Privacy Policy

Effective date: October 14, 2026

iNudge was named Sable Mako until September 2026. The operator, the service and these terms are unchanged by the rename.

1. Who we are

iNudge is an advertising management product operated by Champ X Digital FZ LLC, a company registered in the United Arab Emirates. This policy explains what we collect when you use iNudge, why we collect it, and the choices you have. Questions about anything here go to support@inudge.ai.

2. What we collect

Account identity. When you sign up, our sign-in provider gives us your name and email address so we can create and secure your account.
Platform credentials. When you connect an advertising, analytics, or commerce platform (Meta Ads, Google Ads, Google Analytics 4, Google Merchant Center, TikTok Ads, or Shopify), we store the OAuth access credentials that platform issues. Provider availability is narrower than this list of implemented paths. Google Search Console is collected the same way once connected. Credentials are stored encrypted at rest with AES-256-GCM.
Platform data. We fetch advertising, analytics, and commerce data from your connected platforms in two ways. First, on demand, to answer the requests you make in the product: campaigns, performance metrics, keywords, analytics summaries, product data, and order aggregates where the connected provider supports them. Second, on a daily schedule: when a brand has an eligible active connection and an active trial or paid plan, we run an automated monitoring audit of its ad performance, store the results, and email you an alert when something needs your attention. Scheduled work stops when that service entitlement ends. Included audit summaries may send relevant findings to Anthropic. Included creative checks may send selected existing static Meta ad images and their text. These calls have separate account limits, are paid by iNudge and use no customer credits. Other requested AI reports retain their separate usage agreement.
Conversations. Your chat conversations with the product’s assistant are stored so you can pick up where you left off and so the assistant has the context of your account.
WhatsApp, when enabled. We process your sender phone number, workspace link, messages, supported attachments and approval decisions, together with delivery and account-status metadata, to provide the same iNudge service in WhatsApp. Linking requires sign-in, brand consent and confirmation from the original sender. With optional voice-request consent for your current link, genuine voice notes are saved in your private creative library and transcribed on iNudge infrastructure. Recognized words are used as assistant requests without reviewing each transcript; recognition can make mistakes. Other files need file-import consent, and forwarded or reference audio still needs transcript review. Video frames are sampled on iNudge infrastructure. Original media is not sent to a speech API. Saved files follow the library’s retention and deletion controls. Ad changes still require separate approval, including provider transfer, publication and activation. Requested analysis and assistant requests may send selected document content, sampled frames and transcripts to Anthropic. Starting a new link, continuing another chat, or disconnecting clears voice-request consent. Where Business-app Coexistence synchronization is authorized, we also process its supported history, contacts and manual-reply events. Imported history and manual replies cannot authorize changes. Sending STOP or unlinking revokes workspace access through WhatsApp; it does not delete existing workspace records or disconnect your advertising accounts. Section 10 explains account deletion. WhatsApp and Meta also process data under their own applicable terms.

3. How we use it

We use your data to show you your own accounts, analyze their performance, and carry out changes you authorize. You can approve an exact change or separately permit supported fixes within saved limits for one account. Permission can be withdrawn in chat or Settings. New ads, activation, higher total spending and destination changes need your approval. We check the account before reporting a change as verified.

Advertising data serves you, the account owner. A separate, optional shared-learning program can use selected recommendation records and outcomes to improve recommendation ordering for comparable participating businesses, but only after our data-use review and your workspace owner’s explicit opt-in. Authorized independent reviewers may read selected recommendation text and outcome summaries. Declining does not remove ordinary service, and you can withdraw in Settings. Read the shared-learning disclosure for the exact data, human-review, retention and withdrawal boundaries. We do not sell personal data. We do not use platform data to train machine-learning models.

Which model we call, what reaches it, what never does, and the permission checks each account change passes through are described in full on our AI terms page.

4. Cookies

iNudge uses cookies only to operate the product: a session cookie from our sign-in provider (Clerk) that keeps you signed in, and short-lived, HTTP-only cookies that protect a platform connection while you approve it (these expire within minutes). We set no advertising trackers, no analytics cookies, and no session-recording tools. A cookie from inudge.ai exists to run the product, never to follow you around the web.

5. Google user data (Limited Use disclosure)

iNudge's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Below is every Google permission we request, what we do with it, and how long we keep what it returns. You grant these one platform at a time, and you can revoke any of them from your Google account or disconnect the account here. Disconnecting deletes our stored credential and stops new reads. Existing metrics, chat history and approval receipts stay in your workspace until you request full account deletion under section 10.

