Privacy Policy

01Who this policy covers

This policy explains how ActionNudge handles personal information in its websites, member and admin applications, APIs and support services. ActionNudge operates the service and is the contact for privacy questions at support@actionnudge.com.

For account administration, security and our own subscription billing, ActionNudge determines why and how information is used. For customer records an organization imports into its workspace, that organization generally determines the purposes and instructs ActionNudge to process the records. If your information was added by one of our customers, contact that organization first; you can also contact us for assistance directing a request.

The service is intended for business users, not children. Do not create an account if you are below the age of majority where you live. Contact us if you believe a child has provided personal information.

02Information we collect

• Account and workspace details: name, email, company name, workspace identifier, industry, billing country, role, verification status and plan preferences. Authentication records include password hashes, session information and, where enabled, authentication-factor records.
• Customer work: contacts, conversation content and metadata, tasks, complaints, resolution notes, quotes, invoice line items, payment references and activity history that you or your authorized integrations provide.
• Connected accounts: provider account identifiers, authorized permissions, access and refresh tokens, synchronization status and imported records. For a connected mailbox, this may include sender and recipient addresses, subjects, message bodies, timestamps and thread identifiers.
• Billing and support: subscription identifiers, provider transaction and invoice references, amounts, currency, status, support requests and correspondence. Hosted payment providers collect payment credentials directly; ActionNudge does not collect full card numbers or card security codes through its own checkout fields.
• Technical records: IP addresses, request and error logs, browser or device information made available in requests, security events, and records of authorized account and workspace actions.

We receive information from you, authorized workspace members, connected providers and normal use of the service. Only provide information relevant to your business workflow, and do not include passwords, card security codes or unnecessary sensitive records in messages or support tickets.

03How we use information

We use information to create and secure accounts, verify email addresses, operate workspaces, organize customer conversations, prepare reviewable follow-ups, track complaints and quote-to-payment activity, manage authorized subscriptions, and respond to support requests.

We also use operational records to troubleshoot errors, prevent abuse, investigate security incidents, maintain audit history and meet legal obligations. Account verification, password recovery and optional notification emails use the contact details relevant to that request. Connecting a mailbox is separate from receiving ActionNudge account emails.

Depending on applicable law and the purpose, processing may rely on providing a requested service, your consent, legitimate operational interests where recognized, or legal obligations. Where consent is required for a new purpose or integration, it must be obtained before that processing. This policy is not blanket consent to access your inbox or send messages.

04Connected inboxes and AI

Optional Google Workspace, Gmail, Microsoft 365 and social connections are used only when the relevant service is available and the account is authorized. Mailbox connections use the provider's authorization flow; we do not ask for your mailbox password. Permissions can cover reading messages and sending approved replies. Review the permissions presented by the provider before connecting.

When an external AI provider is configured for conversation analysis, relevant message content and workspace policy settings may be sent to that provider, such as OpenAI, to produce classifications, summaries or suggested actions. Providers may retain operational data under their applicable service terms; we do not promise zero retention. AI output remains subject to review and does not independently authorize a payment, refund or customer communication.

ActionNudge's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace user data policy, including the Limited Use requirements. Google data is used for the authorized, user-facing features, not advertising, sale to data brokers, credit decisions or training generalized AI models.

We do not permit staff to read Google message content except with your explicit agreement for specific content, when necessary for security, or as required by law. Transfers for a user-facing feature require the applicable authorization and provider safeguards. An integration being listed on the website does not mean it is active, or that Google has verified or endorsed ActionNudge.

You can remove a connection in the app where available or revoke it in your provider account, including Google Account connections. Revocation prevents further access under that permission but does not automatically delete previously imported workspace records. Contact us about deletion.

05Zoom meeting connections

Where Zoom connection access is available, you choose whether to authorize your own Zoom account. We use the connection to identify the meeting host, create a meeting you request and let you insert its attendee link into a reply or follow-up draft. Creating a meeting does not itself send an email. A public guide is available in Zoom help; connection management requires member sign-in.

Data accessed and stored: we read your authorized Zoom host profile and retain its user identifier, email address and display name. We store authorization permissions, connection status, token expiry and OAuth access and refresh tokens. For meeting requests, we store the title, start time, duration, time zone, creation status and, when creation is confirmed, the Zoom meeting identifier and attendee join link. Connection and creation actions also produce workspace audit records.

Sensitive information: OAuth tokens are sensitive authentication information needed to access Zoom on your behalf; we do not ask for your Zoom password. The current Zoom integration does not access meeting audio, video, recordings, transcripts, chat messages or participant attendance reports. It does not require health, biometric, financial or other sensitive personal details in meeting titles. Free-text titles and messages can nevertheless contain personal or sensitive information you enter, so use only what is necessary and authorized.

Use and sharing: meeting details are sent to Zoom to create the requested meeting. Zoom processes information under its Privacy Statement. Our hosting providers process stored records to run the service. If you send a message containing a meeting link, your connected email provider and the recipients receive that content. Links and titles copied into workspace conversations are also subject to the connected-inbox and configured-AI processing described above. We do not sell or rent Zoom user data, use it for advertising profiles or use it for surveillance.

