Privacy Policy

NudgeMap ("we", "us", "our") provides review acceleration and reputation management software to local businesses. This policy explains what personal data we collect through our website and product, why we collect it, how long we keep it, and the rights you have over it. By using NudgeMap, you agree to the practices described here.

Business owners: when you create an account, we store your email address, business details, and billing information processed by Dodo Payments, our merchant of record). We never see or store your full card number.

Customers of those businesses: when you scan a counter QR code or receive a WhatsApp receipt nudge, the business may collect your phone number and star rating or written feedback. NudgeMap processes this data on the business's behalf as a data processor; the business you interacted with is the data controller of your feedback.

The categories of data we process are limited to what the product needs:

• Account data: name, email address, password (hashed), business name, slug, and type.
• Customer feedback data: star rating, optional written feedback, and the phone number a customer chose to share — stored against the business whose QR code was scanned.
• Receipt data: when a business sends a WhatsApp receipt, we process the phone number, ordered items, and totals needed to deliver the message and schedule the review nudge.
• Technical data: IP address (for rate limiting and abuse prevention), user agent, and product analytics events such as QR scans and message delivery status.
• AI processing: feedback text and public review text may be sent to Google's Gemini API to generate summaries and suggested replies. We do not use your data to train foundation models.

• To operate the review funnel: route happy customers to Google and deliver private feedback to the business.
• To send transactional messages: WhatsApp receipt nudges and manager alerts the business has configured.
• To authenticate business owners and secure accounts.
• To prevent abuse: rate limiting, spam filtering, and fraud detection.
• To improve the product: aggregate, de-identified analytics.

• Contract — processing necessary to provide NudgeMap to business owners.
• Legitimate interests — security, abuse prevention, and product improvement.
• Consent — marketing communications and any optional data sharing, which you can withdraw at any time.

We do not sell personal data. We share data only with the sub-processors needed to run the service: Supabase (database and authentication), Vercel (hosting), Twilio and Meta (WhatsApp delivery), Dodo Payments (payments), Google Gemini (AI analysis), and Resend (transactional email). Each is bound by its own data-processing terms.

Customer feedback and phone numbers are retained by default for up to 12 months, after which automated cleanup deletes or anonymizes them. Business account data is retained while your subscription is active and for 90 days after cancellation, in case you wish to return. Server logs are kept for 30 days. You can request earlier deletion at any time (see "Your rights" below).

All traffic is encrypted in transit (TLS). Data at rest is encrypted by our infrastructure providers. Database access is protected by row-level-security policies so business data is isolated per account; sensitive administrative operations run through a restricted service-role key that is never exposed to the browser. We apply least-privilege column grants and periodic security reviews of our policies.

Our infrastructure providers may process data in the United States, the European Union, and India. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards offered by those providers.

Depending on where you live (including GDPR in the EU/UK, CCPA/CPRA in California, and India's DPDP Act), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (right to erasure).
• Object to or restrict processing.
• Export your data in a portable format.
• Withdraw consent where processing is based on consent.

Customers who want to exercise rights over feedback they submitted to a business should first contact that business; they may also contact us directly and we will route the request appropriately.

NudgeMap is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the product evolves. Material changes will be announced on this page with a new "Last updated" date, and — for significant changes — by email to business owners.