NudgePrivacy policy
Last updated: 21 October 2026
Nudge is a follow-up automation tool for sales teams, operated by Autotakt. This page explains what data flows through Nudge, why, and what we do and don't do with it. We've tried to write it the way we'd want to read it.
The short version
- Nudge processes your leads' contact data on your behalf: you stay the owner of that data.
- This website sets no cookies and runs no analytics or trackers.
- We never sell data, to anyone, for any reason.
- Google account data is used only to sign you in and to book meetings on a Google Calendar you connect, under Google's Limited Use rules.
- Each client runs on their own isolated instance. No client's data shares a database with another's, with one exception: the encrypted Google calendar tokens of a workspace that connects through Nudge's central service (see Google account data).
Who we are
Nudge is built and operated by Autotakt, an automation agency (autotakt.dev). For anything in this policy, contact us at gezmakan@gmail.com.
Data we process for our clients
Nudge connects to a client's CRM (HubSpot) and automates follow-up with their leads. In doing so, it processes:
- Lead contact data: names, phone numbers, email addresses and pipeline fields, pulled from the client's own HubSpot account.
- Communication history: the WhatsApp messages, emails and call outcomes Nudge sends or records for those leads, including AI call summaries.
- User accounts: the name, email address and profile photo of the client's team members who sign in (via Google sign-in).
- Meetings: meetings booked through a Google Calendar the client connects, with their time, host, invitees and whether each invitee accepted. See Google account data.
For this data, the client is the data controller and Autotakt is a processor: we handle it only to run the service the client configured, and on their instructions. Leads who want their data corrected or removed should contact the business that holds their record, or reach us and we'll route the request there.
Google account data
Nudge uses Google account data for two things: signing in, and booking meetings on a Google Calendar. It asks for nothing else. Nudge does not request access to Gmail, Drive, Contacts or any other Google service.
Signing in
Team members sign in to Nudge with Google. We receive your name, email address and profile photo, and use them to create your account and show your teammates who you are.
Google Calendar (meeting booking)
A workspace admin can connect a Google account as a booking account, under Meetings → Calendar settings → Connect Google account. Nudge books meetings with leads through it. A workspace can connect more than one; each meeting type books through the default account unless the admin picks another. Google's consent screen asks the person connecting for two permissions:
- View your availability in your calendars (
calendar.freebusy). Nudge asks Google when the connected account is busy, so it only offers times when the host is free. Google answers with busy time ranges and nothing else: no event titles, descriptions, attendees or locations. Nudge reads this when it needs to find a time and does not store it. - See, create, change, and delete events on Google calendars you own (
calendar.events.owned). When someone books a meeting, Nudge creates the event on the booking account's own calendar and invites the host and the lead; Google sends the invitations. When someone moves or cancels the meeting in Nudge, Nudge updates or deletes that event. Nudge also reads the booking calendar's events to see whether invitees accepted and whether a meeting was moved or deleted in Google Calendar. Events Nudge did not create are skipped and never stored. Nudge cannot change events on calendars the account doesn't own.
We also receive the connected account's email address, so the settings page can show which account is connected.
A team member can also connect their own Google calendar from their page in Nudge, asking only to view their availability (calendar.freebusy), so Nudge can see when they are busy without them sharing their calendar with the booking account; Nudge never sees their events' details or creates or changes anything on that calendar, and they can disconnect it from the same page.
What we store. The connected account's email address, the tokens Google issues for it (encrypted, never sent to the browser), and for each meeting Nudge booked: Google's event ID, the event link, the Google Meet link if there is one, the start and end time, and each invitee's answer. We do not store busy times or any other event on the calendar.
Where the tokens are kept. In most workspaces, inside that client's own Nudge instance. A workspace can instead connect Google through Nudge's central service, which we run and which is separate from the workspace. For those workspaces the tokens, the connected account's email address and the permissions it granted are stored, encrypted, in the central service and never in the workspace. The workspace can ask the service for busy times and for the meetings Nudge booked, and nothing else from a calendar leaves it. A team member's own calendar is deleted from the service the moment they disconnect it; a booking account's tokens follow the rules under Removing access below.
Who sees it. The client's own team sees the meetings and their status inside Nudge. No Google user data is sent to any AI provider. Google's busy times stay inside Nudge, which uses them only to cross busy hours off the times it offers. If the client lets its AI phone or WhatsApp assistant book meetings, the assistant asks Nudge for open times and gets Nudge's own booking options (say, Tuesday at 10:00 or 14:30). It never sees calendar events, busy times or any other calendar data. To create an invitation, Nudge sends Google the meeting's title and description and the host's and lead's email addresses.
What we never do. We don't sell Google user data, use it for advertising, or share it with anyone beyond what the booking feature above needs. We don't use it to develop, improve or train generalized AI or machine-learning models. Nobody at Autotakt reads it unless the client asks us to for support, we need to for security, or the law requires it.
Limited Use. Nudge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Removing access. An admin can press Disconnect under Meetings → Calendar settings at any time, and Nudge stops booking through that account. Nudge keeps its encrypted token only so meetings it already booked can still be moved or cancelled. To cut Nudge off completely, remove it from the Google account's third-party connections; from then on Nudge can't read or change anything in that calendar. To have the stored tokens and meeting records deleted, email us and we'll delete them within 30 days. When a client leaves, all of it is deleted with their instance, and whatever the central service holds for that client is deleted with it.
This website
autonudge.dev is a static page. It sets no cookies, runs no analytics and does no fingerprinting. Our hosting provider (Vercel) keeps standard server logs (IP address, request time) for security and operations. The contact form is a Nudge form, loaded from Autotakt's own workspace at takt.nudgecrm.dev: what you send through it lands there as a contact, so we can get back to you. It sets no cookies either.
Subprocessors
Nudge runs on a small set of infrastructure providers, each used for one job:
- Convex: application database and backend
- Vercel: web hosting
- Google: sign-in, and Google Calendar for meeting booking
- HubSpot: the client's own CRM, which Nudge reads from and writes to
- Retell: AI phone calls
- Anthropic and OpenAI: the AI models behind a client's WhatsApp assistant, used through their business APIs, whose terms bar them from training on what we send
- Resend: transactional email delivery
- WhatsApp: message delivery
Retention and deletion
Client data lives in that client's instance for as long as their account is active. When a client leaves, their instance, database included, is deleted on request, in full. There is no shared pool that fragments of their data linger in afterward, and anything the central service holds for them (see Google account data) is deleted at the same time.
Security
Data is encrypted in transit. Google calendar tokens are also encrypted at rest: with a key specific to each client's instance or, for a workspace that connects through Nudge's central service, with a key that service holds. The central service keeps each workspace's connections apart and answers a workspace only about its own. Each client's instance is physically separate infrastructure; isolation is structural, not a permissions flag. Access to production systems is limited to the people who operate the service.
Changes
If this policy changes in a way that matters, we'll update this page and the date at the top. We won't quietly weaken it.
Contact
Questions, requests, or something we should fix: gezmakan@gmail.com.