The protection of your personal data is a priority for NUDGETASK. This Privacy Policy details how we collect, use, and protect your information when using our SaaS platform, in accordance with the General Data Protection Regulation (GDPR).
1. Data Controller
The data controller is NUDGETASK SAS, registered with the RCS of Nanterre under number 999 629 850, with its registered office at 57 rue des Molières, 92000 NANTERRE.
We only collect data necessary for providing our services:
Identity data : Last name, first name, email address.
Professional data : Company name, role (optional).
Payment data : Credit card information (securely processed by our provider Stripe; NudgeTask does not store your bank details).
Usage data : IP address, browser type, connection logs, and, if you consent, limited audience measurement data collected through PostHog Cloud EU.
Marketing email preferences : Email address, consent choice, date, collection source, and version of the notice shown.
Service content : Tasks, projects, and prompts (requests) sent to the AI to generate content.
Connected social account data : When you connect Instagram, Facebook, Threads, or another social network, we store the account identifiers, usernames, profile images, OAuth access/refresh tokens, selected Pages, post drafts, scheduled posts, published post identifiers, media URLs, captions, comments configured for publishing, and analytics required to provide publishing and reporting features.
3. Purposes and Legal Bases
The processing of your data is based on the following legal grounds:
Contract execution : Account creation, subscription management, access to the NudgeTask service, and customer support.
Legitimate interest : Improving the platform's usability and securing the service.
Consent : Sending newsletters or using non-essential analytics cookies.
Cookies and audience measurement
NudgeTask uses PostHog Cloud EU for optional product analytics. PostHog is configured with the EU ingestion host, session recording and autocapture disabled. After consent, we collect page views, selected explicitly defined product events, application errors, and Web performance indicators.
Before you accept, PostHog capture and persistence are disabled by default. Rejecting or withdrawing your choice keeps PostHog analytics disabled and prevents non-essential PostHog cookies from being deposited or read.
If you accept, PostHog may process page views, route changes, referrers, feature-usage events, errors, Web Vitals, browser and device technical data, and pseudonymous user, organization, visitor, and session identifiers. We do not send your name or email address to PostHog, and this data is not resold for advertising.
4. Special Case: Artificial Intelligence
To operate the "Nudgy Power" features, some of your data (prompts) are transmitted to our AI providers (e.g., OpenAI, Anthropic, Google...).
Important: We use professional application programming interfaces (APIs). Your data is not used by these providers to train their general artificial intelligence models, unless you specifically agree.
5. Data Recipients
Your data is never sold. It is shared only with our essential subcontractors:
Hosting : Hetzner (Servers located in Germany).
Payment : Stripe (Transaction security).
AI Services : Language model (LLM) providers.
Audience measurement : PostHog Cloud EU, used only after consent for product analytics, error diagnostics, and performance, with EU ingestion.
Email delivery : Resend, used for transactional emails and, only after consent, marketing emails.
Social network APIs : Meta APIs for Instagram, Facebook, and Threads, and other connected social network APIs when you choose to publish, schedule, or retrieve analytics. Google/YouTube API data is handled according to this policy and the Google Privacy Policy.
6. Data Retention Period
Account data : Retained for the duration of your subscription. In case of cancellation, data is deleted after 12 months of inactivity, unless legally required otherwise.
Billing data : Retained for 10 years (French legal requirement).
Technical logs : Retained for 1 year.
Analytics cookies and identifiers : PostHog analytics cookies are limited to 365 days. Your consent choice can be changed at any time.
Marketing consent and suppression : The choice record is retained for as long as needed to manage it. After withdrawal or account deletion, a secured fingerprint of the email address is retained for at least 3 years solely to prevent accidental future solicitation.
Social integration data : Retained while the social account remains connected or while related scheduled/published posts must be operated, then deleted or anonymized after disconnection unless a legal obligation requires retention.
7. Your Rights
In accordance with the GDPR, you have the following rights:
Right of access and rectification : Modify your information at any time.
Right to erasure : Request the deletion of your account and data.
Right to portability : Retrieve your data in a structured format.
Right to object : Object to the use of your data for marketing purposes from NudgeTask preferences or the unsubscribe link included in every email.
If you believe your rights are not being respected, you can file a complaint with the CNIL (www.cnil.fr).
Social integrations and data deletion
Social integrations are optional. You can disconnect Instagram, Facebook, Threads, and other connected accounts from your NudgeTask settings at any time.
Disconnecting a social account removes the OAuth tokens and organization sharing links used by NudgeTask. You can also request deletion of your account and integration data by contacting [email protected].
For Meta deletion callbacks, this section is the public status page for confirming that deletion requests are processed for the relevant connected account.
8. Security
NudgeTask implements technical measures (SSL encryption, security protocols) and organizational measures to protect your data against unauthorized access, loss, or alteration.