NudgeNow

Privacy Policy

Effective and last updated: August 27, 2026

NudgeNow ("the Service", "we", "us") is a funnel and client-management system for client-facing professionals in the Philippines — financial advisors and real estate agents. This policy explains how we handle personal information under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC").

1. Who is responsible

The Service is operated by VILLACRUSISLABS SOFTWARE DEVELOPMENT SERVICES (trading as “Villacrusis Labs”), a sole proprietorship registered with the Philippine Department of Trade and Industry under Business Name Reg. No. 8415621 and with the Bureau of Internal Revenue, with registered business address at Unit 11 Valen Court Townhomes, 4182 Ponte Street, Tejeros, 1204 Makati City, Metro Manila, Philippines, owned and operated by Harold Villacrusis (the "Provider"). For your account data, the Provider is the personal information controller (PIC) as defined in Section 3 of the DPA. Contact for all privacy matters, including data subject requests: hello@nudgenow.ph.

2. Two kinds of data — two roles

(a) Your account data. Information about you, the agent. We are the PIC for this data.

(b) Your clients' and leads' data. Information you enter about the people you serve — names, contact details, birthdays, budgets, dependents. Under the DPA, you are the personal information controller of this data, and we act as your personal information processor (PIP): we store and process it only on your instructions to provide the Service, and for no other purpose. You are responsible for having a lawful basis (such as your clients' consent or your legitimate interest as their agent) to record it.

3. What we collect

  • Sign-in identity — when you continue with Google or Facebook we receive your name, email address (if your account has one), and provider account identifier; we never see your Google or Facebook password. If you sign in with an email address and password, we store the address and a securely hashed password.
  • Profile details you provide — display name, agency, and an optional email address for your morning digest.
  • Data you enter about leads and clients — as described in Section 2(b).
  • Booking and viewing details — when a lead books a session or a property viewing through your pages: the chosen time, contact details they submit, and (for in-person meetings) the meetup place and instructions shown to them. Calendar-sync data is covered in Section 6-A.
  • Listings and inquiries — property listings a real estate agent publishes are public by design (that is their purpose); inquiries a visitor sends about a listing (name, contact details, message) are collected for that agent under Section 2(b).
  • Messenger conversations — if you connect a Facebook Page, messages between your Page and its visitors are processed on your behalf to draft and send replies, including by an AI provider acting as a processor. Covered by Section 2(b): you are the controller for your visitors' messages.
  • Payment records — when subscriptions are enabled, payments are processed by PayMongo Philippines, Inc. We receive confirmation of payment (amount, date, a payment reference) but never your banking or e-wallet credentials.
  • Technical logs — standard server logs (timestamps, IP address, errors) kept for security and troubleshooting.
  • Marketing analytics — on our own website and app (nudgenow.ph) we measure visits and signups as described in Section 10. This never includes the data you enter about your leads and clients.

4. Why we process it (lawful bases, DPA Sec. 12)

  • To provide the Service you signed up for (performance of a contract);
  • To secure accounts, prevent abuse, and keep records of payments (legitimate interest and legal obligations);
  • To investigate fraud and abuse reports — including reports about listings — we may preserve relevant records as evidence and disclose them to competent authorities on lawful request (legitimate interest and legal obligations);
  • To send you service messages such as the morning digest you opt into (consent — you can stop anytime);
  • To understand how people find NudgeNow and improve our own marketing (legitimate interest — Section 10).

We do not sell personal data, and your clients' and leads' data is never used for advertising or for anything except serving you.

5. Where your data is stored

Data is hosted on Supabase infrastructure located in Singapore (AWS ap-southeast-1). The DPA permits processing outside the Philippines provided we remain accountable for its protection (Sec. 21); our hosting providers are bound by their own data-processing agreements and industry-standard security certifications.

6. Who else touches the data

  • Supabase — database, authentication, and hosting.
  • Google / Meta — sign-in; they learn that you use NudgeNow when you authenticate. If you connect a Facebook Page, Meta also carries the Messenger conversations described in Section 3.
  • Resend — delivers the transactional emails the Service sends (booking confirmations, reminders, reports, follow-ups).
  • PayMongo — payment processing (when enabled), regulated by the Bangko Sentral ng Pilipinas.

We disclose personal data to no one else, except where required by Philippine law or lawful order of a competent authority.

6-A. Google Calendar data (optional feature)

If you choose to connect your Google Calendar, NudgeNow requests two permissions: calendar.events (create, update, and remove the client-meeting events that you book in NudgeNow on your own calendar) and calendar.freebusy (read only whether a time slot is busy or free, so booking pages offer accurate availability). We never read the contents, titles, guests, or details of your other calendar events — free/busy responses contain time ranges only.

