Legal

Nudgeo Privacy Policy

Nudgeo privacy practices: data collection, processing, and retention. Data residency, AES-256 encryption at rest, TLS 1.3 in transit, retention periods, third-party sharing, sub-processors, user rights, cookies, and security controls.

Revised and effective 10 October 2026

Notice of revision. This policy was revised on 10 October 2026 and takes effect the same day. It adds the payment and measurement providers we use (Polar, SerpApi, OpenRouter), corrects what AI providers receive and which service sends our emails, and removes descriptions of features the Service does not provide. The previous revision (15 September 2026) added Reddit and TikTok as advertising subprocessors; TikTok's transfers go to Singapore rather than the United States.

Nudgeo (the “Company”) is committed to protecting your personal data in compliance with applicable privacy laws and regulations. This Privacy Policy explains how we collect, use, retain, and protect information about users of the Service.

1. Data We Collect

We collect the following categories of information:

  • Required: Email address, company name.
  • Depending on how you buy: AWS Account ID, only for purchases through AWS Marketplace. For card purchases, the Polar customer ID and subscription status. Card details are entered at Polar's checkout and never reach us.
  • Optional: Full name, job title, industry category.
  • Automatically collected: IP address, browser and OS information, page visit logs, cookies.
  • Inferred advertising and analytics attributes: Age range, gender, and interest categories. We never ask you for these. They are supplied in inferred form by Google Analytics advertising features (Google signals), and only where you have accepted in the cookie banner.
  • Service usage data: Tracked queries, entity information, API call records.

2. Purposes of Collection

  • Service delivery (dashboard access, measurement, analysis).
  • Account management (authentication, permissions, billing).
  • Service improvement (product usage analytics, A/B testing).
  • Customer support (responding to inquiries, debugging issues).
  • Legal obligations (tax reporting, dispute resolution).

3. Retention Periods

We retain personal data only for as long as necessary to fulfill the stated purpose or as required by law.

  • Account information: Until account deletion.
  • Payment records: 5 years (per applicable e-commerce regulations).
  • Access logs: 3 months (per applicable communications privacy regulations).
  • Measurement raw data: For the duration of an active account. Permanently deleted within 30 days of a deletion request.
  • Backups: Automated database backups may keep a copy of deleted data for up to 35 days before they expire.
  • Refund records: The billing account identifier (AWS account ID or Polar customer ID), the date and amount of a refund, and the reason you gave are kept without a link to the deleted workspace, so that the same refund is not granted twice.

4. Data Residency, Encryption, and Cross-Border Transfers

Personal data we store ourselves is held exclusively in AWS ap-northeast-2 (Seoul region), encrypted at rest with AES-256 and in transit with TLS 1.3.

We do, however, engage or provide personal data to the overseas parties below, and personal data is transferred abroad to that extent. You may refuse these transfers; if you do, the functions that need them (for example card payment through Polar) are not available. Transfers for advertising and analytics occur only where you have accepted in the cookie banner, and stop when you decline or withdraw.

