Legal

NUDGEO Privacy Policy

NUDGEO privacy practices: data collection, processing, and retention. Data residency, AES-256 encryption at rest, TLS 1.3 in transit, retention periods, third-party sharing, sub-processors, user rights, cookies, and security controls.

Revised and effective 7 September 2026

Notice of revision. This policy was revised on 7 September 2026 and takes effect the same day. The main changes are a new cross-border transfer section, the addition of advertising subprocessors (X and LinkedIn), and disclosure of our use of Google Analytics advertising features.

NUDGEO (the “Company”) is committed to protecting your personal data in compliance with applicable privacy laws and regulations. This Privacy Policy explains how we collect, use, retain, and protect information about users of the Service.

1. Data We Collect

We collect the following categories of information:

  • Required: Email address, company name, AWS Account ID.
  • Optional: Full name, job title, industry category.
  • Automatically collected: IP address, browser and OS information, page visit logs, cookies.
  • Inferred advertising and analytics attributes: Age range, gender, and interest categories. We never ask you for these. They are supplied in inferred form by Google Analytics advertising features (Google signals), and only where you have accepted in the cookie banner.
  • Service usage data: Tracked queries, entity information, API call records.

2. Purposes of Collection

  • Service delivery (dashboard access, measurement, content generation, automated publishing).
  • Account management (authentication, permissions, billing).
  • Service improvement (product usage analytics, A/B testing).
  • Customer support (responding to inquiries, debugging issues).
  • Legal obligations (tax reporting, dispute resolution).

3. Retention Periods

We retain personal data only for as long as necessary to fulfill the stated purpose or as required by law.

  • Account information: Until account deletion.
  • Payment records: 5 years (per applicable e-commerce regulations).
  • Access logs: 3 months (per applicable communications privacy regulations).
  • Measurement raw data: For the duration of an active account. Permanently deleted within 30 days of a deletion request.

4. Data Residency, Encryption, and Cross-Border Transfers

Personal data we store ourselves is held exclusively in AWS ap-northeast-2 (Seoul region), encrypted at rest with AES-256 and in transit with TLS 1.3.

We do, however, engage overseas providers for the functions below, and personal data is transferred abroad to that extent. You may refuse these transfers; refusing does not restrict your access to the core service. Transfers for advertising and analytics occur only where you have accepted in the cookie banner, and stop when you decline or withdraw.

  • Amazon Web Services, Inc. (United States)
    • Data transferred: Account and usage records needed to operate the service. Storage itself stays in the Seoul region; US-based personnel may access data in the course of support and incident response.
    • When and how: At the time of a support request or incident, encrypted in transit.
    • Purpose: Infrastructure hosting, technical support, payment processing.
    • Retention: Until the processing agreement ends or you close your account.
  • OpenAI, L.L.C. · Anthropic PBC · Google LLC and other AI providers (United States)
    • Data transferred: Tracked queries, limited to brand name and industry category. No user identifiers are included.
    • When and how: At each measurement run, encrypted in transit via API.
    • Purpose: Measuring brand visibility in AI answers.
    • Retention: Per each provider's API data policy.
  • Resend, Inc. (United States)
    • Data transferred: Email address, delivery history.
    • When and how: At the time a transactional email is sent, encrypted in transit via API.
    • Purpose: Authentication and notification emails.
    • Retention: Until the processing agreement ends.
  • Microsoft Corporation (United States)
    • Data transferred: Cookie identifiers, page usage, anonymized session recordings.
    • When and how: On page view for consenting visitors, sent automatically by a script installed on the site.
    • Purpose: Website usage analytics (heatmaps, session analysis).
    • Retention: Per Microsoft's data policy; stops when you withdraw consent.
  • Google LLC (United States)
    • Data transferred: Cookie identifiers, advertising identifiers, page usage, and inferred age range, gender, and interest categories.
    • When and how: On page view for consenting visitors, sent automatically by a tag installed on the site.
    • Purpose: Website usage analytics, ad performance measurement, personalized advertising.
    • Retention: Per Google's data policy; stops when you withdraw consent.
  • Meta Platforms, Inc. · X Corp. · LinkedIn Corporation (United States)
    • Data transferred: Cookie identifiers, advertising identifiers, page usage.
    • When and how: On page view for consenting visitors, sent automatically by advertising pixels installed on the site. All three run on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com).
    • Purpose: Ad performance measurement and personalized advertising.
    • Retention: Per each company's data policy; stops when you withdraw consent.