NudgeNow stores the meeting events it creates, their Google event IDs, and an encrypted refresh token that lets it keep your calendar in sync. Disconnecting Google Calendar in Settings revokes the token and deletes it from our systems immediately; you can also revoke access anytime at myaccount.google.com/permissions.

NudgeNow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only to provide the calendar-sync features you see, is never sold, never used for advertising, and never read by humans except with your explicit consent for support, for security, or where the law requires it.

6-B. Zoom data (optional feature)

If you choose to connect your Zoom account, NudgeNow requests permission to read your basic profile (email address and plan type) and to create, update, and delete only the meetings NudgeNow books for you — client sessions and event rooms. We never read your other Zoom meetings, recordings, or contacts, and meetings NudgeNow creates are set to never auto-record.

NudgeNow stores your Zoom email, plan type, the IDs of the meetings it creates, and an encrypted token that keeps the connection alive. Disconnecting Zoom in Settings revokes the token and deletes it from our systems immediately; you can also remove NudgeNow anytime from your Zoom installed apps, which deauthorizes us automatically.

7. How long we keep it

  • Active and expired (read-only) accounts: retained so you never lose your pipeline.
  • Accounts inactive for more than 24 months may be deleted after 30 days' notice to your registered email.
  • On account deletion (Section 9): personal data is removed from live systems within 30 days and from backups within 90 days. Payment records may be retained longer where tax and accounting laws require it.

8. How we protect it (DPA Sec. 20)

We maintain organizational, physical, and technical safeguards: encryption in transit (TLS) and at rest, row-level security so each agent can only ever read their own records, least-privilege access keys, and no storage of card or e-wallet credentials. In the event of a personal data breach likely to cause serious harm, we will notify the NPC and affected users within 72 hours, as required by NPC Circular No. 16-03.

9. Your rights — and how to delete your data

Under Sections 16 and 18 of the DPA you have the rights to be informed, to access, to rectify, to erase or block, to object, to data portability, and to damages. To exercise any of them — including full deletion of your account and every record in it — email hello@nudgenow.ph from your registered email address with the subject "Data request". We act on verified requests within 30 days. If you believe your rights were violated, you may lodge a complaint with the National Privacy Commission (privacy.gov.ph).

Step-by-step instructions — including how to disconnect a connected Facebook Page — are at nudgenow.ph/data-deletion.

9-A. For people who used an agent's pages (leads and clients)

If you took an agent's Protection Check or Property Check, booked a session or viewing, or sent an inquiry on this platform, this section is for you. What you submit — your name, contact details, and the figures or messages you enter — is collected for and on behalf of the agent whose page you used. Under the Data Privacy Act, that agent is the personal information controller of your submission; NudgeNow processes and stores it on their behalf and uses it for nothing else.

  • Purpose: computing your report (Coverage Snapshot or Property Report), letting the agent prepare for and conduct your consultation or viewing, and (if you book) scheduling it — including a confirmation via the contact details you provide, and the meetup place for in-person meetings.
  • What the agent sees: your answers, your computed figures, your messages, and any "what I already have" figures you enter on a result page.
  • Your rights: you may ask the agent — or us athello@nudgenow.ph — to access, correct, or delete your submission at any time (DPA Secs. 16 & 18). Deletion requests are honored within 30 days.
  • No ads, no selling: your submission is never sold or shared beyond the agent you chose. If the agent runs Meta ads, standard Meta Pixel analytics may register your visit to the page (see Section 10).

10. Cookies, local storage, and analytics

We use your browser's local storage to keep you signed in and to remember workspace preferences. When you visit our website via a campaign link, we also note in your browser where that visit came from (for example, a campaign tag or the referring site) and, if you sign up, we store it with your account so we know which of our marketing efforts work.

On our own pages (nudgenow.ph) we use standard measurement tools that set cookies: Google Analytics, the Meta Pixel, the TikTok Pixel, and the LinkedIn Insight Tag. They help us count visits, measure signups, and reach interested visitors with ads on those platforms. Each provider processes this under its own privacy policy, and you can limit ad personalization in your Google, Facebook, TikTok, and LinkedIn account settings or by blocking cookies in your browser — the Service works fine either way.

An agent's public pages (their site, quiz, listings, and booking page) never run our measurement tools. If the agent connected their own Meta Pixel, it may register your visit — see Section 9-A.

11. Age

The Service is for working professionals — financial advisors and real estate agents — and is not directed at anyone under 18.

12. Changes

We will post any changes here and update the date above; material changes will be announced in the app. Continued use after the effective date constitutes acceptance.

See also our Terms of Service.