  • Amazon Web Services, Inc. (United States)
    • Data transferred: Account and usage records needed to operate the service, including your email address for transactional emails. Storage itself stays in the Seoul region; US-based personnel may access data in the course of support and incident response.
    • When and how: At the time of a support request or incident, encrypted in transit.
    • Purpose: Infrastructure hosting, technical support, and the product's transactional emails (Amazon SES and Amazon Cognito). For purchases through AWS Marketplace, AWS Marketplace handles the billing. The marketing site does not send email.
    • Retention: Until the processing agreement ends or you close your account.
  • OpenAI, L.L.C. · Anthropic PBC · Google LLC · Perplexity · OpenRouter, Inc. (United States)
    • Data transferred: The text of your tracked prompts. You write these prompts, and they may name your brand or your competitors. No user identifiers are included. OpenRouter passes prompts on to the providers that host the other AI models, which may be located outside the United States.
    • When and how: At each measurement run, encrypted in transit via API.
    • Purpose: Measuring brand visibility in AI answers.
    • Retention: Per each provider's API data policy.
  • SerpApi, LLC (United States)
    • Data transferred: Brand-name search queries. No user identifiers are included.
    • When and how: At each Google AI Overviews measurement, encrypted in transit via API.
    • Purpose: Running the brand-name Google searches used to measure Google AI Overviews.
    • Retention: Per SerpApi's data policy.
  • Polar Software, Inc. (United States)
    • Data transferred: Your email address and Nudgeo account identifier when you start a card checkout; the billing details you enter at checkout; payment and subscription status (payment metadata). Card numbers are processed by Polar's payment partner and never reach Nudgeo.
    • When and how: At card checkout and on each subscription event, encrypted in transit via API.
    • Purpose: Card payments and subscription management. Polar sells card subscriptions as merchant of record.
    • Retention: Per Polar's privacy policy.
  • Microsoft Corporation (United States)
    • Data transferred: Cookie identifiers, page usage, anonymized session recordings.
    • When and how: On page view for consenting visitors, sent automatically by a script installed on the site.
    • Purpose: Website usage analytics (heatmaps, session analysis).
    • Retention: Per Microsoft's data policy; stops when you withdraw consent.
  • Google LLC (United States)
    • Data transferred: Cookie identifiers, advertising identifiers, page usage, and inferred age range, gender, and interest categories.
    • When and how: On page view for consenting visitors, sent automatically by a tag installed on the site.
    • Purpose: Website usage analytics, ad performance measurement, personalized advertising.
    • Retention: Per Google's data policy; stops when you withdraw consent.
  • Meta Platforms, Inc. · X Corp. · LinkedIn Corporation · Reddit, Inc. (United States)
    • Data transferred: Cookie identifiers, advertising identifiers, page usage.
    • When and how: On page view for consenting visitors, sent automatically by advertising pixels installed on the site. All four run on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com).
    • Purpose: Ad performance measurement and personalized advertising.
    • Retention: Per each company's data policy; stops when you withdraw consent.
  • TikTok Pte. Ltd. (Singapore)
    • Data transferred: Cookie identifiers, advertising identifiers, page usage.
    • When and how: On page view for consenting visitors, sent automatically by the advertising pixel installed on the site, on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com).
    • Purpose: Ad performance measurement and personalized advertising.
    • Retention: Per TikTok's data policy; stops when you withdraw consent.

5. Third-Party Disclosure

We do not share personal data with third parties except in the following circumstances:

  • With your explicit consent.
  • When required by law (e.g., valid legal process).
  • With subprocessors necessary to deliver the Service (see Section 6).
  • To the payment providers below, which act as independent controllers under their own terms when you buy a plan:
    • Polar Software, Inc. (card purchases). Purpose: card payments and subscription management, as merchant of record. Items: your email address and Nudgeo account identifier, the billing details you enter at checkout, and payment and subscription status. Card numbers go to Polar's payment partner and never reach Nudgeo. Retention: per Polar's privacy policy.
    • Amazon Web Services, Inc. (AWS Marketplace) (purchases through AWS Marketplace). Purpose: subscription billing through AWS Marketplace. Items: your AWS account ID and Marketplace customer identifier, and subscription and entitlement status. Retention: per AWS's privacy notice.

6. Subprocessors

We engage the following subprocessors:

  • AWS: Infrastructure hosting and the product's transactional emails (Amazon SES, Amazon Cognito).
  • OpenAI · Anthropic · Google · Perplexity · OpenRouter: Transmission of tracked prompt text during measurement.
  • SerpApi: Brand-name Google searches for Google AI Overviews measurement.
  • Microsoft Clarity: Website usage analytics and session analysis (heatmaps, anonymized recordings), limited to aggregate usage statistics.
  • Google LLC (Google Analytics): Website usage analytics. We also use its advertising features (Google signals), so this is not limited to aggregate statistics: it includes collection of inferred age, gender, and interest categories, and use for personalized advertising.
  • Meta Platforms · X Corp. · LinkedIn Corporation · Reddit, Inc. · TikTok Pte. Ltd.: Ad performance measurement and personalized advertising, on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com), limited to users who consent via the cookie banner.