Protection at rest: Zoom OAuth access and refresh tokens, and join-link fields in saved meeting records, are encrypted before database storage using AES-256-GCM. Access to meeting connections is scoped to the authenticated member and workspace. This is field-level encryption, not a claim that the entire database or backups are encrypted. Other host and meeting metadata, and copies of links in messages, are not encrypted by this mechanism.

Disconnecting and deletion: disconnecting Zoom in ActionNudge clears the connection's stored OAuth access and refresh tokens and invalidates pending authorizations. It does not delete the retained host profile, meeting records or links already copied into drafts and messages, cancel existing Zoom meetings, or remove the app from your Zoom account. Remove ActionNudge in the Zoom App Marketplace to revoke the provider authorization. Removal in Zoom does not currently trigger automatic deletion of ActionNudge records.

Retained records follow the retention and deletion practices below. To request access, correction or deletion of Zoom-related records, email support@actionnudge.com with your ActionNudge account email and workspace, but no passwords or tokens. We verify your authority and explain any applicable retention limits. Copies held by Zoom or email recipients are governed by their own processes.

06Who can receive information

Workspace information is accessible to authorized members according to their roles. ActionNudge personnel may access information needed for support, administration, billing or security within their permissions; the additional Google message restrictions above still apply.

Service providers may process information on our behalf for hosting, infrastructure, email delivery and, when activated, AI processing. Google Workspace may deliver our account emails. PayPal and Stripe receive the details needed for authorized hosted checkout and subscription administration when those services are activated. Connected providers also process data under their own account relationships and privacy policies.

We do not sell personal information or use connected inbox content for targeted advertising. We may disclose information where legally required or necessary to protect rights and security. A business transfer would be subject to applicable notice, confidentiality and consent requirements; Google data remains subject to its Limited Use restrictions.

Depending on the provider and service configuration, information may be processed outside your province, state or country and may be subject to the laws of that location. We do not represent that all information stays in Canada. Contact us about current processing locations and providers before submitting data with residency requirements.

07Cookies and approximate location

The member and admin applications use essential session cookies for sign-in. A short-lived preference cookie can preserve a selected signup plan; it does not authorize payment. Blocking essential cookies can prevent sign-in or interrupt the signup flow. The current website does not use advertising cookies or third-party advertising pixels.

To display CAD for visitors in Canada and USD elsewhere, the website may look up your IP address in a country database stored on our server. This lookup does not send your IP address to a geolocation service, and the pricing feature does not save the address. Ordinary server access and security logs may still contain IP addresses.

The location estimate is approximate, not precise device location, and can be affected by a VPN or network routing. Your confirmed billing country and authorized checkout currency determine billing. We will update this policy and obtain consent where required before introducing non-essential tracking.

08Retention and deletion

Retention depends on the record and its purpose, including operating your workspace, fulfilling support requests, maintaining financial records, investigating security issues and meeting legal obligations. We do not apply a single automatic deletion period to every record.

Canceling a subscription does not itself delete the workspace, and revoking an integration does not itself delete imported records. To request account closure or deletion, contact support@actionnudge.com. We review the request, verify authority and explain any records that must be retained or cannot immediately be removed. Retained legal, accounting or security records are restricted to those purposes.

Removal from active systems may not immediately remove copies held in backups or by a connected provider. Those copies are subject to their applicable retention and deletion processes. Ask about retention requirements before importing information that needs a specific deletion deadline.

09Safeguards

Safeguards include HTTPS for public services, hashed account passwords, role-based access, workspace scoping and audit records. Integration secrets and queued transactional email payloads use application-level encryption. These measures do not mean every business record is end-to-end encrypted or that a formal compliance certification has been obtained.

No system can guarantee absolute security. Protect your account and report suspected unauthorized access promptly. We will assess privacy incidents and provide notifications where applicable law requires them. See our Security page for more about the current approach.

10Your choices and privacy requests

Depending on applicable law, you may have rights to access or correct personal information, request deletion or a copy, withdraw consent, or object to or restrict certain processing. You can manage available notification preferences and revoke connected account permissions. Withdrawing access needed for a feature may prevent that feature from working.

Email support@actionnudge.com with the subject "Privacy request," your account email, the relevant workspace and the request. Do not include passwords, authentication codes or full payment details. We may ask for information necessary to verify your identity or authority, and will respond within the period required by applicable law.

If a workspace customer controls the records, we may need to coordinate with that organization. You may also raise concerns with the privacy regulator responsible for your location; contacting us first does not waive that right.

11Policy updates and contact

We will update the effective date when this policy changes. For material changes, we will provide notice through the service or appropriate account communications and seek consent where required before a new use of information.

For privacy questions or complaints, contact ActionNudge at support@actionnudge.com, with "Privacy" in the subject line.