Privacy Policy

This Privacy Policy explains how FiveNudge ("we", "us"), a sole proprietorship owned and operated by Tirtha Ray in Kolkata, West Bengal, India, and operator of www.fivenudge.com and app.fivenudge.com (the "Service"), collects, uses and protects personal data. It applies to business owners who use the Service ("you") and to the customer contact data you add to it.

1. Data we collect

• Account data: you sign in with your Google account, so we receive your name, email address and profile picture from Google. We do not collect or store a password. You also give us your business name and a contact phone number.
• Business listing data: the Google Business Profile you choose (its Place ID and review link) and public details Google shows about it: name, address, city, opening hours, phone, website, photos, rating, review count and recent public reviews.
• Your customers' data (added by you): phone numbers and names, entered by hand, imported from a file, or sent by a billing/POS system you connect, so we can send review requests on your behalf.
• Messaging data: the message settings you configure, and for each message its type, time, delivery status (sent, delivered, read or failed) and any delivery error code from WhatsApp. We do not keep a copy of each message's text. We also record opt-out replies such as STOP (including Hindi equivalents). Other replies from your customers are not stored or forwarded to you.
• Review signals: to know when a customer has reviewed you, we read the display names of your recent Google reviewers and match them to your customer list, and we keep periodic snapshots of your rating and review count.
• Billing data: your plan, subscription and payment status, and the GST details we need to issue your GST invoices. Card and UPI payments are processed by Razorpay; we never see or store card numbers.
• Support data: messages you send through "Get help" or our contact form (name, phone, email address, business, city and what you write). Contact-form messages are emailed to our team and also stored in our database so we can follow up and keep track of enquiries.
• Technical and security data: delivery and error logs, records of administrative actions on accounts, and basic usage analytics on our website (see section 7).

2. How we use data

• To provide the Service: signing you in, sending your review requests, tracking each customer's sequence, and stopping it when they review or opt out.
• To show you your dashboard, reports, ratings and recent reviews, and to alert you on WhatsApp when a customer's review arrives (if you switch that on).
• To verify that you manage the business you connect, including a one-time code sent on WhatsApp to the phone number on the public listing.
• To bill you, provide invoices and offer support.
• To keep the Service safe: enforcing sending limits, monitoring the WhatsApp number's quality rating, preventing spam and abuse, and investigating faults.
• To understand usage in aggregate, such as how many businesses are in each city, and to improve the product.

What we never do: we never sell personal data. We never use your customers' numbers to market anything to them. We never message your customers except as part of the flows you set up. We never post, edit, reply to or delete anything on your Google profile.

3. Google APIs and the information we get from Google

FiveNudge uses Google services in three ways:

• Google Sign-In (OAuth): to sign you in. We receive your name, email address and profile picture.
• Google Business Profile API (optional permission): if you grant it when you sign up, we can list the business locations you manage so you can pick yours in one tap, confirm that you are an owner or manager of the listing you chose, and read the reviews on that listing so we can stop sending reminders once a customer has reviewed. This is read-only. We use the permission only for these purposes. The short-lived access token Google gives us is held in a temporary, secure cookie for up to an hour while you set up. If your listing is verified as yours, we store a refresh token so we can keep checking for new reviews, until you disconnect, withdraw access in your Google account, or delete your FiveNudge account.
• Google Places API: to look up public information about the listing you choose and to let you search for your business by name: its address, city, coordinates, hours, phone, website, photos, rating, review count and recent public reviews. We keep this data for up to a few hours to avoid repeated lookups, and store only your Place ID, city and the rating and review-count snapshots described above.

You can withdraw FiveNudge's access at any time at myaccount.google.com/permissions, or ask us to delete your data (section 10). Google's own handling of your data is covered by Google's Privacy Policy.

4. Meta and the WhatsApp Business Platform

FiveNudge sends messages through Meta's official WhatsApp Business Platform (Cloud API). All messages go out from FiveNudge's own verified WhatsApp Business number and name your business, so you do not connect your own number. This means:

• Your customers' phone numbers and the message content necessarily pass through WhatsApp's systems, governed by WhatsApp's Privacy Policy and Meta's terms.
• Meta tells us whether each message was sent, delivered, read or failed, and delivers opt-out replies (such as STOP) to us. We act on those and nothing else.
• We also use WhatsApp to send you, the business owner, review alerts and one-time verification codes, and to alert FiveNudge's team about service problems.
• Because all businesses share one number, a customer's STOP stops messages from every business on FiveNudge. We keep that record so the customer is never messaged again.

