Hermes — Privacy Policy

Last updated: 21 September 2026

Hermes is made by Nexus Labs Technology L.L.C-FZ ("we"), Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. This policy explains what Hermes does with your information, and in particular with the information it receives from your Google account.

Contact: info@nexuslabuae.ai

The short version

Hermes reads only the school email you tell it to, and nothing else.
It cannot delete your email. The permission it holds does not allow it.
It never sends anything without your explicit approval.
It does not sell your data, show you ads, or use your email to train AI models.
You can have your data erased, and erasure is permanent.

What Hermes asks Google for, and why

When you connect Gmail, Google shows you exactly two permissions:

Permission	What it allows	Why Hermes needs it
View your email messages and settings	reading messages	to read the school emails you have chosen
Send email on your behalf	sending a message	to send a reply to the school after you approve it

Hermes does not ask for permission to delete email, move it to the trash, or change your labels or settings. Neither of the permissions above can do any of those things — so this is a limit on what Hermes can do, not only on what it chooses to do.

Which email Hermes reads

You tell Hermes which senders or addresses belong to your children's schools. Only messages from those sources are read or stored. Email from anyone else in your mailbox is not processed by Hermes and does not enter our systems.

We filter in two places, deliberately. We ask for only the school messages where Google allows it, and Hermes checks every message against your list again before keeping anything. If a message is not from a source you chose, it is discarded, not stored.

What we keep, and how

The school messages you chose, and what Hermes understood from them — the tasks, dates and which child each is for.
Your corrections — when you tell Hermes it got something wrong.
Your household — the children you entered and their school year or class. Hermes never guesses who your children are from email; you enter them.

Message content is encrypted at rest. The keys that protect it are held in a separate key service on a separate server, not alongside the data. That key service can only be unlocked by two of three independent key holders acting together; no single person, including anyone at Nexus Labs, can unlock it alone.

Who else processes your information

Hermes relies on a small number of service providers, each only to run the product for you:

Provider	What for
Composio	connecting to your Gmail account and receiving new school messages. Composio holds the Google access credential on our behalf; Hermes itself never receives it
Amazon Web Services (Bedrock), United States	reading a school message to work out what it asks of you. The model is Anthropic's Claude, running inside AWS; Anthropic does not receive your messages
Google	your Gmail account itself
Contabo, France	the servers Hermes runs on

Where your information goes. Hermes' own servers are in France. When a school message is read, its text is sent to Amazon Web Services in the United States for processing, and is not retained there afterwards.

We do not sell your information, share it with advertisers or data brokers, use it for advertising, or use it to decide anything about credit or lending.

We do not use your email or your family's information to train AI models — ours or anyone else's. A message is sent to the AI provider only to be read for you, at the moment Hermes processes it.

Google API Services User Data Policy

Hermes' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sending email

Hermes can draft a reply to your child's school. It is sent only after you read the full message and approve it, from your own email address, and it appears in your own Sent folder. Hermes does not send email on its own.

Children's information

School email is about children, so Hermes necessarily handles information about them — their names, their school year or class, and what the school asks of them. Hermes is used by parents and guardians, not by children, and is not directed to children. We use children's information only to show the parent what the school needs.

Keeping it, and deleting it

We keep your information while your account is active.

You can ask us to erase your information at any time by writing to info@nexuslabuae.ai. Erasure destroys the encryption key that protects your data, which makes the stored content permanently unreadable — it cannot be recovered by us or anyone else.

You can also disconnect Gmail at any time, from Hermes or from your Google account at myaccount.google.com/permissions. Disconnecting stops Hermes receiving any further email immediately.

Security

Message content is encrypted at rest, with keys held separately.
Each family's information is kept separate from every other family's. Between customer accounts this is enforced by the database itself; between families within an account it is enforced by the application and checked by automated tests on every change.
Administrative access to the servers uses cryptographic keys, not passwords, and is limited to named people.
If Hermes stops receiving your mail — for example because access was revoked or expired — it tells you, rather than showing you an empty list as though nothing needed attention.

Changes

If we change this policy in a way that affects how your information is used, we will tell you before the change takes effect.

Contact

Nexus Labs Technology L.L.C-FZ · info@nexuslabuae.ai