Privacy policy

1. Who we are

Nudger is an invoice-reminder service for Australian sole traders and small teams. It watches your unpaid invoices and sends a reminder sequence on your behalf, stopping when the invoice is marked paid.

The operating entity is {{LEGAL_ENTITY}}, ABN {{ABN}}, of {{POSTAL_ADDRESS}}. Those are placeholders, not redactions. The entity isn't registered yet and we won't invent one on a privacy policy of all places.

For anything on this page — a question, an access request, a correction, a deletion, a complaint — email hello@nudger.com.au. That mailbox is the only contact channel we run. There's no phone line and no support desk.

2. What this policy covers

It covers the Nudger website, the signed-in app at /app, the reminder pipeline that sends messages on your behalf, and the optional email scanner.

It covers two groups of people, and they are in very different positions. There are account holders — you, if you signed up. And there are the people you invoice, who never signed up for anything and are in Nudger because you put them there. Section 3.2 and section 10.2 are written for them.

The Australian Privacy Principles

Nudger is aimed at Australian businesses, so this policy is written around the Australian Privacy Principles in the Privacy Act 1988 (Cth). Two caveats we'd rather state than let you assume:

• We claim no certification. There is no SOC 2, no ISO 27001, no penetration test and no external privacy assessment. Nobody has audited us.
• Whether the Act legally binds {{LEGAL_ENTITY}} depends on things like annual turnover that we can't assert here. We're following the APPs either way, because that's the standard our customers should expect.

3. What we collect

This section is written from the database, not from a template. If a field is stored, it's listed.

3.1 Your account and workspace

• Your email address. It's your login and it's unique across Nudger.
• Your password, as a hash. Stored as a scrypt hash with a salt unique to that password. We never store the plaintext and can't recover it. Minimum twelve characters, no silly composition rules.
• Your workspace name — usually a real trading name.
• A hash of your API key. The key itself is shown once at sign-up and never stored.
• Login sessions. A random token (the value of your session cookie), which user it belongs to, when it was created and when it expires. No IP address, user-agent, device fingerprint or location is recorded on that row.
• Your company profile, if you fill it in. Company name, an ABN, a phone number, a bookkeeping contact email and an owner contact email. If you're a sole trader, those are personal details about you. The ABN field is free text and is never checked against any registry.
• Your email sending settings, if you configure them. Mail server host and port, username, password, and the from-address and display name. Read section 11 before you enter that password.
• Brand-voice text you write for reminder drafting, up to 2,000 characters. Whatever you type goes to Anthropic — section 5.
• Webhook settings. The URL you want reminders posted to, and the shared secrets used to sign and verify those posts.
• Your email-scanning consent record — the moment you approved the scanning terms and which version you approved.

3.2 Your customers' data — the part that matters most

Worth reading twice. Nudger holds personal information about people who never signed up for it: the customers you invoice. They have no Nudger account, no login, no way to see what's held about them and no way to correct it themselves.

Here's what's held about each of them:

• Their email address. This is the single most sensitive routine field in the system.
• The invoice. Amount owed, currency, due date, the invoice number or provider id, a link to view or pay it, and its status — open, paid, void, or written off as uncollectible.
• Every reminder sent to them, in full. Not a summary — the address it went to, the subject line and the complete body of the message, kept on the record after delivery.
• The chase history. Which escalation step fired and on what date, from the first friendly nudge through to a final notice.
• Delivery telemetry. How many attempts were made, when it was delivered, and the last failure message — which can contain a mail server's error text or a short snippet of a receiving server's response.
• Anything the scanner extracted about them, if you use it — name, email, amount, due date, plus the model's own free-text reasoning. That output is a machine's guess and can be wrong.

That information reaches Nudger three ways: from an invoicing provider you've connected, from an email you forward to the scanner, or from a correction you type in the review queue. There's no route for a customer of yours to put their own details in, and no route for them to take them out.

In plain terms: you decided to collect it. We hold and process it for you. If someone you invoice contacts us about their own information, we'll act on it — see section 10.2.