5. Your customers' data: your ownership, our role

For customer data you add, you are the data fiduciary (owner) and we act on your instructions as a processor. You are responsible for having a lawful basis (such as the customer's consent or an existing business relationship) to share those numbers with us. We process them solely to deliver your review-request flows. Customers imported from a file are never messaged until you start them.

6. Sharing with third parties

We share data only with providers needed to run the Service, and only as much as each needs:

• Google (sign-in, Business Profile API, Places API, and Analytics on our website).
• Meta (WhatsApp Business Platform) to deliver messages.
• Razorpay to process subscription payments.
• Supabase (database and authentication), Vercel (hosting) and Inngest (scheduling the timed steps of each flow), which store or process data on our behalf.
• Resend, which delivers the emails our website contact form sends us.
• Authorities, if required by law.

Some of these providers process data on servers outside India. We choose reputable providers and share only what is needed.

7. Cookies and analytics

Our marketing website (www.fivenudge.com) uses Google Analytics (gtag.js) to understand aggregate visitor behaviour: pages visited, approximate location and device type. This involves cookies and similar identifiers set by Google. You can block cookies in your browser or use Google's opt-out tools; the website works without them. The app uses only cookies needed to keep you signed in and, briefly during sign-up, to carry your Google connection from the sign-in step to the setup step.

Our own first-party analytics. To understand how people find and use FiveNudge, our website and sign-up pages also record a small set of events in our own database (not a third-party service): which pages were viewed, whether the pricing section was seen, which buttons were clicked, and how the visit started (the referring website's domain and any campaign tags in the link). We identify a browser only by a random ID stored in a cookie on fivenudge.com (fn_vid, kept for one year) and a visit by a second random ID (fn_sid, ending after 30 minutes without activity). We do not store your IP address, browser fingerprint, full web addresses, or any contact details in these records.

If you create a FiveNudge account from the same browser, we link that browser's random ID to your new account, so we can see which pages and campaigns lead to sign-ups and paid plans. We never link visits by IP address or by guessing. Sign-ups, setup progress, review requests sent and payments are recorded from our own systems and payment provider, not from your browser.

We keep these analytics records for up to 12 months (or a shorter period we set) and then delete them automatically. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is recorded. Where we ask for consent, nothing is recorded until you accept, and you can change your choice by clearing the fn_consent cookie. To have your analytics records deleted, email hello@fivenudge.com with the ID below (or the email address of your FiveNudge account).

Your analytics ID on this browser: none (nothing has been recorded)

8. Data retention and deletion

• Account and business data: kept while your account is active. When you delete your account in Settings, your business, customers and message history are removed from the live Service immediately, and any remaining copies, such as backups, are deleted within 30 days. We keep invoices and records we must keep under Indian tax law.
• Customer contact data and message logs: kept while your account is active so sequences work correctly; deleted on your request or with your account. Customers who opted out cannot be deleted from your list while your account is active, because that record is what keeps them from being messaged again.
• Support messages and security logs: kept as long as needed to resolve issues and protect the Service.

9. Security

We use industry-standard measures: encryption in transit, access controls that keep each business's data separate from others, encrypted storage of payment-provider credentials, restricted administrator access with a record of sensitive actions, and sign-in through Google rather than passwords we would have to store. No system is 100% secure, but we design the Service to hold the minimum data it needs.

10. Your rights

Under India's Digital Personal Data Protection Act, 2023 (and similar laws), you can ask us to access the personal data we hold about you, correct it, delete it, or explain how it is used, and you can withdraw consent, including Google access (section 3). Email hello@fivenudge.com and we will respond within 30 days. If your customers contact us directly about data you added, we will refer them to you and help you honour their request.

11. Children

The Service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

If we make material changes, we will notify you by email or in-app before they take effect. The "Last updated" date at the top always reflects the current version.

13. Contact

Privacy questions or requests: hello@fivenudge.com. It reaches a human, usually the founder. FiveNudge is a sole proprietorship of Tirtha Ray, Kolkata, West Bengal, India. See also our Terms of Service.

Grievance Officer

In line with India's Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:
Tirtha Ray, Founder, FiveNudge
Email: hello@fivenudge.com
Kolkata, West Bengal, India
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.