your data,plainlyexplained.
How nudgt collects, stores, and protects your data and your invitees' data.
who operates nudgt
nudgt is a product of TACTECH LLC ("TACTECH LLC", "we", "us"), registered at 7901 4th St N, STE 300, St. Petersburg, FL, United States. For the purposes of this policy, TACTECH LLC is the data controller for Account Data and, per "our role: processor, not owner" below, the data processor for Invitee Data.
who this policy covers
This policy covers two kinds of people: visitors and customers of the nudgt website and product ("you", "customer"), and the "invitees" — the people a customer sends calendar invites and nudges to through the product. If you're a customer, this policy explains what we collect about you directly. If you're an invitee, see "if you're an invitee, not a customer" below — the short version is that your data was uploaded by the organization that invited you, and we process it strictly on their behalf.
Throughout this policy, "Account Data" means information tied to a customer's nudgt account (name, email, billing details, connected-service credentials), and "Invitee Data" means the names, emails, and phone numbers a customer uploads to run a campaign.
the data we collect
We collect only what the product needs to run — nothing more.
- Account data: your name, email address, password (stored as a salted hash, never in plain text), and billing information, which is handled directly by our payment processor — we never see or store full card numbers.
- Sending domain: the domain you verify to send calendar invites and email nudges. We never see or store a password or credential for it — verification is DNS-based, done by publishing DKIM and mail-from records you already control on your own domain.
- SMS provider credentials: the API keys for the SMS account you connect so text nudges can send through it. These live in an isolated secrets vault, encrypted separately from the rest of your data.
- Invitee data: the names, emails, phone numbers, and any custom fields you upload to build a campaign, plus the templates and send schedules you create.
- Usage and device data: IP address, browser type, and basic product-usage logs (e.g. login times, features used), collected for security, debugging, and abuse prevention.
- Support communications: anything you send us through the contact form or by email, including the content of your message and the address you left it from.
why we process it
We use the data above only for the following purposes. For anyone in the EU, UK, or Switzerland, we also note the GDPR legal basis we rely on for each one.
- To provide the service — authenticate your account, send your campaigns through your sending domain and connected SMS account, and render your dashboard and reports. (Necessary to perform our contract with you.)
- To bill you — calculate subscription and credit charges and process payment through our payment processor. (Necessary to perform our contract with you.)
- To secure the service — detect abuse, fraud, and unauthorized access, and enforce our terms of service. (Our legitimate interest in keeping the service safe and working, balanced against your rights.)
- To support you — respond to questions sent through the contact form or by email. (Our legitimate interest in supporting the people who use the service, or performing our contract with you.)
- To improve the product — understood in aggregate and de-identified form wherever possible; we do not build advertising profiles from your data. (Our legitimate interest in understanding how the product is used.)
- To comply with the law — where we are legally required to retain or disclose information. (Legal obligation.)
our role: processor, not owner
For Account Data, TACTECH LLC is the data controller — we decide why and how that data is processed, as described in this policy.
For Invitee Data, the customer who uploaded it is the data controller, and TACTECH LLC acts only as a data processor (or "service provider" under US state privacy law), processing that data solely to run the campaigns the customer configures. We don't decide who gets messaged, and we don't independently market to invitees.
That also means the customer — not us — is responsible for having a lawful basis to contact their invitees, including obtaining any consent required for SMS messaging (for example, under the US TCPA), honoring opt-outs, and complying with email laws such as CAN-SPAM, CASL, or GDPR/PECR where applicable. Our terms of service require customers to meet these obligations before sending a campaign.
how it’s protected
Your data lives in an encrypted, access-controlled database behind the same authentication that protects your account. SMS-provider credentials get an extra layer on top of that: they’re held in an isolated secrets vault, decrypted only in memory for the moment a batch actually sends — they never touch a plain database column, and no one, including us, can export them in plaintext. There’s nothing equivalent to hold for email: your sending domain is verified by DNS records you publish yourself, not a password we store.