3.3 Email you forward to the scanner

The scanner is off until you switch it on. You approve a specific version of the scanning terms first, and we record the moment you did and which version it was.

Once it's on, your workspace gets a unique forwarding address. Anything you forward there is stored like this:

• The complete message. Sender address, subject, arrival time, and the full plain-text and HTML body. Not a preview — the whole thing, whatever it contains.
• The raw bytes of PDF attachments, up to 5 MB each, stored in our database. A supplier invoice PDF usually carries names, postal addresses, ABNs, line items and bank details. All of that is stored.
• Whether the sender was one of yours — we check the from-address against your workspace's logins, your bookkeeping contact and your owner contact, and store the answer.

Two things about that which aren't obvious from using the product. First, our inbound mail provider is Resend: it receives the mail as the mail host, tells us it arrived, and we then fetch the body and the attachments back from its API. Second, the dashboard only ever shows you a 500-character preview and never shows attachment bytes back to you at all — but they're still sitting in the database.

Mail that arrives without a current consent is recorded so you can see it arrived, and marked discarded. Attachment bytes are dropped. It's never scanned and never sent to Anthropic. Being straight with you: the code drops the attachment bytes but writes the subject and any inline body text onto that record regardless of consent. In practice the arrival notification we receive usually carries no body, so those fields are normally empty — but we're not going to tell you "nothing is stored without consent" when the code doesn't strictly guarantee it. It's on the list to fix.

Withdrawing consent stops future scanning immediately. It does not delete anything already stored.

3.4 What we don't collect

• No analytics, no tracking. There is no Google Analytics, no tag manager, no Meta pixel, no Segment, no PostHog, no Sentry, no Hotjar, no session recording. Not on the marketing site, not in the app.
• No card details, ever. Paid plans aren't purchasable yet — there's nowhere to enter them. See section 7.3.
• Google sign-in is optional. When an operator configures GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET, Continue with Google uses OpenID Connect and creates the same httpOnly session as email login. Until then the button redirects back with an honest error. We receive your Google email and subject id only — not your Google password or Drive data.
• Nothing in your browser's storage. Nudger writes nothing to localStorage or sessionStorage.
• We don't sell, rent or trade personal information. There is no advertising business here to sell it to.

3.5 Server logs

Our server writes a log line for every request. That line includes your IP address and port, the request method, the URL and the hostname. It isn't stored in the database — it goes to our host's log stream.

Redaction is narrow. It strips the authorization header and three password-style fields, and nothing else, which means a customer's email address can appear in a log line. Rate limiting also keeps a per-IP counter in memory on the public webhook and OAuth callback routes.

So the accurate statement is: we don't store your IP address in our database, but our server logs record it. We haven't set a log-retention window — {{LOG_RETENTION_PERIOD}}.

4. What we do with it

We use what we collect to run the thing you signed up for: keeping your account working, deciding which invoices are overdue, drafting and sending reminders, showing you a dashboard, keeping a record of what was sent to whom, and keeping the service up.

That's the whole list. We don't use your data, or your customers' data, for anything else without asking you first.

Specifically, we don't train models on it, we don't build a shared database of late payers, and nothing crosses between workspaces. Every query in the app is scoped to the workspace that made it.

5. Claude, and where your content goes

Nudger uses Claude, the AI model made by Anthropic, in two places. Both are switched on in production today.

Drafting a reminder

When you ask Nudger to draft a reminder, we send Anthropic the invoice number, the amount and currency, how many days overdue it is, the due date, your customer's email address, the tone you picked, and your brand-voice text.

Reading a forwarded email

If email scanning is on, we send Anthropic the sender's address, the subject line, up to 50,000 characters of the message body, and the complete contents of every PDF attachment. Whatever is in that PDF — names, postal addresses, ABNs, line items, bank and BSB details — goes with it.

Anthropic processes this on its own infrastructure. We don't pin a processing region, so assume it happens outside Australia. What Anthropic does with what it receives is governed by Anthropic's own terms and privacy policy; if that matters to your business, read them.