7. Your Rights

You have the right to:

  • Access, correct, or delete your personal data.
  • Request restriction of processing.
  • Withdraw consent (by canceling your account).
  • Lodge a complaint with the relevant data protection authority.

Submit requests to privacy@nudgeo.com. We will respond within 7 business days.

8. Cookies

We use the following categories of cookies:

  • Authentication: Maintains your login session (required).
  • Preferences: Stores language, theme, and other user settings (optional).
  • Analytics: Usage statistics via Microsoft Clarity (_clck, _clsk) and Google Analytics (_ga, _ga_*) (optional).
  • Advertising (optional)
    • Meta pixel: _fbp, _fbc. Runs on both nudgeo.com and app.nudgeo.com, because sign-up and payment complete on the product.
    • X pixel: third-party cookies personalization_id, muc_ads, guest_id, guest_id_ads, guest_id_marketing (x.com, twitter.com). It also sets first-party cookies _twpid and _twsid on our own domain, and may add the click identifier _twclid for visitors arriving from an ad.
    • LinkedIn Insight Tag: third-party cookies bcookie, lidc, li_sugr, UserMatchHistory, bscookie, li_gc, AnalyticsSyncHistory (linkedin.com). It also sets the first-party cookie li_fat_id on our own domain.
    • Reddit pixel: sets the first-party cookie _rdt_uuid on our own domain, used alongside third-party cookies from reddit.com.
    • TikTok pixel: sets the first-party cookies _ttp, _tt_enable_cookie, ttcsid and ttcsid_(pixel ID) on our own domain, used alongside third-party cookies from tiktok.com. For visitors arriving from an ad it reads the click identifier from the landing URL and stores it as the first-party cookie ttclid.
  • Google Analytics advertising features (optional): We use Google Analytics advertising features (Google signals). When enabled, our first-party Google Analytics cookie (_ga) is used together with Google's third-party advertising cookies and identifiers, which allows your visit data to be combined with Google's advertising data for signed-in Google users.

Analytics and advertising cookies are non-essential and are set only if you accept them in the cookie banner shown on your first visit. You can withdraw consent at any time, and you can also refuse them via your browser settings or each provider's opt-out tools.

9. Behavioral Data for Advertising

We collect and use behavioral data for personalized advertising as set out below, on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com), and only where you have accepted in the cookie banner.

  • What we collect: Pages visited, time on page, clicks and other site usage, and advertising identifiers.
  • Who collects and processes it: Meta Platforms, Inc., X Corp., LinkedIn Corporation, Reddit, Inc., TikTok Pte. Ltd., and Google LLC.
  • How we collect it: Automatically, via the advertising pixels installed on the site (Meta, X, LinkedIn, Reddit, TikTok) and Google Analytics advertising features, and only where you have accepted in the cookie banner.
  • Why we collect it: To measure ad performance and to serve advertising based on your interests.
  • Retention and disposal: We do not store behavioral data on our own servers. Each company above retains and deletes it under its own data policy, and you can stop collection at any time using the controls below.
  • Your controls: Decline in the cookie banner, or withdraw consent later. You can also block cookies in your browser, or opt out with each provider:

We do not serve personalized advertising to children under 14, and we do not use sensitive data such as beliefs, political opinions, health, or sexual life for personalized advertising.

10. Security Measures

  • AWS Foundational Technical Review: all items passed (verified April 2026).
  • Role-Based Access Control (RBAC) with audit logs retained for 90 days.

11. Data Protection Officer

To obtain the name, title, and contact details of our Data Protection Officer, email privacy@nudgeo.com.

12. Policy Updates

We will provide at least 7 days' advance notice of changes to this Policy (30 days for material changes).

To request a DPA, security checklist, or audit report, contact security@nudgeo.com.