth/calendar.events.readonlyhttps://www.googleapis.com/auth/calendar.eventshttps://www.googleapis.com/auth/calendar.events.freebusy | Your calendar list, events and their attendees, and free/busy information — so an agent can look up availability and create, update, move, respond to and delete events. |
| Google Docs | https://www.googleapis.com/auth/drive.file | The content of documents the agent creates, and of documents you explicitly open with it — so an agent can read, export, create and edit documents. drive.file limits Drive access to those specific files. |
| Google Sheets | https://www.googleapis.com/auth/drive.file | The values, structure and formatting of spreadsheets the agent creates, and of spreadsheets you explicitly open with it — so an agent can read, write, format and reorganise them. |
| Google Contacts | https://www.googleapis.com/auth/contacts.readonlyhttps://www.googleapis.com/auth/contacts | Your contact entries — names, email addresses, phone numbers and the other fields you store — so an agent can look up, search, create, update and delete contacts. |
| Google Groups | https://www.googleapis.com/auth/cloud-identity.groups.readonlyhttps://www.googleapis.com/auth/gmail.readonlyhttps://www.googleapis.com/auth/gmail.send | Any Cloud Identity groups the connected account can access, including their memberships and member email addresses, plus group mail delivered to that account's Gmail mailbox — so an agent can look up groups and members, read group conversations, and send or reply to group mail on your instruction. |
| Google Analytics | https://www.googleapis.com/auth/analytics.readonly | The Google Analytics accounts and properties the connected account can already read, and the report data an agent requests from them — visitor, traffic and page statistics for the sites measured by those properties. Read-only: an agent cannot change a property's configuration or the data it has collected. |
| Google Search Console | https://www.googleapis.com/auth/webmasters.readonly | The Search Console properties the connected account can already read, and their Google Search performance — the queries, pages, countries and devices your site appeared for, with clicks, impressions and average position. Read-only: an agent cannot add or remove properties, submit sitemaps, or change anything about how your site is indexed. |
| Google Tag Manager | https://www.googleapis.com/auth/tagmanager.readonly | The Tag Manager accounts and containers the connected account can already read, the configuration of the container version that is currently published, and the list of previous versions. Read-only: an agent cannot edit a tag, trigger or variable, create a version, or publish one — so nothing it does can change what runs in your visitors’ browsers. |
| Google Ads | https://www.googleapis.com/auth/adwords | The Google Ads accounts the connected account can already reach, their campaign reporting — spend, clicks, impressions and conversions — and the account change history, including which user made each change. Google publishes no read-only Ads scope: its single scope permits changing campaigns as well as reading them. Nordbase does not use it to change anything — every Google Ads tool we ship runs a report query or lists accounts, and none can create, edit or pause a campaign, adjust a budget or a bid, or upload a conversion. |
| All of the above | openid, email | The email address of the Google account you connect — to confirm the connection works, label it in the interface, and keep several connected accounts of the same product apart. If your organisation uses Google for sign-in, the same identifiers authenticate you to Nordbase. |
If you enable a trigger — for example "when a message arrives in this Gmail label" or "when this Drive file changes" — Nordbase polls the relevant Google API on a schedule while the trigger is switched on, using the same scopes, so it can detect the event and start the agent run you configured.
4.2 How we use Google user data
We use Google user data only to provide and improve the user-facing features you have enabled: executing the tool calls an agent makes, evaluating the triggers you switch on, and showing you what the agent did in run history and the audit log. We do not use Google user data for advertising or marketing, to build profiles, for credit-worthiness or lending purposes, and we do not sell it.
4.3 How we store and protect Google user data
OAuth access and refresh tokens are encrypted at rest and are scoped to the individual user, organisation and connection they belong to. Google user data an agent reads or writes during a run is stored in your organisation's run history and audit log so that its work stays inspectable and reversible. All of it is hosted in the European Union, encrypted in transit with TLS 1.2+ and at rest with AES-256. Further detail is on our security page.
4.4 How we share Google user data
We never sell Google user data. We transfer it only:
- to the infrastructure providers in Annex A, under contract, strictly to operate the features you use;
- to the AI model provider your organisation has enabled for that agent, for inference only — so the model can produce the agent's next step. Providers are contractually barred from training on it or retaining it for their own purposes;
- to a destination you direct, when an agent you configured acts — for example sending an email you asked it to send;
- where necessary for security purposes, or to comply with applicable law or enforceable governmental requests.
We do not transfer Google user data to third parties for any other purpose.
