PRIVACY POLICY

1. INFORMATION WE COLLECT

We collect information in the following categories:

1.1 Account Information. When you create an account or sign up for our Services, we collect your name, email address, company name, job title, and other information you provide.

1.2 Payment Information. If you make a payment, your payment-related information (such as credit card or billing details) is collected by our third-party payment processor on our behalf. We do not store full payment card numbers.

1.3 Communications. When you contact us (via email, forms, or chat), we collect the information you provide in those communications.

1.4 Usage Data. We automatically collect information about how you interact with our Services, including pages viewed, features used, actions taken, time spent, and frequency of use.

1.5 Device and Technical Data. We automatically collect technical information including IP address, browser type and version, operating system, device type, screen resolution, referring URLs, and general location information (e.g., city or region inferred from IP address).

1.6 Cookie and Tracking Data. We use cookies and similar tracking technologies to collect information about your browsing behavior. See Section 6 (Cookies) for more detail.

2. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Services

• To create and manage your account

• To process transactions and send related information (invoices, receipts)

• To communicate with you about the Services, including updates, security alerts, and support messages

• To send marketing and promotional communications (with your consent or as permitted by law)

• To respond to your comments, questions, and requests

• To monitor and analyze trends, usage, and activity to improve the Services

• To detect, prevent, and address fraud, security issues, and technical problems

• To comply with legal obligations and enforce our agreements

• To generate anonymized or aggregated data that does not identify you, which we may use for any lawful purpose

3. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers. We share information with third-party service providers who perform services on our behalf, such as hosting, analytics, payment processing, email delivery, and customer support. These providers are contractually obligated to use your information only for the purposes of providing services to us.

3.2 Legal Requirements. We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.3 Business Transfers. We may share or transfer your information in connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, in which case we will make reasonable efforts to require the recipient to honor this Privacy Policy.

3.4 With Your Consent. We may share your information with third parties when you have given us explicit consent to do so.

4. DATA RETENTION

We retain your personal information for as long as your account is active, as needed to provide you with the Services, or as necessary to fulfill the purposes described in this Privacy Policy. We may also retain information as required by law, to resolve disputes, or to enforce our agreements. When personal information is no longer needed, we will delete or anonymize it.

5. DATA SECURITY

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, loss, alteration, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. COOKIES

We use cookies and similar tracking technologies to collect information about your activity on our website. Cookies are small text files placed on your device that help us analyze web traffic and improve your experience.

We use the following types of cookies:

• Strictly Necessary Cookies: Required for the website to function and cannot be disabled.

• Analytics Cookies: Help us understand how visitors interact with our website by collecting information anonymously (e.g., Google Analytics).

• Marketing Cookies: Used to track visitors across websites and display relevant advertisements (e.g., LinkedIn Insight Tag, Facebook Pixel).

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. A cookie consent banner is presented on your first visit to our website.

7. GOOGLE API USER DATA

When you connect your Google Analytics, Google Search Console, or Google Merchant Center account to Nudge, we access data from these Google services on your behalf using OAuth 2.0. This section describes how we access, use, store, and share that data, and is in addition to (not in place of) the other terms of this Privacy Policy.

Scopes we request

We request the narrowest scopes required to provide the Service:

• https://www.googleapis.com/auth/userinfo.email — to identify the Google account that authorized the connection.

• https://www.googleapis.com/auth/analytics.readonly — read-only access to your Google Analytics 4 reporting.

• https://www.googleapis.com/auth/webmasters.readonly — read-only access to your Search Console search performance.

• https://www.googleapis.com/auth/content — read and write access to your Google Merchant Center product listings.

We do not request write access to any Google service.

Data we read

From Google Analytics, we read aggregated reporting only: account and property metadata you can already see in GA Admin, session and page-view counts, traffic-by-channel breakdowns, top pages, and referrals from AI platforms (such as ChatGPT, Claude, Gemini, and Perplexity). From Search Console, we read your verified site list and page-level metrics (clicks, impressions, click-through rate, average position) and top search queries.

We do not access individual end-user data, advertising identifiers, or any data that personally identifies your site visitors.

How we use this data

Google API data is used solely to render your Nudge dashboard — specifically the Attribution and Catalog Metrics views — for your account. We do not:

• sell or rent Google user data to any third party;

• use Google user data for advertising or to serve ads;

• use Google user data to train, fine-tune, or evaluate artificial-intelligence or machine-learning models;

• transfer Google user data to third parties except sub-processors we use to provide the Service (such as our cloud infrastructure providers), under contractual obligations consistent with this Privacy Policy.

Data we write. With your explicit approval, Nudge writes enriched product attributes (for example product highlights, product details, material, and additional images) to a supplemental data source named "Nudge AEO" that Nudge creates in your Merchant Center account. Supplemental feeds only add the specific attributes you approve; we never modify your primary product feed, your prices, or your availability. Every write is shown to you for review, and you can edit or reject it before it is applied.

How we store this data

OAuth access tokens and refresh tokens are encrypted at rest using AES-256-GCM before being written to our database. Aggregated reporting results are cached server-side for up to six (6) hours to reduce load on Google's APIs. We do not persist raw row-level Google data beyond this short-lived cache.

Retention, deletion, and revocation

When you disconnect a Google integration from the Nudge dashboard, we revoke the OAuth token with Google immediately, delete the stored token records from our database, and the cached aggregate metrics expire within six (6) hours.

You may also revoke Nudge's access independently at any time at https://myaccount.google.com/permissions.