5. Third-Party Disclosure

We do not share personal data with third parties except in the following circumstances:

  • With your explicit consent.
  • When required by law (e.g., valid legal process).
  • With subprocessors necessary to deliver the Service (see Section 6).

6. Subprocessors

We engage the following subprocessors:

  • AWS: Infrastructure hosting and payment processing.
  • OpenAI · Anthropic · Google · other AI providers: Transmission of tracked queries during measurement (limited to brand name and industry category).
  • Resend: Transactional email delivery.
  • Microsoft Clarity: Website usage analytics and session analysis (heatmaps, anonymized recordings), limited to aggregate usage statistics.
  • Google LLC (Google Analytics): Website usage analytics. We also use its advertising features (Google signals), so this is not limited to aggregate statistics: it includes collection of inferred age, gender, and interest categories, and use for personalized advertising.
  • Meta Platforms · X Corp. · LinkedIn Corporation: Ad performance measurement and personalized advertising, on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com), limited to users who consent via the cookie banner.

7. Your Rights

You have the right to:

  • Access, correct, or delete your personal data.
  • Request restriction of processing.
  • Withdraw consent (by canceling your account).
  • Lodge a complaint with the relevant data protection authority.

Submit requests to privacy@nudgeo.com. We will respond within 7 business days.

8. Cookies

We use the following categories of cookies:

  • Authentication: Maintains your login session (required).
  • Preferences: Stores language, theme, and other user settings (optional).
  • Analytics: Usage statistics via Microsoft Clarity (_clck, _clsk) and Google Analytics (_ga, _ga_*) (optional).
  • Advertising (optional)
    • Meta pixel: _fbp, _fbc. Runs on both nudgeo.com and app.nudgeo.com, because sign-up and payment complete on the product.
    • X pixel: third-party cookies personalization_id, muc_ads, guest_id, guest_id_ads, guest_id_marketing (x.com, twitter.com). It also sets first-party cookies _twpid and _twsid on our own domain, and may add the click identifier _twclid for visitors arriving from an ad.
    • LinkedIn Insight Tag: third-party cookies bcookie, lidc, li_sugr, UserMatchHistory, bscookie, li_gc, AnalyticsSyncHistory (linkedin.com). It also sets the first-party cookie li_fat_id on our own domain.
  • Google Analytics advertising features (optional): We use Google Analytics advertising features (Google signals). When enabled, our first-party Google Analytics cookie (_ga) is used together with Google's third-party advertising cookies and identifiers, which allows your visit data to be combined with Google's advertising data for signed-in Google users.

Analytics and advertising cookies are non-essential and are set only if you accept them in the cookie banner shown on your first visit. You can withdraw consent at any time, and you can also refuse them via your browser settings or each provider's opt-out tools.

9. Behavioral Data for Advertising

We collect and use behavioral data for personalized advertising as set out below, on both the marketing site (nudgeo.com) and the signed-in product (app.nudgeo.com), and only where you have accepted in the cookie banner.

  • What we collect: Pages visited, time on page, clicks and other site usage, and advertising identifiers.
  • Who collects and processes it: Meta Platforms, Inc., X Corp., LinkedIn Corporation, and Google LLC.
  • How we collect it: Automatically, via the advertising pixels installed on the site (Meta, X, LinkedIn) and Google Analytics advertising features, and only where you have accepted in the cookie banner.
  • Why we collect it: To measure ad performance and to serve advertising based on your interests.
  • Retention and disposal: We do not store behavioral data on our own servers. Each company above retains and deletes it under its own data policy, and you can stop collection at any time using the controls below.
  • Your controls: Decline in the cookie banner, or withdraw consent later. You can also block cookies in your browser, or opt out with each provider:

We do not serve personalized advertising to children under 14, and we do not use sensitive data such as beliefs, political opinions, health, or sexual life for personalized advertising.

10. Security Measures

  • Annual SOC 2 Type II audit (report available to Enterprise plan customers).
  • AWS Foundational Technical Review: all items passed (verified April 2026).
  • Role-Based Access Control (RBAC) with audit logs retained for 90 days.
  • SSO/SAML integration for Enterprise customers (Okta, Google Workspace, Azure AD).

11. Data Protection Officer

To obtain the name, title, and contact details of our Data Protection Officer, email privacy@nudgeo.com.

12. Policy Updates

We will provide at least 7 days' advance notice of changes to this Policy (30 days for material changes).

To request a DPA, security checklist, or audit report, contact security@nudgeo.com.