Privacy Policy

1. Who this policy covers

Nudge is an embeddable AI chat service. There are two kinds of users:

• Customers are businesses and their authorised team members who create a Nudge account, upload documents, and configure a widget.
• End users are visitors who chat with a Nudge widget on a Customer’s website.

Nudge is operated by Daniel Felix Muigai, based in Nairobi, Kenya (“Nudge”, “we”, “us”).

2. Our roles

For account, billing, and service-administration information, Nudge generally decides how and why the information is used and acts as a data controller.

For documents a Customer uploads and messages an End user sends through that Customer’s widget, the Customer is the data controller and Nudge processes that information on the Customer’s instructions to provide the service. Customers are responsible for giving visitors the required privacy notice, choosing an appropriate lawful basis, and responding to visitor rights requests. Nudge will provide reasonable assistance as described below and in any data processing agreement that applies. [VERIFY: publish and link the applicable data processing agreement.]

3. Information we handle

• Account information: name, email address, login and account settings, and information needed to administer a Customer account.
• Customer content: PDFs and other documents uploaded by Customers, plus configuration and instructions they provide for their widget.
• Chat content: messages sent by End users and responses generated by the AI service.
• Usage and diagnostics: basic operational analytics and error information generated and stored within Nudge’s own systems. Nudge does not use a separate analytics provider.
• Device and network information: IP address, browser and device information, approximate usage timestamps, and first-party cookies or similar technologies used for login, security, and service operation. [VERIFY: document the actual cookies, purposes, lifetimes, and consent controls.]
• Payment information: payment status and transaction details processed through Paystack. Paystack handles payment credentials under its own terms. [VERIFY: confirm the exact payment fields Nudge receives or stores.]

Do not upload sensitive personal information unless the service and your legal basis are suitable for it. Customers should only upload documents they have the right to use and share for this purpose.

4. How we use information

We use information as needed to:

• create and secure accounts, provide the dashboard, process documents, and operate the chat widget;
• retrieve relevant information from a Customer’s documents and send the relevant content and question to an AI model provider to generate a response;
• process payments, provide customer support, monitor service reliability, prevent abuse, and fix errors;
• understand aggregate product use and improve the service. Customers may opt out of optional use of their content for service improvement by contacting us; this does not disable processing needed to provide Nudge; and
• meet legal obligations and protect the rights, safety, and security of users and Nudge.

Customer documents and chats are not used to train AI models. Customers may opt out of optional service-improvement use of their content by contacting us at the address below.

5. AI responses

The widget uses Customer-provided documents to help generate answers. AI responses can be incomplete or incorrect and are not a substitute for professional advice or a Customer’s own review. End users should confirm important information with the relevant business. Customers should review the service for their intended use and provide a way to contact their business.

To generate answers, relevant document content and chat messages are processed by OpenAI and Voyage AI. MongoDB stores and searches document-derived data. These providers process information to provide the service under their applicable terms. [VERIFY: confirm provider product/legal names, data locations, retention settings, and current contractual terms.]

6. Service providers and sharing

We share information only as needed to operate Nudge, meet legal obligations, or protect users and the service. Our providers include:

• OpenAI and Voyage AI: AI model and related processing used to generate answers.
• MongoDB: storing and searching document-derived data.
• Render and Cloudflare: hosting, delivery, and related infrastructure. [VERIFY: which provider handles which data and service.]
• Paystack: payment processing.

We do not use a separate third-party analytics provider. We may also share information with professional advisers, authorities when legally required, or a successor in a business transfer, subject to appropriate safeguards. [VERIFY: maintain a current subprocessor list and provide a link or contact method.]

7. International transfers and security

Nudge and its providers may process information in countries other than the country where it was collected. [VERIFY: identify processing locations and the transfer safeguards used, including any GDPR transfer mechanism that applies.]

We use reasonable technical and organisational safeguards intended to protect information. No online service can guarantee absolute security. [VERIFY: describe only controls that are actually in place, such as encryption, access controls, backups, and incident response.]

8. Retention and deletion

While an account is active, Customer documents, document-derived data, and widget chats are retained to provide the service. After account cancellation, Nudge retains this Customer content for five days and then deletes it from active systems, except where retention is required by law. [VERIFY: confirm how the five-day deletion period applies to backups and third-party provider systems.]

Account and payment records may be kept for as long as needed to administer the account, meet legal obligations, resolve disputes, and maintain required business records. [VERIFY: set their actual retention periods, including for logs and backups.]

Customers can request an export or deletion of their account content by emailing felixjardini502@gmail.com. Customers should request and download any needed export before the five-day post-cancellation period ends. End users should direct requests about a Customer’s widget conversations to that Customer. We will reasonably assist the Customer with requests we receive directly.

9. Your privacy rights

Depending on where you live and the applicable law, you may have rights to request access to, correction of, deletion of, or a copy of your personal information; to object to or restrict some processing; or to withdraw consent where processing relies on consent.

Under Kenya’s Data Protection Act, 2019 and related regulations, people have rights concerning their personal data, subject to the law. GDPR may provide similar rights to people in the European Economic Area and the United Kingdom. Customers acting as controllers are generally responsible for handling End user requests about widget chats. Contact us for account information or to ask us to assist your Customer. You may also have the right to complain to the relevant data protection authority. [VERIFY: confirm applicable rights, regulator details, and request process for each market you serve.]

10. Cookies and analytics

Nudge uses first-party cookies or similar technologies for account login, security, and service operation. Nudge does not use a separate analytics provider. [VERIFY: provide a cookie list, purposes, lifetimes, consent or opt-out choices, and distinguish Nudge cookies from cookies set by a Customer’s website.]

11. Children

Nudge is a business service and is not designed for children to create accounts. Customers are responsible for deciding whether their widget is appropriate for their audience and for providing any notices or protections required by law. [VERIFY: confirm minimum account age and whether the widget is intended for services directed to children.]

12. Changes and contact

We may update this policy as Nudge changes. We will post the current version and update the effective date. If a change materially affects Customers, we will provide notice through the service or by email where appropriate.

Privacy questions or requests: felixjardini502@gmail.com.

Daniel Felix Muigai, Nairobi, Kenya.