Privacy Policy

Proposed controlled-mode update — approval and effective date pending. Operated by 9th Level Software ("we", "us").

1. Who we are

NudgePay is an accounts-receivable collections tool that connects to your QuickBooks Online account to surface overdue invoices and help your team follow up. Questions: support@nudgepay-ar.app.

2. Data we access from QuickBooks Online

With your authorization we read invoices, customers, balances, and due dates. We use this data solely to display overdue invoices and manage collections on your behalf. We do not access QuickBooks data beyond what these features require.

3. QuickBooks authorization tokens

OAuth access and refresh tokens are encrypted at rest using AES-256 and are never exposed to your browser. When you disconnect QuickBooks, we revoke the tokens with Intuit and delete them from our systems.

4. Messaging data (SMS)

When you text a customer, we process the destination phone number, the message body, and Twilio delivery status. We send SMS only to customers with recorded consent, honor STOP/HELP opt-out keywords, and check current sending eligibility before submission.

5. Account data

We store your user email and team membership to authenticate you and control access to your organization's data.

6. Storage and security

All data is encrypted in transit and at rest. Row-level security isolates each organization's data so members of one organization cannot access another's.

4b. Messaging data (email)

When you email a customer, we process the destination address, subject, body, and delivery events through Resend. Inbound replies to a configured receiving mailbox are recorded in your workspace. We honor unsubscribe requests (CAN-SPAM / RFC 8058 one-click) and do not send collection email after a customer opts out.

7. Sub-processors

We rely on Intuit (QuickBooks Online), Twilio (SMS delivery), Resend (transactional email send and inbound receiving), Supabase (database and authentication), OpenAI (optional reviewed assistance), and Cloudflare (application hosting). Render may host a secondary Node runtime for staging.

7b. Reviewed assistance and pilot records

When assistance is enabled and requested, we send scoped account evidence, including invoice facts and relevant notes, promises and message history, to OpenAI to prepare suggestions. Payment links are removed from that evidence. Suggestions require human review; assistance does not send messages or confirm payments. Messaging providers receive the recipient and approved content needed to deliver a message.

The controlled pilot is designed to record review decisions, edits, optional self-reported review effort, send outcomes and operator-reported incidents. Reporting uses limited identifiers, times, counts and status codes rather than copying message bodies, generated prose, recipients or payment links. These records support review and operations; they do not establish model accuracy, time saved or confirmed payment.

8. Data retention and deletion

Expired OAuth states, notification logs older than 90 days, resolved sync errors older than 90 days, and unused invites that have expired are purged automatically. Invoices, customers, cases, and messages stay until an owner deletes the workspace or erases a customer. Assistance usage and extraction/reply review records expire within 30 days. Sequence step/proposal content and copied dispatch content expire after 90 days from their original capture or commitment, including while work is active or its outcome is unresolved. Freshly reviewed successor content has its own retention window; an older step does not extend that window. Proposed pilot review/reporting metadata has a 30-day assistance or 90-day sequence limit, shortened by the source record's expiry or redaction. Customer erasure removes linked assistance and reporting records and scrubs sequence content. Minimal send identity and outcome records can remain after content redaction to prevent duplicate submissions. Provider deletion is separate: supported deletion requests are queued, while unsupported deletion, pending requests and later-arriving provider identifiers require follow-up. Local erasure does not confirm that a provider has removed its copy; minimal provider references can remain while that deletion obligation is unresolved. Disconnecting QuickBooks revokes and deletes stored tokens. You can leave this workspace in Settings by typing your email or LEAVE. That removes your membership and signs you out. It does not delete the workspace or erase invoices, customers, or messages. If you are the last remaining member and QuickBooks is connected, we disconnect those tokens. The last owner cannot leave; they must transfer ownership or delete the workspace. Owners can download a JSON copy of workspace customers, invoices, cases, promises, and messages in Settings. Owners delete a workspace in Settings by typing its name; that revokes QuickBooks tokens, purges tenant data, and writes a deletion tombstone. Owners can erase a customer's stored name, phone, email, notes, and message bodies from the account page by typing the customer name. Invoices remain; QuickBooks is not deleted; later sync will not restore the erased fields. You can download a JSON copy of your NudgePay login, workspace memberships, and contact-log activity in Settings (or onboarding if you have no workspace). You can delete your NudgePay login in Settings, or on onboarding if you have no workspace, by typing your email or DELETE. That removes the Auth user and your memberships. Contact-log and message actor fields are cleared; remaining workspace invoices, customers, and messages stay unless an owner deleted the workspace. For other erasure requests, contact support@nudgepay-ar.app.

9. Payments and automated sequences

NudgePay does not process payments. QuickBooks or your payment provider handles actual payments, using an available native QuickBooks invoice link or an explicitly configured workspace payment-page fallback. We do not charge your customers. Delivery and customer payment claims do not settle invoices or change accounting records.

Opt-in controlled email and SMS sequences require current human approval of the exact recipient, content, selected invoices and payment instructions before every new send, with current eligibility and consent checks. Workspace feature settings, service admission for dispatch and emergency stop are separate controls. Stop prevents new sends that have not yet been committed for delivery; it cannot recall already committed or in-flight requests. An uncertain send stays frozen until its outcome is verified.

10. No sale of data

We do not sell your data or share it for advertising.

11. Governing law

This policy is governed by the laws of Florida.