Written from the software rather than from a template, so every category below is a thing that genuinely exists in the system. Last updated 30 September 2026.
For your account — your email, your billing details, your team — we decide what is collected and why. That makes us responsible for it directly.
For your contacts and their messages, we decide nothing. You chose to collect those people and you decide what to send them. We hold that data on your instructions and process it only to run the features you switch on. If one of your customers asks what you hold about them, or asks you to delete it, that request is yours to answer and we will do our part: write to us and we will put together everything we hold about that person, or remove them and the messages attached to them. Deleting your data sets out what you can remove yourself today and what still comes to us.
| What | Specifically | Why |
|---|---|---|
| Your account | Name, work email, a hashed password, your workspace name, and the roles of people you invite. | To give you an account and let your team sign in. |
| Your billing details | Registered business name, address, state, GSTIN if you have one, and the identifiers Razorpay gives us for your subscription and payments. | To charge you and issue a valid tax invoice. |
| Your contacts and their messages | The phone numbers, names and tags you import, plus every WhatsApp message sent or received through your number, in both directions. | This is the product. You are the one deciding to hold it; we hold it for you. |
| Your WhatsApp credentials | Your Meta app secret, access token and phone number ID — encrypted at rest and never shown again after you save them. | To send and receive on your number. We cannot read them back in plain text from the interface. |
| Your Instagram account and messages | Only if you connect an Instagram professional account: its account ID and username, an access token (encrypted at rest), the list of your own posts and reels, the Direct messages your customers send you and your replies, the names they show on Instagram, and comments on your own posts that match a keyword rule you set. | To show your Instagram conversations in NudgeBolt and send the replies you, your team or your assistant write. Never used for advertising and never sold. |
| Your knowledge base | Whatever you upload for the assistant to answer from — price lists, FAQs, brochures. | So the assistant answers from your words instead of guessing. |
| How the AI was used | Which feature ran, how many tokens it used and what it cost. For replies, also which passage of your knowledge base was used and whether the assistant refused. | To meter your plan honestly and to let you audit why the assistant said what it said. |
| Sign-in and audit records | Session records with IP address and browser, and an audit log of significant actions with who did them. | Security, and answering "who changed this" when someone asks. |
Named, because "trusted partners" is not a disclosure. These are the only companies that see any part of your data, and each sees only the part it needs.
| Who | What they do | Where |
|---|---|---|
| KnownHost | Hosts our servers and database, where all of the data on this page is stored. | United States |
| Meta (WhatsApp) | Delivers every message. Meta bills your own account directly at their rates — we never handle that money. | Per Meta’s own terms |
| Meta (Instagram) | Only if you connect Instagram: delivers Direct messages and comment replies for your connected account. | Per Meta’s own terms |
| Anthropic | Runs the AI that composes replies and drafts flows and templates. Sees the conversation and the knowledge-base passage needed to answer. | United States |
| Voyage AI | Indexes your knowledge base so the assistant can find the right passage, and searches it with the customer’s latest message. | United States |
| Razorpay | Takes your subscription payment. Card and UPI details go to them directly and never touch our servers. | India |
| Brevo | Sends transactional email — password resets, invitations, billing notices — and alerts to your team, which can include WhatsApp template names and account status notices. | European Union |
| Shopify | Only if you connect a store: sends us abandoned-cart and order events. | Per your own Shopify account |
We do not sell data, and we do not use your conversations or your knowledge base to train any AI model — ours or anyone else's.
Being precise here rather than saying "as long as necessary", which means nothing:
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to the address below and we answer.
For your own customers' data: some of it you remove yourself — a list, a lead source, a template, a connection — and the rest, including an individual contact and the message history attached to them, we delete on request. Deleting your data sets out every route, what actually goes, and how long it takes.
hello@nudgebolt.com reaches us for anything on this page. We answer privacy questions from customers and from their customers alike.
Tripping Vibe Digital Private Limited, B1, Sector-19, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India. GSTIN 09AAGCT9260N1ZK.