Neither feature runs unless an Anthropic key is configured on the server. Both are configured today. If you don't want your invoices read by a model, don't turn on the scanner and don't use the draft button — the reminder pipeline itself runs on your own templates and doesn't touch Anthropic.

6. Payment reputation scores

Nudger shows you a payment score for each customer, keyed to their email address: a number out of 100, a rating out of five stars, and a plain label that ranges from "Excellent payer" to "High risk".

Three things about that are true and worth stating precisely.

• It isn't stored. The score is calculated when you open the page and thrown away. There's no score column in the database.
• It only uses your own history. It's computed from your workspace's own invoices and reminders. There is no cross-tenant data, no shared blacklist and no industry network. Nothing about your customers is visible to another Nudger workspace.
• The workspace benchmark is genuinely anonymous. It keeps star counts and rates only — no names, no addresses, no identifiers.

Nudger is not a credit reporting body, this is not a credit report, and none of it is shared with one. It's your own private view of your own customers, built from your own invoices.

7. Who else handles your data

7.1 The companies that actually touch it

These are live. Data really does flow to each of them.

• Hosting · Tokyo, Japan Fly.io

  Runs the application. Everything that passes through Nudger passes through here: sign-up details, session cookies, invoice records, customer email addresses and forwarded email content. Fly also holds our server logs, which include IP addresses.

• Database · Tokyo, Japan Supabase (Postgres, on AWS)

  Our only database. Every record described in section 3 is stored here and nowhere else — including forwarded email bodies and PDF attachment bytes.

• AI processing · United States company Anthropic

  Receives what's described in section 5: invoice details and your customer's email address when you draft a reminder; the full message and every PDF attachment when the scanner runs.

• Inbound email · United States company Resend

  The mail host for the scanner's forwarding address. Resend receives your forwarded mail in full — headers, sender, subject, body and attachments — and we fetch the body and attachments back from its API. If you never turn on scanning, no mail reaches Resend.

• Web fonts · United States company Google (Google Fonts)

  Every page on this site loads fonts from fonts.googleapis.com and fonts.gstatic.com. That request tells Google your IP address, your browser's user-agent and which page you were on. No Nudger data goes with it.

• Stylesheet · United States company Tailwind Labs CDN

  The signed-in dashboard loads its styling from cdn.tailwindcss.com. Same exposure as the fonts — your IP address, user-agent and referring page. No Nudger data goes with it.

We use each of these on their standard published terms. We have not negotiated or published a separate data processing agreement with any of them — {{DPA_STATUS}}.

7.2 Where reminders go, when you point them somewhere

Two delivery routes leave our systems entirely, and both are destinations you choose. They aren't our processors — they're your instructions.

Your own mail server. If you turn on email sending, the reminder goes out through the mail server you nominated, using the credentials you gave us. Nudger runs no mail server of its own. Your customer's email address, the subject and the full body pass through whichever provider you picked.

Your webhook URL. If you don't turn on email sending, each reminder is posted as signed JSON to the URL you configured. That payload contains your customer's email address, the invoice details, and the complete rendered message. It goes wherever you pointed it. We check the destination isn't a private or internal address and we don't follow redirects — past that, it's your call and your responsibility.

7.3 In the code, but switched off

You may see these names in the product or in our documentation. None of them receives your data today, and we're not going to list them as processors as though they did.

• Not in use Stripe — for our own billing

  We take no payments. Paid plans aren't purchasable — checkout returns an error because billing isn't configured on the server, and every sign-up lands on Free. No card details have ever reached Nudger. If that changes, Stripe would collect payment details on its own hosted page and we'd store only a customer id and a subscription id.

• Not in use Stripe — as an invoice source

  The code can receive invoice notifications from Stripe. Nothing is sent to Stripe on that path; signature checking happens locally with no network call. No Stripe account is connected to the deployed service today.

• Not in use Xero and QuickBooks

  Connectors exist in the code. Neither is configured on the deployed service — the connect routes don't respond. No accounting data has been pulled from either. If you ever connect one, we'd store the access tokens for your organisation, and those sit in plain database columns (section 11).

