Privacy policy

Last updated 13 October 2026

This policy explains how Nudgelist handles personal data. Nudgelist is a trading name of Upwren Ltd (“we”, “us”), a company registered in England and Wales with company number 17507839, whose registered office is 66 Paul Street, London, EC2A 4NA. You can contact us about anything in this policy at hello@getnudgelist.com. We are registered with the Information Commissioner’s Office under number ZC270041.

Who this policy covers

Nudgelist is used by recruitment agencies to send shortlists of candidates to their clients. This policy covers four groups of people:

• Recruiters who have a Nudgelist account.
• Client contacts: people at hiring companies who receive a shortlist link from a recruiter.
• Candidates whose details a recruiter adds to a shortlist.
• Visitors to getnudgelist.com.

Our role: controller and processor

When an agency adds candidates and client contacts to Nudgelist, the agency is the controller of that data: it decides what is collected and why, and it is responsible for having a lawful basis to share it. We act as the agency’s processor and handle that data only to provide Nudgelist to the agency, under the data processing terms in our Terms of service. If you are a candidate or client contact and want to exercise your data rights, the agency that sent you the shortlist is usually the right place to start. We will help them respond, and you can also contact us.

We are the controller for data about recruiters’ accounts, billing and use of the service, and for visitors to our website.

What we collect

Recruiters

• Your name, work email address, password (stored only as a secure hash) and agency details you enter in Settings.
• Billing details: your subscription plan and payment history. Card details are handled by Stripe and never reach our systems.
• Records of what you do in Nudgelist, such as sending a shortlist, so the service works and the introduction record is accurate.
• Anonymous usage statistics (see “Analytics” below).
• Feedback you choose to give us, for example through the feedback form during your trial, together with your agency and a count of how much you have used Nudgelist.

Client contacts

• Your name and email address, added by the recruiter.
• What you do with the shortlist: when you open it, how long each candidate’s card is on your screen (in seconds), which CVs or documents you download, your decisions, reasons, comments and interview times, and any email replies you send to a Nudgelist reply address.
• Reminder emails we sent you on the recruiter’s behalf, and a receipt each time you record a decision.

We record this so the recruiter can see where each candidate stands, so reminders are relevant, and so there is a dated record of each introduction. We do not use it for advertising and we do not track you across other websites.

Candidates

• The profile the recruiter writes: display name (usually first name and last initial), headline, summary points, salary expectation and notice period.
• Your CV and any other documents the recruiter uploads, and your email address if the recruiter gives it. It is used to ask you to confirm you are happy to be put forward, and for updates your recruiter sends you through Nudgelist, such as interview times. Those updates are kept in the introduction record.
• Whether you agreed to be put forward, how and when, and the client’s decisions and comments about you.

Website visitors

Anonymous page-view statistics only. We do not use advertising or tracking cookies.

Why we use it (lawful basis)

• To provide the service to agencies (contract): running accounts, sending shortlists, reminders and notifications, and taking payment.
• To keep Nudgelist secure and working (legitimate interests): error reports, preventing misuse, and keeping backups.
• To improve Nudgelist (legitimate interests): anonymous usage statistics, feedback you give us, and emails during your trial asking how it is going. You can ask us to stop these emails at any time.
• To meet legal obligations: for example keeping financial records for tax.

For candidate and client contact data, the agency is responsible for its own lawful basis, usually legitimate interests or consent in the course of recruitment.

Analytics and cookies

We use PostHog, hosted in the EU, to count how Nudgelist is used. It runs without cookies, does not record your screen, and receives only random identifiers, never names, email addresses or candidate details. It is switched off completely on shortlist, candidate and password-reset pages. The only thing Nudgelist stores in your browser is your sign-in session, which is needed for the service to work.

Who else handles the data

We use the following services to run Nudgelist. Each is bound by a data processing agreement and only uses the data to provide its service to us.

Some of these companies are based in the United States and may access data from there, for example for support. Where that happens the transfer is protected by the UK’s approved safeguards: the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We do not sell personal data to anyone.

How long we keep it

• Shortlists, candidates and the introduction record: for as long as the agency keeps them in its account. Agencies can delete candidates who have not been sent; the record of a sent introduction is kept because it is evidence the agency may need if a placement fee is disputed.
• When an agency closes its account: we delete its data, including CVs and the introduction record, within 30 days, unless the agency asks us to export it first. Copies in backups are overwritten within a further 30 days.
• Candidate confirmation links expire after 14 days; shortlist links after 30 days.
• Billing records: 6 years, as required for tax.
• Feedback: up to 2 years, or until you ask us to delete it.
• Error reports and analytics: up to 90 days for error reports, and up to 12 months for anonymous analytics.

How we protect it

Data is encrypted in transit and at rest. Every agency’s data is separated at the database level so one agency can never see another’s. CVs are stored privately and can only be downloaded through a link that expires after five minutes, and only once the agency’s release setting allows it. Shortlist links are long random codes, private to each client contact. Access to production systems is limited to us.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how it is used, and ask for it in a portable format. Email hello@getnudgelist.com. We will reply within one month. If your data was added by an agency, we will pass your request to them and help them respond.

Nudgelist does not make decisions about anyone by automated means. Clients and recruiters make every decision about candidates.

Complaints

If you are unhappy with how we have handled your personal data, you can complain to us by emailing hello@getnudgelist.com with “Data protection complaint” in the subject, or by writing to Upwren Ltd, 66 Paul Street, London, EC2A 4NA. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office at any time, at ico.org.uk/make-a-complaint.

Changes to this policy

If we make important changes we will tell account holders by email before they take effect. The date at the top shows when this policy was last updated.