Privacy Policy
This policy explains what personal data DM Nudge collects, why, and what rights you have. DM Nudge is run by Niclas Hilltorp, Sweden (“we”). Questions: niclas.hilltorp@gmail.com.
1. Two roles: your data and your leads’ data
For your own account (email, settings, billing) we are the data controller. For the leads you add (names, Instagram handles, goals, notes), you are the controller and we process that data on your behalf, only to run the service for you. Only add information you are allowed to keep, and keep notes about other people relevant and respectful.
2. What we collect
- Account: email address, sign-in records, and the settings you save (name, offer, writing samples for “my voice”, follow-up messages).
- Leads you add: name, Instagram handle, what they want help with, source, notes, follow-up status and history.
- Billing: handled by Stripe. We receive your subscription status and a customer ID. We never see or store your full card number.
- Technical: essential cookies that keep you signed in, and standard server logs (such as IP address and time of request) kept for security.
We do not use advertising or tracking cookies.
3. Why we use it (legal basis)
- To provide the service you signed up for: contract (GDPR art. 6.1.b).
- To send the daily reminder email, which you can turn off under “My voice”: contract.
- To keep the service secure and prevent abuse: legitimate interest (art. 6.1.f).
- To keep accounting records for payments: legal obligation (art. 6.1.c).
4. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU |
| Vercel | Hosting the app | EU / USA |
| Stripe | Payments | EU / USA |
| Anthropic | Writing messages when you tap “Write in my voice” | USA |
| Resend | Sending reminder emails | USA |
When you use the AI writer, the lead’s name, handle, goal and your notes, plus your writing samples, are sent to Anthropic to write the message. It is not used to train their models. Transfers outside the EU rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
5. How long we keep it
We keep your data while your account is open. If you ask us to delete your account, we delete your account and all leads within 30 days. Payment records are kept as long as Swedish accounting law requires (currently 7 years).
6. Your rights
You can ask to access, correct, export or delete your data, or object to how we use it. Email niclas.hilltorp@gmail.com and we answer within 30 days. If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.
If someone in your lead list asks you what data you hold about them, you can find it, edit it or delete it in the app. Contact us if you need help.
7. Security
Data is encrypted in transit. Each account can only see its own leads, enforced in the database itself.
8. Changes
If we change this policy in a way that matters, we tell you by email before it takes effect.