GDPR / CCPA

How elNudge supports GDPR and CCPA compliance for merchants and their visitors.

GDPR

Data Processing Agreement (DPA)

Every merchant has a Data Processing Agreement with elNudge: the Data Processing Addendum is part of our Terms of Service and applies from sign-up or install, with no separate signature needed. It covers GDPR Article 28, the UK GDPR, India's DPDP Act and the CCPA. For a countersigned copy, email legal@elnudge.com with the subject line "DPA request".

Visitor consent

Shopify stores need no setup: elNudge follows your store's cookie banner (Shopify's customer privacy settings). Until a visitor allows analytics, elNudge keeps no visitor ID, sends no behaviour events, looks up no location and shows no proactive nudges; tracking starts as soon as they allow it and stops if they withdraw it.

The chat still works without consent. The chat button is shown, and a visitor who opens it gets a connection for that conversation only. The id for it lives in the browser tab (sessionStorage) so the chat follows them from page to page, and it is gone when the tab closes; nothing is kept that would recognise them on a later visit. The conversation itself is processed to answer them (contract or legitimate interest, not consent), and lead details they type are stored under the marketing consent state.

Other sites pass the choice from your consent banner (CMP): set data-consent="denied" on the script tag to start with tracking off, then call __eln('consent', { analytics: true, marketing: true }) when the visitor accepts, or { analytics: false } when they withdraw.

Data storage

elNudge data is stored in the AWS Asia Pacific (Mumbai) region (ap-south-1): the database is encrypted at rest with AWS KMS and backed up automatically with the same encryption. Visitor data collected on your site leaves that region only as described below:

• Conversation transcripts are sent to our AI model provider (US-based) for processing, under a commercial data processing agreement; it does not use this data for training. Sub-processors are listed in our Privacy Policy.
• Voice is handled by our speech providers under commercial data processing agreements.

Data retention

Data is automatically purged after the applicable retention period.

Visitor data deletion

To delete all elNudge data for a specific visitor:

DELETE https://api.elnudge.com/v1/visitors/:visitor_id
Authorization: Bearer sk_live_XXXXXXXX

You can also submit a deletion request via hello@elnudge.com if you do not have the visitor ID.

Deletions are processed within 30 days and are irreversible.

Your privacy policy

As a merchant using elNudge, you are the data controller. You are responsible for disclosing your use of elNudge in your privacy policy. You can copy and adapt the template paragraph below.

Template privacy policy disclosure

We use elNudge, an AI-powered sales assistant service provided by elSapiens Private Limited. elNudge collects anonymised behavioral data from visitors to our site — including page views, scroll depth, and cart interactions — to personalise sales nudges and chat responses. elNudge does not use cookies, does not track visitors across other websites, and does not collect personal information such as names or email addresses unless you engage with the chat feature. Data is stored in the EU. For more information, see the elNudge Privacy Policy.

CCPA

elNudge does not sell personal information

Under the California Consumer Privacy Act (CCPA), "selling" personal information has a broad definition. elNudge does not sell personal information as defined by CCPA. Visitor data collected on your site is used solely to provide the elNudge service to you. It is not disclosed to third parties for monetary or other valuable consideration.

Deleting a California resident's data

If a California resident exercises their right to deletion, you can fulfil the request by calling:

DELETE https://api.elnudge.com/v1/visitors/:visitor_id
Authorization: Bearer sk_live_XXXXXXXX

This permanently removes all behavioral events, conversation transcripts, and profile data elNudge holds for that visitor.

If you do not have the visitor ID, submit the request to hello@elnudge.com with the visitor's email address (if provided via the identify call) or the approximate date range of their visit. We will locate and delete the record within 30 days.

Opt-out

elNudge does not participate in targeted advertising and does not share data with advertising networks. There is no opt-out mechanism required for elNudge beyond the visitor data deletion API described above.

Shopify GDPR webhooks

If you installed elNudge through the Shopify App Store, Shopify requires you to handle three mandatory GDPR webhook endpoints. See the GDPR Webhook Endpoints guide for details on payload format and your obligations.