4.5 Limited Use, and no training of AI/ML models
Nordbase's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use data obtained through Google Workspace APIs to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models, and we do not transfer it to others for that purpose. Google user data reaches a model only as part of the specific agent run you requested, to produce that run's output for you.
People at Nordbase do not read your Google user data, except: with your explicit consent (for example when you share a run with us for support); where necessary for security purposes, such as investigating abuse or a suspected incident; to comply with applicable law; or where the data has been aggregated and de-identified for internal operations. Support access to a workspace requires your approval and is logged.
4.6 Retention, deletion and withdrawing access
- Disconnect at any time — in Nordbase, open Integrations and disconnect the account. We revoke and remove the stored tokens and the connection, so we can no longer reach your Google data. We also ask Google to revoke the authorisation itself, so access ends on Google's side and Nordbase leaves your account's connected-apps list — except where another connection is still using that authorisation. Connecting Gmail and Drive from one Google account shares a single authorisation, and revoking it would disconnect both, so we leave it standing until the last of them is disconnected. That check is a good-faith one, not a guarantee: it can miss a case, and Google may be unreachable at that moment. If you want certainty that access has ended, use the Google control below — it is authoritative and takes effect immediately.
- Revoke at Google — you can withdraw access from your Google account directly at any time, at myaccount.google.com/permissions. This works whether or not you disconnect in Nordbase, and it stops all access immediately.
- Data already in your workspace — Google user data an agent read or wrote is kept in your organisation's run history and audit log under the retention rules in section 7, and is deleted with the rest of your organisation's data on request or at the end of your agreement.
- Deletion on request — write to hello@nordbase.ai and we will delete the Google user data we hold about you, subject only to what the law requires us to keep.
If we ever want to access a type of Google user data we have not disclosed here, we will update this policy and ask for your consent before doing so.
5. How we share personal information
We share personal information only with the service providers that run our infrastructure (listed in Annex A), with professional advisers where necessary, and with authorities where the law requires it. Providers act under contracts that restrict their use of the data to providing their service to us.
6. International transfers
We are established in Sweden, in the European Union, and host customer data in the EU. Where a service provider processes limited data outside the EU/EEA, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
7. Retention
We keep personal information only as long as needed for the purposes above: contact enquiries for up to 24 months after our last exchange; account and audit information for the life of your organisation's agreement plus a documented deletion schedule; server logs for a short, fixed window; Google Analytics event-level data for no more than 14 months. The analytics cookies in your browser expire after 180 days.
8. Your rights
Under the GDPR you can ask us for access, correction, deletion, restriction, portability, and to object to processing based on legitimate interests. Write to hello@nordbase.ai and we will respond within a month. You may also lodge a complaint with your local supervisory authority.
9. Cookies
The marketing website loads Google Analytics when you visit, without asking for a cookie choice. The cookie banner and Cookie settings control are currently hidden. A previous choice stored in this browser is not applied while the control is hidden. You can block Google Analytics using your browser settings. Blocking future collection does not erase information already processed.
| Cookie | Purpose | Duration |
|---|---|---|
nordbase_analytics_consent | Stores a previous analytics choice, which is currently not applied. | 180 days |
_ga | Distinguishes browsers for Google Analytics. | 180 days |
_ga_* | Maintains session state for our Google Analytics property. | 180 days |
The Nordbase platform (app.eu.nordbase.ai) separately sets cookies that are strictly necessary for sign-in and session security.
10. Security
How we protect data — encryption, access control, EU residency, testing — is documented on our security page.
11. Children
Our services are for businesses and are not directed to children under 16.
12. Changes to this policy
When we change this policy we update the date at the top; for material changes affecting platform users we notify your organisation's administrators.
13. Controller and contact
Agenthub AB, trading as Nordbase, is the controller for the processing described in this policy. Write to us with any question about it, or to exercise the rights in section 8.
Agenthub AB, trading as Nordbase
Organisationsnummer 559585-2665
Stockholm, Sweden
hello@nordbase.ai
Annex A — subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting and storage | EU |
| Anthropic, OpenAI, Google (Gemini) | Model inference, only for the models your organisation enables. Inference only: no training on your data, and no retention for the provider's own purposes | EU/US under SCCs, per provider |
| Nordbase EU model infrastructure | Inference for open-weight models we host ourselves | EU |
| Sentry | Error monitoring and fault diagnostics (technical event data) | EU |
| Google Ireland Limited (Google Analytics) | Marketing-website analytics | Global; applicable adequacy decisions and/or SCCs cover transfers outside the EEA |