Privacy Policy

Nudge ("Nudge", "we", "us") is an AI Front Desk operated by GOLDMINE INFOTECH PRIVATE LIMITED, an Indian private limited company. Business address: 21, PARTHASARATHYPURAM EXTN, T.NAGAR, Chennai, Tamil Nadu 600017, India. GSTIN: 33AABCG3582H1ZR. Contact: contact@nudgeagent.app.

For account, access-request and demo-booking data, Nudge determines why and how the data is used. When a business uses Nudge to communicate with its own customers, that business controls its contacts' data and Nudge processes the data to provide the service and follow the business's documented instructions, subject to the parties' agreement and applicable law.

Account data you give us: your name, work email, business name, country, business type, and, if you subscribe to a paid plan, billing details handled by our payment processors (we never see full card numbers).

Demo and access-request data you give us: your name, work email, phone or WhatsApp number and form source. If you schedule through Cal.com, we may receive the Cal booking UID, event type, appointment time and the first attendee's name, email and phone. Nudge separately stores its internal lead status and operator-authored notes. Do not put patient, clinical or other special-category information in Nudge's demo forms or booking notes.

Website first-touch attribution is disabled by default. Only the exact value "true" for the deployment setting NEXT_PUBLIC_MARKETING_ATTRIBUTION_ENABLED enables Nudge to write first-touch browser local storage, read an existing _ga cookie or forward attribution to Cal.com. When that setting and an approved consent and analytics configuration are in place, we may collect a landing path, origin-only referrer, the UTM source, medium and campaign, and a validated pseudonymous Google Analytics client ID. Aggregate CTA and form events can still enter the GTM data layer while first-touch attribution is off; Google Analytics collection depends on the separately reviewed GTM and server configuration. Arbitrary page query parameters are not forwarded.

Contact data you upload or receive: the phone numbers, names, email addresses, tags, notes and message history of the customers you manage in Nudge. You are responsible for having a lawful basis and the necessary consent to process this data.

WhatsApp message data: inbound and outbound message content, delivery and read receipts, and the metadata Meta's official WhatsApp Cloud API returns, so we can run the shared inbox, AI Front Desk, automations and service analytics.

AI and integration data: owner-provided business knowledge, relevant conversation context, model outputs and tool requests; connected Google Calendar account details and appointment data; and information sent to optional payment, CRM, voice or webhook integrations you configure. Provider credentials and supported tokens are stored encrypted where the product supports a saved connection.

Technical data: authentication tokens, IP address, request and security logs, audit events, and usage records needed to operate, meter and protect the service. We do not sell personal data or use it for cross-site advertising.

• To provide the AI Front Desk, inbox, contacts, campaigns, automations, business actions, analytics and team collaboration.
• To send WhatsApp messages on your behalf through the official Meta WhatsApp Cloud API, subject to opt-in and opt-out rules described below.
• To schedule and manage product demos, respond to access requests, operate the founder lead pipeline and follow up with prospects.
• When separately approved and enabled, to attribute demo demand, measure aggregate website actions and connect a booked demo to later lead-quality events.
• To process payments and manage your subscription.
• To secure the service, prevent abuse, and comply with legal obligations.
• To contact you about your account, service changes and, where you have opted in, product updates.

Nudge's platform-paid AI uses Anthropic or OpenAI models, depending on Nudge's default and the AI model setting the business chooses. An eligible business may instead connect a customer-supplied API key for an allowed Anthropic, OpenAI or Google model; that key is encrypted at rest. Relevant prompts, business knowledge and conversation context are sent to the selected model provider to produce the requested output. Nudge does not use customer content to train its own general-purpose model. The selected provider's handling is governed by its applicable terms and the business's provider account where a customer-supplied key is used.

Suggested inbox replies and campaign drafts require a team member to review and send or launch them. Separately, when a business enables its AI Front Desk, it can automatically answer inbound messages and perform configured, bounded actions such as checking availability or preparing a booking or payment step. Configured follow-ups can send approved templates. Consent, the 24-hour service window, role checks and deterministic tool validation remain code-enforced rather than being left to the model.

A business owner can connect their own Google Calendar so the AI Front Desk can book appointments. Nudge then requests three Google permissions, and uses each only for this:

• calendar.readonly — to check when the owner is free or busy before offering a customer a time. Nudge reads availability; it does not read, store or analyse the contents of existing events.
• calendar.events — to create the appointment a customer has confirmed in the owner's calendar, and to read that same event back so a change or cancellation the owner makes in Google Calendar is reflected in Nudge.
• userinfo.email — to show the owner which Google account is connected.