Invites and email nudges are sent through your own verified sending domain; text nudges through the SMS-provider connection you supply. We are never a shared sending pool — your domain and your SMS number carry the reputation, not ours.
Access to production data is restricted to the personnel who require it to operate and maintain the Service, on a need-to-know basis.
data processing agreements
If you’re a business customer and need a signed Data Processing Agreement covering our processing of your Invitee Data — for your own GDPR, UK GDPR, or US state privacy-law compliance — contact us and we’ll provide one.
international transfers
Your data may be processed on infrastructure located outside your own country. Where that happens, we take reasonable steps to see that it continues to receive a level of protection consistent with this policy, wherever it is processed.
how long we keep it
We keep Account Data and Invitee Data for as long as your account exists.
Cancelling a subscription does not delete your account or its data — it stops billing and moves your workspace to the free plan, so your invitee lists, templates, and settings are still there if you come back. If you’d rather we deleted your data outright, whether or not you’ve cancelled, contact us and we will — see "your rights" below. Backups that include anything we’ve deleted age out on our infrastructure provider’s own backup rotation; we don’t keep a separate copy past that.
We may retain limited billing records for longer where required by tax or accounting law.
your rights
Depending on where you live, you may have some or all of the following rights over your Account Data. To exercise any of them, contact us using the details below.
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to fix inaccurate or incomplete data.
- Deletion — ask us to delete your data, subject to any legal retention obligations.
- Portability — request your data in a portable format; you can also export your invitee lists and templates yourself, any time, from your account.
- Restriction or objection — ask us to limit or stop certain processing.
- Non-discrimination — we won’t penalize you for exercising any of these rights.
- If you’re in the UK, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time.
- If you’re in the EU or Switzerland, you also have the right to lodge a complaint with your local data protection authority at any time.
- Either way, we’d appreciate the chance to make it right directly first — see "questions" below.
- California and other US state residents have a further set of rights — see "california & other us state privacy rights" below.
california & other us state privacy rights
If you’re a California resident, the CCPA (as amended by the CPRA) gives you rights beyond the general list above. Other US states with their own privacy laws (Virginia, Colorado, Connecticut, Utah, and a growing list of others) give you similar rights — we handle requests from any of them the same way.
- Right to know — the specific pieces of personal information we hold about you, not just the categories (which are listed in "the data we collect" above).
- Right to delete — subject to the same legal-retention exceptions as everywhere else in this policy.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing — including "sharing" in the CPRA’s broad sense (cross-context behavioral advertising). We don’t do either: we don’t sell personal information, and we don’t use any of it for cross-context ad targeting, so there’s nothing active to opt out of.
- Right to limit use of sensitive personal information — we don’t collect sensitive personal information as the CCPA defines it (no government ID numbers, precise geolocation, biometric or health data), so this doesn’t apply to anything we hold.
- Right to non-discrimination for exercising any of the above.
- Right to appeal — if we deny a request, you can ask us to reconsider by replying to our decision; we’ll explain the outcome either way.
- Authorized agent — you can have someone else submit a request on your behalf; we’ll ask for evidence they’re actually authorized to act for you before doing anything with your data.
- We respond to a verifiable CCPA request within 45 days, with one 45-day extension where the law allows it for a complex request.
if you’re an invitee, not a customer
If you received a calendar invite, email, or text from a business using nudgt, your information was uploaded by that business, not by you directly. To update or remove your data, the fastest path is usually to contact that business directly. You can also reach us — we will forward your request to the relevant customer and assist where we're able to, consistent with our role as their processor.
children’s privacy
nudgt is a business tool and is not directed at, or knowingly used to collect data from, children under 16. If you believe a child has provided us with personal data, contact us and we’ll delete it.
changes to this policy
We’ll update this page as the product and our practices change, and post a new "last updated" date whenever we do. Material changes will be communicated to active customers by email.
questions
Reach us at info@nudgt.com, or use the contact form, with any question about this policy or your data.