Privacy Policy

Last updated: 12 October 2026

Who we are, and who is responsible

Nudgely LLC provides a Shopify app that shows popups on merchants' online stores, collects contact details from shoppers who choose to give them, and sends text messages on the merchant's behalf.

This policy is for shoppers: people who use a Nudgely popup on a store, or who receive text messages sent through Nudgely.

When you give your details to a store using Nudgely, the store is responsible for that information, as its controller. Nudgely is a processor and a service provider, acting on the store's documented instructions. Contact the store you signed up with first. We help that store answer.

If you run a store that uses Nudgely, how we handle your own business details is set out in the Merchant Agreement.

What we collect about shoppers

Phone number and email address, when a shopper enters them in a popup or lead capture form on a merchant's store.
City, state or region, and country, together with the first name on the order. See the section below on where this comes from.
Time zone, taken from the shopper's browser and from the region on their address, so that messages arrive at a reasonable hour and within the quiet hours the law requires.
Consent records. When a shopper opts in we record the exact wording they were shown, the time, the page, and their IP address and browser user agent. This is evidence that consent was given and is required by telemarketing law.
Message records. What was sent, when, whether it was delivered, and any reply such as STOP or HELP.
Order information. When someone places an order at a store using Nudgely, Shopify sends us the order: its number, date, total, currency and status, and the products, quantities and prices in it. We treat this as personal information. Where an order can be matched to someone who signed up through the store's popup, for example by the discount code used, we link the two.
Popup interaction data, such as which popup was shown and whether it was completed.
Store domain, so that data is associated with the correct store.

Where location comes from, and what it is not

We use a shopper's city and state or region. We derive them from the shipping address the customer already gave the merchant when placing an order, or from the address saved on their customer account with that store if they already have one. We keep the city, state or region, and country, and nothing else from the address.

This is not GPS. It is not device location, and it is not precise location of any kind. We do not access location services, we do not track phones, and we do not use background location. We do not know a shopper's street-level position and we do not try to find it.

We use it for three things: to work out the right time zone so messages are not sent in the middle of the night, to look up the local weather forecast, and to choose a product to mention in a message where a merchant has switched weather messages on.

We do not sell location data and we do not share it with third parties for their own purposes.

How we use shopper data

To show popups and deliver the discount code a shopper has earned.
To send the text messages a merchant has asked us to send, which may include the discount code, a reminder about an unused code, and, where the merchant has turned it on, a message about a product chosen using the local weather forecast.
To time messages using the store's order history, for example a reorder reminder when a product usually runs out, and to show the store which orders followed a message.
To decide when a message may lawfully be sent, using quiet hours, state rules and federal holidays.
To honour opt-outs, keep a suppression list, and prove that consent existed.
To operate, secure and support the service, and to comply with law.

Message copy is drafted with the help of an AI model. The model receives the shop name, the product, the discount code and the weather signal. It does not receive the shopper's name, phone number, email address or address.

Data sharing

We do not sell personal information and we do not share it for cross-context behavioural advertising.

We use a small number of service providers to run the service. They act on our instructions, may use the data only to provide their service to us, and may not use it for their own purposes:

Twilio, to deliver text messages and to register merchants with carrier registries.
Supabase, for database hosting.
Render, for application hosting.
Anthropic, to draft message copy. Shopper contact details and addresses are not sent to it.
A weather data provider, which receives a city name only.

Data is shared with the merchant whose store collected it, because it is their data. If the store has connected its own email or text marketing tool to Nudgely, such as Klaviyo, Omnisend or Postscript, we pass the details you gave the popup to that tool on the store's behalf, because it is the store's own system. We may disclose information if the law requires it, and if Nudgely is ever sold or merged, data may transfer as part of that business, subject to this policy.

SMS and phone compliance

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Mobile numbers and opt-in records are used only to send the messages the shopper agreed to receive from the store they signed up with.

Phone numbers are collected only with express written consent, given through clear opt-in wording shown on the form before submission. Consent is never a condition of purchase.

Recipients can opt out at any time by replying STOP, and can reply HELP for help. We also honour CANCEL, END, QUIT, UNSUBSCRIBE, STOPALL, OPTOUT and REVOKE. Opting out is immediate and free. Message and data rates may apply, and message frequency varies.

Nudgely operates under the merchant's registered sender identity. The merchant is the sender of record and is responsible for the content they ask us to send.

How long we keep things

Subscriber records: for as long as the merchant uses the service, or until deletion is requested.
Consent records: the IP address and browser user agent are deleted after two years. The rest of the record is deleted after five years. The limitation period under the Telephone Consumer Protection Act is four years and runs from the message rather than the sign-up, so the evidence has to outlast the messaging, not the opt-in.
Message records: kept as proof of what was sent and under which consent. When someone asks for deletion these are anonymised rather than deleted: the link to the person and the message text are removed, and what remains is information about the shop rather than about a person.
Suppression records survive deletion, and this is deliberate. If someone has replied STOP we keep their phone number and the fact that they opted out, and erase everything else about them. If we deleted the record outright, the same number could be added again tomorrow and messaged, because a do-not-contact list works by matching the number. Deleting it would solve a privacy duty by creating a worse one. This is permitted where processing is necessary to comply with a legal obligation.
Order information: for as long as the store uses Nudgely. It is deleted when the store uninstalls.
When a merchant uninstalls: Shopify notifies us 48 hours later and we delete that store and all of its records.

Your rights

Depending on where you live you may have the right to know what we hold, to get a copy, to correct it, to delete it, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but the other rights apply.

Shoppers: contact the store you signed up with. They are responsible for your data and Shopify gives them a process for it. We answer their request within the time the law allows them, which is 30 days.

You can also write to us at the email address below, and we will pass your request to the store and help it answer.

Storage and security

Data is stored in Supabase, a hosted PostgreSQL service, and is encrypted at rest and in transit. Access is limited to those who need it to run the service. Data is stored and processed in the United States.

Children

Nudgely is not intended for children under 13 and we do not knowingly collect their information. If you believe a child has given us information, write to us and we will delete it.

Changes

If we change this policy we will update the date at the top. If the change is significant we will tell merchants through the app.

Contact

Questions about this policy, or to exercise a right: graham@nudgely.io. Nudgely LLC.