Nudge stores the connected account's email address and an encrypted refresh token, plus the identifiers and times of the appointments it created. The busy times it reads are used to answer the customer and are not kept.

Nudge does not sell Google user data, does not use it for advertising, and does not share it with anyone except as needed to provide this feature. Available times are included in the conversation the AI uses to reply to the customer; Google user data is never used to train or improve any AI or machine-learning model, Nudge's or a provider's.

The owner can disconnect Google Calendar at any time in Apps → Google Calendar, which deletes the stored token and account details, and can also revoke access from their Google Account's security settings.

Nudge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Nudge includes controls designed to support use of Meta's WhatsApp Business Platform policies. Marketing messages are only sent to contacts marked as opted in, and this is enforced in code, not just in the interface. This product control is not a substitute for the business's own legal and policy review.

Opt-outs are permanent. When a contact replies STOP (or an equivalent), they are unsubscribed and can never be re-subscribed by a later import. You must obtain valid opt-in before importing contacts for marketing, and you confirm this at import time.

You are responsible for the lawfulness of your messaging and for honouring your contacts' rights. Misuse that risks Meta bans or violates applicable law is grounds for suspension.

We disclose data to service providers only as needed to run a feature, fulfil a request or operate Nudge. Availability, location and the provider's legal role can vary by configuration and contract; the providers used depend on the features you enable:

• Meta Platforms — WhatsApp Cloud API message delivery.
• Supabase — database, authentication and file storage hosting.
• Vercel — application hosting.
• Cal.com — Nudge demo scheduling and signed booking-event delivery.
• Google — connected Google Calendar, optional Google Sheets lead forwarding, and Google Analytics 4 measurement when those features are configured and approved.
• The selected model provider — Anthropic or OpenAI for the built-in service, or Anthropic, OpenAI or Google when an eligible business connects its own key.
• Razorpay and Stripe — payment processing (region-dependent).
• Resend — transactional email (e.g. team invites), where enabled.
• Other integration providers you choose — such as configured CRM, voice or outbound-webhook recipients — for the data needed to perform that integration.

We may disclose data if required by law or to protect our rights, users or the public. We do not sell personal data.

Our primary application and database region is Singapore. Our service providers may also process data in other countries, including the United States, for hosting, AI processing, support and security. A primary hosting region does not limit all processing or remote access to that country. Supported saved secrets, including WhatsApp credentials, Google refresh tokens and customer-supplied model keys, are encrypted at rest with AES-256-GCM. Passwords are handled by our authentication provider and are not stored by Nudge in plain text. Production access is restricted; workspace queries are organization-scoped and database row-level security is used as a backstop.

No system is perfectly secure, but we apply industry-standard measures — encryption in transit and at rest for secrets, signed webhooks, role-based access, and audit logging of sensitive actions.

We retain account and workspace data while the account is active and as needed to provide the service, resolve disputes, secure the platform and meet legal or accounting obligations. Demo bookings, access requests and waitlist records are retained while needed for scheduling, sales follow-up and legitimate internal records.

We do not currently promise a fixed deletion period for every category. A category-specific retention schedule, including the attribution identifiers described above, must be approved before first-touch attribution and new GA4 lead measurement are activated. When an authorized deletion request is completed, data is removed or de-identified from live systems unless retention is required; residual copies may remain in protected backups until their normal rotation.

Applicable law may give you rights to access, correct, export, restrict or delete personal data, object to or withdraw consent for some processing, or complain to an authority. The available rights and exceptions depend on your jurisdiction; not every listed right applies in every jurisdiction.

Workspace administrators can export contacts and message history from Settings → Data. This export does not cover every data category or replace a verified rights request. For deletion instructions, visit https://nudgeagent.app/data-deletion. Demo prospects and other individuals can request access, correction or deletion by emailing contact@nudgeagent.app; we may verify identity and authority before acting.

If the request concerns a Nudge customer's contacts, we normally direct or forward it to that customer as the party controlling the data. We remain responsible for requests concerning data Nudge controls, including account, access-request and demo-booking data.

Nudge is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

We may update this policy as the product and law evolve. Material changes will be notified in-app or by email. The "last updated" date above reflects the current version.