Legal
Privacy Policy
Last updated 31 August 2026
Nudgley handles two kinds of people's data: yours, and your clients'. This explains both, because the second one matters more than most privacy policies admit.
Who we are
Nudgley is operated by an individual based in Abu Dhabi, United Arab Emirates, who is the data controller for the purposes of this policy. For questions or requests about your data, email support@nudgley.io.
The controller's full legal name and contact details are available on request. Email support@nudgley.io and we will provide them, with no reason needed — including where you need them to exercise a data protection right or to make a complaint.
What we collect
About you, our customer
- Your name, business name and email address, given when you sign up.
- Your subscription status and plan. We store an identifier from our payment provider so we know your account is paid — we never see or store your card details.
- Basic operational records: when reminders were sent from your account, and whether they were delivered.
About your clients
When you record an invoice, you give us your client's name and email address, along with the invoice number, amount and due date. We use this for one purpose only: sending that client reminders about that invoice, on your behalf.
We also record whether each reminder was delivered, bounced or was marked as spam, so we can stop emailing an address that is not working or does not want to hear from us.
We do not build profiles of your clients, do not use their details for anything outside your account, and do not contact them for our own purposes.
Who is responsible for what
For your own account data, we are the controller. For your clients' data, you are the controller and we are your processor — we act on your instructions, which you give by recording an invoice. You are responsible for having a lawful basis to contact your client about that debt.
Why we are allowed to hold it
| Data | Purpose | Lawful basis |
|---|---|---|
| Your account details | Providing the service you signed up for | Performance of a contract |
| Your subscription status | Knowing whether your account is active | Performance of a contract |
| Your clients' details | Sending the reminders you asked for | Legitimate interests — recovering a genuine debt |
| Delivery and bounce records | Not emailing broken or unwilling addresses | Legitimate interests, and our own compliance |
Who else sees it
We do not sell data and we do not share it for advertising. We use these providers to run the service, and each sees only what it needs:
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Stores accounts and invoices, and runs the reminder automation | Your details and your clients' details |
| Resend | Sends the reminder emails | Client email addresses and message content |
| WeWeb | Provides the app you log in to | Your login and the data shown to you |
| Netlify | Hosts our public website and the reminder action pages | Standard web request logs |
| Creem | Sells and processes subscriptions as merchant of record | Your billing details — not shared with us |
We may also disclose data where the law genuinely requires it.
Where it is held
These providers store and process data on servers outside the United Arab Emirates, including in the United States and the European Union. Where data protected by UK or EU law is transferred, we rely on our providers' standard contractual clauses and equivalent safeguards.
How long we keep it
- Invoice and client records: for as long as you keep them in your account. Delete an invoice and its client details go with it.
- Your account: for as long as it is open. After you close it we keep the data for 30 days in case you come back, then delete it.
- Suppression records: we keep a minimal record of addresses that hard-bounced or complained even after deletion, because re-emailing them would harm both those people and our sending reputation.
- Billing records: held by Creem under their own retention rules, which may be longer for tax reasons.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. You can object to processing based on legitimate interests. Email support@nudgley.io and we will respond within 30 days.
If you are one of our customers' clients and received a reminder from Nudgley: the fastest route is to reply to the email, which reaches the person who is actually chasing the invoice. You can also contact us directly and we will pass your request to them and stop emailing you from our side. Because they control that data, decisions about deleting it are ultimately theirs.
If you are in the UK or EU and think we have handled your data badly, you may complain to your national data protection authority.
Cookies
Our public website sets no tracking or advertising cookies. The app you log into uses cookies that are strictly necessary to keep you signed in.
Security
Access to the systems above is restricted and protected by strong authentication. No service can promise perfect security, but if a breach affects your data we will tell you and, where required, the relevant authority.
Children
Nudgley is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect.
Any question about data, however small: support@nudgley.io.