.../auth/adwords Google Ads. We read campaigns, ad groups, keywords, search terms, creatives and performance so the product can report on the account and audit it. Where enabled for your workspace and account, supported writes include status and budget changes, paused campaign and ad creation, campaign settings and targeting, keywords and negatives, ad-group structure, ad copy, assets, bidding controls, supported Performance Max and Shopping changes, exact-object removal and bounded bulk actions. Each write requires either your explicit approval of its exact proposal or a separate current account permission for a supported fix within saved limits; applicable destructive and bulk operations require a second confirmation. Creation does not activate delivery. Availability depends on current permissions, account settings, feature admission and provider validation.
.../auth/content Google Merchant Center, for the product feed behind your Shopping ads. We read your Merchant Center accounts so you can choose one, read that account’s data sources, and read your products with their status and item-level issues, so we can show you which products are disapproved and why. With your explicit approval per publish, we create a primary product data source and insert or delete product inputs, publishing a feed built from your own store catalog. Each publish is previewed for your approval, then verified by re-reading the API.
.../auth/analytics.readonly Google Analytics 4, read-only. Used to list your properties when you connect one. No write permission is requested.
.../auth/webmasters.readonly Google Search Console, read-only. We read the list of your verified sites, then search queries and pages with clicks and impressions, day by day. It cannot add a site or submit a sitemap. Google classes this scope as non-sensitive.
.../auth/userinfo.email Your email address, so the connected account can be labeled with the identity that granted it.

Why these and not narrower ones: Google publishes read-only variants for Analytics and Search Console, and we request those. Google Ads and Merchant Center do not offer read-only variants. .../auth/content is the only scope the Merchant API publishes, and it covers reading and writing together, so requesting it is the only way to read your product statuses at all. What bounds us there is the product rather than the permission: no feed is published until you approve that specific publish.

Storage and sharing. Data returned by these APIs is stored in our database, hosted where section 8 below says, and used only to serve you, the account owner. It is never used for advertising, never sold, and never used to train a general-purpose AI model. It is passed to the model provider listed in Subprocessors below only as context needed to answer your requests or produce the separately capped included audit summaries described in section 2. Disconnecting deletes the credential and stops new reads; imported history remains until full account deletion under section 10.

6. Meta platform data

Data we receive from Meta’s APIs is used solely to provide the service to you, the account owner, including the scheduled monitoring described in section 2. We retain it in your workspace until you request deletion, as described in section 10.

7. Subprocessors

We rely on a small set of service providers to run iNudge, and each one receives only what its function requires:

Vercel hosts the application.
Neon provides the database.
Clerk handles authentication.
Anthropic provides AI processing of your conversations and of the data you ask the assistant to analyze.
Resend delivers alert and notification emails; it receives your email address and the content of each alert we send you.
Stripe processes payments; it receives your email address and your billing and card details, which it holds. We never see or store your card number.
Better Stack monitors our public health endpoint and delivers operational incident emails. It also receives privacy-filtered operational events from our production runtime. Before storage, an allow-list removes ordinary request metadata, identifiers, message content, URLs and stack traces. Better Stack receives the public health response and timing, our operations contact, and the remaining identifier-free event type, status and bounded diagnostic fields; it receives no platform credentials, chat text, ad or store content, or customer account identifiers.

8. Where your data lives

iNudge runs on infrastructure in the United States: the application is hosted on Vercel and the database on Neon (AWS, US East). Whichever country you use the product from, your data is processed and stored there, and it always travels over TLS-encrypted connections.

9. International transfers

If you are in the European Economic Area, the United Kingdom or Switzerland, using iNudge means your personal data is transferred to the United States, which those jurisdictions do not treat as offering equivalent protection by default. We rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) as the transfer mechanism, together with the UK International Data Transfer Addendum for UK data and the Swiss addendum for Swiss data.

Every processor we hand data to is bound by the same clauses through its own data-processing agreement with us: Vercel, Neon, Clerk, Stripe, Anthropic, Resend and Better Stack. That is the same list as section 7, and we do not transfer your personal data to anyone outside it.

iNudge is operated by Champ X Digital FZ LLC in the United Arab Emirates, so our own staff access your data from there as well as from the United States infrastructure it is stored on. That access happens under our own internal safeguards: it is limited to what operating the service requires, protected by the security measures in section 11, and treated under this policy exactly as if it took place inside the EEA. Standard Contractual Clauses are contracts between separate parties, so we do not claim them for our own staff; this paragraph is the safeguard we actually apply.

We will sign a data-processing agreement incorporating those clauses with any customer who needs one. It is published in full at inudge.ai/dpa, so you can read the roles, the annexes and the subprocessor list before you ask for it. Email support@inudge.ai and we will send it countersigned. You are entitled to a copy of the clauses we rely on, and asking for them costs you nothing and requires no justification.