• Not a processor Svix

  You may see the name in our inbound webhook handling. It's a signature format we verify locally with no network call. No data is sent to Svix.

8. Where your data lives

All of it is in Tokyo, Japan.

That's worth saying plainly, because Nudger is sold to Australian businesses and you might reasonably have assumed Australian hosting. The application runs on Fly.io in its Tokyo region. The database is Supabase Postgres running on AWS in Tokyo. There is no Australian copy.

On top of that, Anthropic and Resend process on their own infrastructure. Both are United States companies and we pin no region for either, so assume processing in the United States or wherever else they operate.

Under Australian Privacy Principle 8, you should be told before your information is disclosed overseas. This section is that disclosure. Beyond relying on each provider's published terms, we have not taken separate steps to ensure those overseas recipients handle your information consistently with the APPs — {{APP8_MEASURES}}.

If your business needs Australian data residency, Nudger can't give you that today.

9. How long we keep it

Honestly: indefinitely, until someone deletes it by hand.

There is no automatic deletion in Nudger. No purge job, no retention window, no expiry, no anonymisation. What that means in practice:

• Invoices, including your customer's email address, stay after the invoice is paid, voided or written off.
• Reminder records, including the full text of every message sent, stay after delivery.
• Forwarded emails, their complete bodies and their PDF attachments stay after you approve or dismiss them in the review queue. Dismissing changes a status flag; it deletes nothing.
• Expired login sessions stop working the moment they expire, but the records stay.
• Records of provider notifications we've processed are never pruned.

We have not set a retention period — {{RETENTION_PERIOD}}. Until we do, treat everything above as kept until you ask us to delete it. Section 10 explains how.

APP 11.2 expects personal information to be destroyed or de-identified once it's no longer needed. We're not there yet, and saying so is more useful to you than inventing a schedule we don't run.

10. Access, correction and deletion

10.1 If you have a Nudger account

What you can do yourself, right now:

• See most of what's held about your workspace in the dashboard — invoices, reminders, the review queue.
• Correct your profile, your email settings, your brand voice and your escalation policy in Settings.
• Log out, which deletes that session on our server.
• Withdraw email-scanning consent, which stops future scanning. It deletes nothing already stored.

What you can't do yourself:

• Close or delete your account.
• Delete a single invoice, reminder, forwarded email or attachment.
• Export your data.

None of those exist as a button. There is no delete endpoint anywhere in Nudger. Deleting a workspace is a manual database operation an operator runs; it removes the workspace and everything attached to it — users, sessions, accounts, invoices, reminders, forwarded emails and attachment bytes.

To ask for access, correction, a copy of your data or deletion, email hello@nudger.com.au from the address on the account, so we know it's you. We haven't committed to a turnaround time — {{RESPONSE_TIME}}. For reference, the APPs generally expect an organisation covered by the Act to answer an access request within 30 days. If we refuse a request, we'll tell you why in writing.

10.2 If you received a reminder sent through Nudger

You may be reading this because a Nudger email landed in your inbox. This section is for you.

You never signed up for Nudger and you have no account here. That doesn't mean you have no rights.

What's held about you: your email address, the invoice details the business entered or imported, every reminder sent to you and when, and — if that business uses the scanner — whatever was read out of a forwarded invoice about you.

Who decided to collect it: the business that invoiced you. They chose to put your details into Nudger. Ask them first. They can see and change everything held about you, and they can stop the reminders immediately by marking the invoice paid or pausing the account.

If that doesn't work: email hello@nudger.com.au. We'll act on a request about your own information even though you're not a customer of ours. There is no self-service route for this — it's a person doing it by hand, so tell us the email address the reminder went to and roughly which business sent it.

What Nudger is not: we're not a debt collection agency, we're not a credit reporting body, and nothing here is a credit report or is shared with one. Any payment score a business sees about you exists only inside that one business's workspace, calculated from their own invoices, and is never shared with another business.

