NudgedeskPrivacy Policy
This policy explains how Ahvan Digital ("Nudgedesk", "we") handles data when you use the service. It applies alongside our Terms of Service.
1. Our role
For your account data (your login, business details) we are the controller. For your customers' conversation data that flows through the service, you are the controller/fiduciary and we act as your processor, handling that data only to provide the service on your instructions.
2. What we process
- Account data: your name, business name, email, and password (stored only as a secure hash).
- Connection data: tokens and identifiers for the Instagram/WhatsApp accounts you connect (stored encrypted).
- Conversation data: messages exchanged with your customers, their names/handles/phone numbers as provided by Meta, lead status, and notes, so the AI can reply and you can manage the conversation.
- Usage data: basic logs needed to run, secure, and debug the service.
3. Why we process it
To operate the service: receive your customers' messages, generate and send replies, capture and score leads, and show you your inbox and analytics. We do not sell your data or your customers' data.
4. Processors we use
- Meta (Instagram & WhatsApp) - the messaging platforms the data flows through.
- Our AI provider - to generate replies. We use providers under terms that prohibit training on your data and limit retention.
- Cloud hosting - to run the service, in India-region infrastructure where possible for data locality.
5. Where data is stored
We host in India-region infrastructure where possible. Some processors (such as Meta) may process data in other regions as part of their platforms.
6. Retention
We keep conversation and account data for as long as your account is active and as needed to provide the service, then delete or anonymise it within a reasonable period, unless a longer period is required by law.
7. Your rights & deletion
Under applicable law (including India's DPDP Act) you and your customers may have rights to access, correct, or delete personal data. To request access or deletion of your data, or on behalf of your customers, contact us at the address below and we will act within the timelines the law requires.
8. Security
Passwords are stored as salted hashes, access tokens are encrypted at rest, sessions use secure httpOnly cookies, and each business's data is isolated from every other business's. No system is perfectly secure, but we take reasonable measures to protect your data.
9. Your responsibilities
You are responsible for having your own privacy notice and lawful basis/consent for the customer data you collect through the service, and for any legally required disclosure that a customer is interacting with an automated service.
10. Grievance & contact
For any privacy question, request, or grievance, contact our grievance officer at hello@nudgedesk.io. We may update this policy and will note the version and effective date above.