10. Data retention and deletion

If you own an iNudge workspace, you can download a structured JSON copy of the account and workspace records associated with your login from Settings → Data & privacy. Provider credentials, invitation secrets, private storage links and payment-card details are not included. Uploaded creative files, large exports and member-specific requests are handled through support@inudge.ai.

Disconnecting a platform in the product immediately deletes the stored credential and stops iNudge from making new reads. It does not automatically delete metrics already imported, chat history, or approval and action receipts. Those records stay in the workspace so past recommendations and changes remain explainable.

A workspace owner can start full account deletion from Settings → Data & privacy. iNudge first shows the number of workspaces, brands, stored records, files, active subscriptions and pending invitations in scope. It requires the exact confirmation phrase, recounts the scope after installing a closure fence, and refuses self-service deletion if the workspace has another member, your login belongs to someone else’s workspace, a platform write is still finishing, or any data category cannot be verified safely.

For a confirmed self-service closure, iNudge cancels active subscriptions first, then removes stored creative files, live workspace records and the sign-in identity. Each completed step is recorded so a safe retry resumes instead of starting again. If a provider step fails, the closure pauses; if identity deletion needs manual follow-up, the erased account remains blocked from creating a replacement workspace. Shared workspaces, member-specific requests and unresolved failures are handled through support@inudge.ai. We complete account deletion and any necessary follow-up within 30 days of the request.

Account deletion does not issue a refund and cannot revoke the permission shown by an external platform. You can revoke iNudge’s access at any time from the platform side: Google Account permissions for Google products, your Meta Business integration settings for Meta, and the apps page of your Shopify admin for Shopify. Revoking there stops future access at the platform, but it does not erase data already stored in your iNudge workspace. Use full account deletion for that.

This section is our data-deletion instructions page for Meta platform review. A workspace owner can use the Settings control above to delete data iNudge received from Meta. If self-service deletion is blocked, send a deletion request from the address on the account to support@inudge.ai; we complete the deletion within 30 days.

A minimal closure record remains for no longer than 30 days after the request. It contains the sign-in identity, aggregate record counts, progress stage and timestamps. It holds no email, workspace or platform identifiers, credentials, metrics or message contents. This record prevents a delayed sign-in event from recreating the erased workspace and lets us verify unfinished cleanup. It is then deleted automatically. Stripe may retain billing records under its own legal and regulatory obligations; iNudge deletes its live workspace billing records.

Runtime logs, privacy-filtered operational telemetry and automated database backups follow the retention settings of the providers named above. We keep no additional archive outside those providers. Account deletion removes the live database records, and backup copies leave the provider’s rolling history as that history expires.

11. Security

Platform credentials are encrypted at rest. All traffic to and from iNudge travels over TLS. Each brand’s data is isolated to its own tenant. Write actions against your ad accounts are gated behind the per-account write switch you control and either your exact approval or a separate current permission for supported fixes within saved account limits.

If a security incident affects your personal information, we will investigate, contain it, and notify you and the relevant authorities without undue delay, as applicable law requires.

12. Your rights

Depending on where you live, data-protection law gives you rights over your personal information: to access a copy of it, correct it, delete it, receive it in a portable form, restrict or object to some processing, and complain to your local supervisory authority. You hold those rights whatever this page says about them. What follows is how each one is actually answered here, because the honest answer differs by right.

Section 10 describes the owner-facing deletion control, its safety limits and the 30-day completion deadline. Complex deletion cases remain support-assisted rather than deleting data another person may own.

A workspace owner can download a machine-readable JSON copy fromSettings → Data & privacy. The file contains the account record and database records for organizations the login owns. Provider credentials, invitation authenticators, private storage locations and delete handles are excluded. Stored creative metadata is included; creative file bytes, browser bundles above 20 MiB, member-specific access, correction, restriction and objection requests remain operator-assisted. Email support@inudge.ai from the address on your account and we will reply within 30 days. For an assisted copy, the final format and delivery timeline are agreed with you in that exchange. The same boundaries appear in the retention clause of our Data Processing Addendum.

Withdrawing consent does not affect processing that happened lawfully before you withdrew it.

13. Children

iNudge is a business tool and is not directed at anyone under 18. We do not knowingly collect personal information from minors; if we learn that we hold any, we delete it.

14. Changes and contact

This policy is effective as of October 14, 2026 and was last updated on October 25, 2026. If we make material changes, we will announce them on this page. For any privacy question or request, contact support@inudge.ai.