11. Security — what's true, and what we're not claiming

Here's what's actually in the code:

• Passwords are stored as scrypt hashes with a per-password salt. Verification is constant-time. The plaintext is never stored and can't be recovered.
• The session cookie is httpOnly, so a script on the page can't read it, and sameSite=lax. It expires after 30 days, and it's marked secure in production so it only travels over HTTPS.
• Your workspace API key is stored only as a hash. The key is shown once at sign-up and never again.
• Traffic to the site runs over HTTPS.
• Where Nudger connects outward — to your mail server or your webhook URL — private, loopback and internal addresses are refused, redirects aren't followed, and mail connections are restricted to the standard SMTP ports.
• Email scanning is gated on your consent, and the gate is versioned: if we change the scanning terms, your old consent stops counting and scanning halts until you approve the new version. That's enforced in the code, not just promised on this page.
• Public webhook and OAuth callback routes are rate limited.

And here's what isn't true, which we'd rather say than let you assume:

• There is no application-level encryption in Nudger. Your mail server password, any accounting-provider tokens, and your per-account webhook secrets are stored in plain database columns. Whatever encryption exists is whatever our database host applies to its disks — it isn't something Nudger enforces. If your SMTP password protects anything else, use one that doesn't.
• We hold no security certification. No SOC 2, no ISO 27001, no penetration test, no external audit.
• Log redaction is narrow. It covers the authorization header and three password-style fields. Customer email addresses can appear in a log line.
• There's no security monitoring beyond ordinary server logs, and no on-call roster.

No system is un-hackable, and a young one run by a small team least of all. Weigh that against what you're putting in.

12. Cookies and third-party requests

Nudger sets one cookie: nudger_session. It holds a random token and nothing else — no name, no email, no tracking id. It's how the server knows you're signed in. It's httpOnly, sameSite=lax, and lasts 30 days or until you log out.

That's the only cookie. It's strictly necessary — without it you can't stay signed in — so there's no consent banner, because there's nothing optional to consent to. There are no analytics cookies and no advertising cookies, because there's no analytics and no advertising.

Two requests do go to other companies when a page loads. Google Fonts, on every page of this site. And the Tailwind CDN, on the signed-in dashboard. Neither carries any Nudger data, but both reveal your IP address and browser user-agent to those hosts. We'd rather self-host both and haven't yet.

13. Data breaches

If we become aware of unauthorised access to or disclosure of personal information that's likely to result in serious harm, we'll notify the people affected and, where the Notifiable Data Breaches scheme applies to us, the Office of the Australian Information Commissioner.

We have not set a response-time commitment, and there's no incident-response contract behind this — {{BREACH_NOTIFICATION_TARGET}}. If you're evaluating Nudger for anything sensitive, weigh that alongside section 11.

14. Complaints

If you think we've mishandled personal information — yours or someone else's — email hello@nudger.com.au and say what happened. Put "Privacy" in the subject line so it isn't missed.

We'll acknowledge it and tell you what we're doing about it. We haven't set a formal timeframe — {{RESPONSE_TIME}}.

If you're not satisfied with how we handle it, you can escalate. The Office of the Australian Information Commissioner (OAIC) is Australia's independent privacy regulator and it accepts privacy complaints from the public at oaic.gov.au. You'll generally need to complain to us first and give us a reasonable chance to respond before the OAIC will take it on. Nothing on this page limits your right to go to them.

15. Changes to this policy

If we change this policy we'll change the date at the top of the page. If a change materially affects what happens to your data — a new processor, a new purpose, data moving somewhere new — we'll email account holders before it takes effect.

Email scanning works differently, and better. Your consent is tied to a specific version of the scanning terms. If we change those terms, your existing consent stops counting and scanning stops until you approve the new version. That's enforced by the software, not by a promise on this page.

Last updated 7 August 2026. This document is a draft, written from an audit of what the software does, and has not been reviewed by an Australian privacy lawyer. Every bracketed token above marks something genuinely unresolved rather than something withheld.