Privacy Policy
Last updated
This policy explains what personal data PayNudge handles, why, who we share it with, and the choices and rights you have. We collect as little as we need and never sell it.
1. Who we are
PayNudge is operated by PayNudge, Indonesia. You can reach us about privacy at support@paynudge.site. Where this policy says “we” or “us”, it means PayNudge.
2. Our role: controller and processor
Controller. We decide how and why we process personal data about our own customers and website visitors: for example your account details, billing status, support messages and security logs. This policy mainly describes that processing.
Processor. When you upload invoices and add your clients' contact details, we process that data on your behalf and only on your instructions. For that data you are the controller, and our Data Processing Addendum applies.
Received a reminder sent through PayNudge? The business that sent it is responsible for your data. Please contact them directly. If you contact us, we will pass your request to them.
3. Personal data we collect
- Account data: your name, email address, password (stored only as a hash), time zone, workspace name and role, and the business details you add, such as sender name, signature and reply-to address.
- Billing data: your plan, subscription status, Polar customer and subscription identifiers, and billing country. Card details are collected and stored by Polar and its payment processors, never by us.
- Customer content: invoices and photos you upload, contracts, client names, contact names and email addresses, amounts, notes, writing-style samples you paste, and the drafts and emails created in the Service.
- Usage and technical data: IP address, browser user agent, sign-in times, actions recorded in audit logs, email delivery status, AI usage counts, and error logs.
- Communications: messages you send through our contact form or by email, including your name, email address and IP address.
We do not intentionally collect special category data. Please don't upload it.
4. How we use data and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and running your account, providing the Service, sending your reminders | Performance of our contract with you |
| Account emails such as verification, password reset, security notices and billing notices | Performance of contract; legitimate interests in keeping accounts secure |
| Billing and subscription management through Polar | Performance of contract; legal obligations (tax and accounting) |
| Security, rate limiting, fraud and abuse prevention, protecting email reputation | Legitimate interests in operating a safe service |
| Answering support and contact requests | Legitimate interests; performance of contract where you are a customer |
| Improving the product using aggregated usage information | Legitimate interests |
| Complying with law and responding to lawful requests | Legal obligation |
5. AI processing
To read invoices and contracts and to draft emails, we send the relevant content to Anthropic, PBC through its commercial API. Under Anthropic's commercial terms, data sent through the API is not used to train its models. We do not use your content to train any AI model. You can avoid AI processing by entering invoice details manually and writing or editing drafts yourself. See AI Transparency.
7. International transfers
Some providers process data outside the UK and the European Economic Area, including in the United States. Where we transfer personal data to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework (and its UK extension) where the recipient is certified, together with appropriate additional safeguards.
8. How long we keep data
- Account data and customer content: for as long as your account exists. When you delete your account, we delete it from our live systems.
- Backups: daily backups are kept for 14 days and then deleted, so deleted data disappears from backups within that period.
- Billing records: kept by Polar and by us for as long as tax and accounting laws require, typically up to 7 years.
- Contact form messages: up to 24 months after our last exchange, unless needed longer for an open issue.
- Security data such as rate-limit records and expired tokens: purged regularly, usually within days.
9. Your rights
UK and EEA. You have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent where we rely on it. You can also complain to your data protection authority, for example the UK Information Commissioner's Office (ico.org.uk) or the authority in your EU country. We'd appreciate the chance to help first.
United States (including California). Depending on where you live, you may have the right to know what personal information we collect and how we use it, to access, correct and delete it, and not to be discriminated against for exercising these rights. We do not sell or “share” personal information as those terms are defined in the CCPA/CPRA, and we do not use sensitive personal information to infer characteristics about you.
You can update most data in Settings and delete your account in Settings → Account. For other requests, email support@paynudge.site. We will verify your identity and respond within the time required by law (usually one month). Authorised agents may submit requests with proof of authorisation.
11. Security
We protect data with HTTPS encryption in transit, per-workspace access control enforced on the server, hashed passwords and tokens, rate limiting and daily backups. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the authorities as the law requires. Read more on our Security page.
12. Automated decision-making
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. AI is used to read documents and suggest drafts, which you review.
13. Children
PayNudge is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
14. Changes to this policy
We will post any changes on this page and update the date above. For material changes we will notify account holders by email or in the app.
15. Contact
PayNudge, Indonesia. Email: support@paynudge.site.