Privacy policy

• Most of the data we hold is not ours. When you book through an AskNudge form, the company that publishes that form decides everything; we merely process the data on its behalf.
• We do not sell anything, we do not use this data for our own prospecting, and we do not use it to train artificial intelligence models.
• Product analytics are never started without your agreement. Advertising tags, on the other hand, depend on a setting that belongs to each company — and that setting is off by default: section 5 says exactly what fires, and when.
• The database is hosted in the European Union. Several providers are American; section 7 names them one by one.
• To have your data deleted, write to the company you booked with, or to us at contact@asknudge.ai if you no longer remember which one. Section 11 says what deletion reaches, and what it does not.

This is the most important distinction in this document, because it determines who you should be writing to.

We never use a customer’s visitor data for our own purposes: no prospecting, no resale, no model training.

Here is what is collected, what it is used for and on what legal basis. Not every row applies to every form: each company chooses the questions it asks and the options it turns on.

What is done with this data

• Create and manage the meeting, cancel it or move it.
• Create the calendar event and the video call with the provider the company has connected (Google Calendar, Microsoft, Zoom). Zoom meetings created by AskNudge are configured without automatic recording.
• Send service emails: confirmation, reminders, follow-up after a missed meeting, recovery sequence if the form was left unfinished.
• Copy the contact and the meeting into the company’s CRM, if it has connected one. From then on, that data also lives with the company and follows its own policy.
• Report a conversion to its advertising accounts where it has configured them. Your email and phone number never leave in the clear towards those platforms: they are normalised and then turned into a cryptographic fingerprint (SHA-256) before being sent.
• Limit abuse, monitor technical errors and measure product usage.

Some forms offer a conversational assistant. It answers your questions and books the meeting for you. What you write to it is sent to Anthropic, which provides the language model, for as long as it takes to produce the reply.

The assistant draws on a knowledge base built from the customer company’s public website, read by a Cloudflare service when the company triggers that analysis. That knowledge base contains no visitor personal data.

Transcripts are not used to train models. Those that did not lead to a meeting are deleted automatically — see section 9.

This section is detailed because the honest answer depends on a setting that belongs to each customer company.

Analytics

Our product analytics tool (PostHog) is never started until you have given your agreement. This is not a switch flipped after the fact: without your agreement the script is not initialised at all, so no analytics cookie is set and no event is sent. It is only present on the public booking pages; the application itself contains none.

Advertising tags

They exist to tell the company’s ad platforms (Meta, Google, LinkedIn, TikTok, OpenAI) that a meeting has been booked. Two cases, depending on what the company has configured:

• It has turned the consent request on. No vendor script is loaded and no event is sent until you have given your agreement.
• It has not turned it on. This setting is off by default, so this is the case unless the organisation has deliberately changed it: the tags it has configured then load on page view. Configuring them and collecting consent are its responsibility, as the controller — if a cookie banner appears, it is the company’s own.

What the checkbox actually commits you to

When a form shows a consent checkbox, it covers the processing of your data by the company, not merely analytics. As a result, refusing it prevents the booking from being completed: you can read the page and talk to the assistant, but confirmation stays blocked until the box is ticked. We would rather write this down than let you believe it is a simple statistics toggle.

This consent is recorded as evidence: the wording that was shown to you, the date and your IP address. Your choice, on the other hand, is not remembered from one visit to the next — there is no consent cookie. It is held in memory for the length of the page view and is gone on reload, so you are asked again each time the form loads. The durable record is a row in the database attached to your contact, not something stored in your browser.

For users of the application, we process: identity and email address, password as a hash or external sign-in identifier, organisation and role, display preferences, access tokens for the services you connect (calendar, video conferencing, CRM, advertising platforms, telephony), billing and subscription data, audit logs of sensitive actions, technical logs and errors.

This data is used to run the service, to bill it, to secure it and to answer you when you write to us. Legal basis: performance of the contract between us, our accounting obligations, and our legitimate interest in securing and improving the product.

Access tokens for third-party services are used only for the actions you have asked for (read your availability, create an event, push a contact). You can revoke each connection from within the application and from the provider itself.

We sell no data. We entrust some of it to providers, strictly in order to run the service. Those marked “on activation” receive nothing until the customer company has configured them.

To which may be added, where relevant: the CRM the company has connected, and judicial or administrative authorities where a legal obligation requires it.

The database and the application processing are located in the European Union, as are error collection and analytics. Several of the providers listed above are, however, established in the United States.

Those transfers rely on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU–US Data Privacy Framework, together with technical measures: encryption in transit and at rest, separation by organisation, and minimisation of what is sent — the identifiers passed to advertising platforms, for example, are reduced to cryptographic fingerprints.

These durations are not intentions: they are the ones applied by the automatic purge that runs every night.

You have a right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time and to give directives about what happens to your data after your death.

How to exercise them

• You booked a meeting with a company: write to that company. It is the one that decides, and it has a command inside AskNudge that carries out the deletion. If you do not know who to write to, write to us and we will pass the request on.
• You have an AskNudge account: write to us directly.
• You simply want to stop receiving emails: the unsubscribe link at the bottom of every message is enough, and it takes effect immediately. Messages tied to a meeting already booked — confirmation, reminders — keep arriving.

By email: legal@asknudge.ai. By post: BeBranded, 34 avenue Chanzy, 93250 Villemomble, France.

No data protection officer has been appointed. Requests are handled by the publication director, Maxime Konzelmann, at legal@asknudge.ai.

We answer within one month. We may ask you for something that lets us verify your identity if the request leaves any doubt — only in that case, and that item is not retained.

A promise of total erasure would be false. Here is the truth, in both directions.

By default, only strictly necessary records are used. They do not ask for your agreement because, without them, the service does not work. Some are written under two names at once — nudge_ and pipecall_, the product’s former name. That is deliberate: a booking widget already embedded on a website keeps running the copy of our script it cached, and that older copy can only read the former name. Writing both is what stops a visitor who already dismissed or already booked from seeing the widget again. Both are dropped once those cached copies have expired.

There is no consent cookie and no language cookie: your consent choice lives in memory for the length of the page view, and the language you are reading is determined by the address of the page.

To remove these records, clear site data in your browser settings. You can also block them, at the cost of the convenience they provide: booking itself keeps working.

Traffic is encrypted in transit and data is encrypted at rest at our database host. Each organisation’s data is partitioned and access to it is filtered by rules enforced in the database itself, not only in the application. Sensitive actions are logged. Internal access is limited to the people who need it.

Our error-tracking tool is configured to receive no personal data: sensitive URL parameters, headers, cookies and request bodies are stripped before sending, and session video replay is deliberately absent — replaying those screens would amount to exporting their contents.

In the event of a data breach likely to create a risk to your rights, we inform our customer — the controller — without delay, so that it can make the notifications incumbent on it.

AskNudge is a professional tool. The service is not addressed to minors and we do not knowingly collect their data. If you believe a minor has sent us information, write to us: we will delete it.

This policy changes along with the product. The date of the last update appears at the top of the page. When a change materially alters the way data is processed, our customers are informed so that they can inform their own visitors.

Write to contact@asknudge.ai. The publisher’s full details appear in the legal notice.

If our answer does not satisfy you, you may refer the matter to the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.