Attributes previously written to the "Nudge AEO" supplemental data source remain in your Merchant Center account until you delete that data source, which you can do at any time in Merchant Center's data source settings.

Compliance

Nudge's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

8. META ADS API USER DATA

When you connect your Meta (Facebook) Ads account to Nudge, we access data from Meta's Marketing API on your behalf using Facebook Login for Business (OAuth 2.0). This section describes how we access, use, store, and share that data, and is in addition to (not in place of) the other terms of this Privacy Policy.

Permissions we request

We request one permission, ads_read, which gives read-only access to the ad accounts you own or have been granted access to, and to their performance reporting. Meta also grants public_profile to every app automatically, which gives us the name and ID of the Facebook profile that authorized the connection. We do not request ads_management, business_management, or any other permission. Nudge cannot create, edit, pause, or publish ads on your behalf.

Data we read

From the ad account you select, we read: the list of ad accounts you can access (name, ID, currency, time zone, status, and spend counters); campaigns (name, objective, status); ad sets (name, optimization goal, budget, and a targeting summary such as countries, regions, age range, genders, interests, audience names, and placements); ads and their creatives (headline, primary text, description, call to action, destination URL, image and video assets, and Instagram permalink); the pixels on the account (name, ID); and performance metrics (spend, impressions, clicks, click-through rate, cost per click, cost per thousand impressions, reach, frequency, landing page views, purchases and purchase value, return on ad spend, and delivery rankings), optionally broken down by age, gender, country, region, platform, placement, and device.

We do not access data about the individual people who see or click your ads. All metrics are aggregated as Meta reports them.

How we use this data

Meta API data is used solely to provide the Services for your account: to let you choose the campaign and ad a landing page is built for; to draft a landing page whose copy and imagery match the ad you selected; to place the Meta pixel you select on landing pages that Nudge hosts for you, so Meta can attribute visits and purchases to your ads; and to report the performance of those pages against the ad's metrics. We do not:

• sell or rent Meta user data to any third party;

• use Meta user data for our own advertising or to serve ads;

• use Meta user data to train, fine-tune, or evaluate artificial-intelligence or machine-learning models;

• transfer Meta user data to third parties except sub-processors we use to provide the Service (such as our cloud infrastructure and AI model providers, which receive the copy and images of the ad you select as an input to draft your page), under contractual obligations consistent with this Privacy Policy.

  
  

How we store this data

Access tokens are encrypted at rest using AES-256-GCM before being written to our database. Meta tokens are valid for sixty (60) days and are re-exchanged automatically while the connection is active. We store the ID and name of the ad account and pixel you select. Campaign, ad set, ad, creative, and pixel data is read from Meta in real time when you use the dashboard and is not stored. To match your landing pages to your ads and to render the ad funnel report, we cache ad IDs, ad names, ad destination URLs, and performance figures server-side for up to one (1) hour. Ad images are processed in memory while a page is being drafted and are not retained. Landing page drafts we create for you may contain text taken from the ad you selected, and are stored as your content.

Retention, deletion, and revocation

To delete the Meta data Nudge holds, open Settings, then Integrations, in your Nudge dashboard and choose Disconnect Meta Ads. We immediately revoke Nudge's permissions with Meta, delete the stored token, clear the ad account and pixel selections, and remove those identifiers from your account's activity history. Cached data expires within one (1) hour. Pages you have already published keep the pixel until you republish or unpublish them.

You may also revoke Nudge's access independently at any time from your Facebook settings under Apps and Websites, or, for a business portfolio, under Business Settings, Integrations, Connected apps. Revoking there stops our access immediately; to have the stored records deleted as well, disconnect in the dashboard or contact us.

If you no longer have access to a Nudge dashboard, contact us at the address in the Contact Us section from the email address on your account and we will delete the data within thirty (30) days.

Compliance

Nudge's use of information received from Meta's APIs adheres to the Meta Platform Terms (https://developers.facebook.com/terms/) and Developer Policies (https://developers.facebook.com/devpolicy/).

9. YOUR PRIVACY RIGHTS

Depending on your location, you may have certain rights regarding your personal information:

• Right to Access: You may request a copy of the personal information we hold about you.

• Right to Correction: You may request correction of inaccurate personal information.

• Right to Deletion: You may request deletion of your personal information, subject to certain exceptions.

• Right to Opt-Out: You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email or by contacting us.

• Right to Data Portability: Where applicable, you may request your personal information in a structured, commonly used, machine-readable format.

To exercise any of these rights, please contact us at [email protected]. We will respond to verified requests within the timeframes required by applicable law.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes for collection, and the categories of third parties with whom we share your information.

• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.

• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

We do not sell personal information as defined under the CCPA. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA.

To submit a CCPA request, contact us at [email protected]. We will verify your identity before fulfilling your request and will respond within 45 days.

10. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that differ from your country. Our servers and primary operations are located in the United States, and our Services are operated from the United States. If you are accessing our Services from outside the United States, your information will be transferred to the United States for processing.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy when transferred internationally.

11. THIRD-PARTY LINKS

Our Services may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you access through our Services.

12. CHILDREN’S PRIVACY

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at [email protected] and we will take steps to delete such information.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date at the top of this Privacy Policy and, where required by law, by providing additional notice (such as email notification). We encourage you to review this Privacy Policy periodically.

14. CONTACT US

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Nudge Technologies Inc.

Email: [email protected]

General inquiries: [email protected]