Version 1.6 · Effective date: October 6, 2026
This policy describes how Cost Nudge Industries, LLC (“Cost Nudge,” “we,” “us”) collects, uses, and shares data in connection with the Cost Nudge service — the end-user component that displays meeting cost, its companion admin dashboard, and the backend services behind them (together, the “Service”).
Summary
This summary is for convenience. The numbered sections below control.
Cost Nudge shows meeting organizers an approximate labor cost for the meetings they schedule, and gives their employer aggregate reporting on meeting cost. It is sold to businesses. An employer’s IT administrator installs it for employees, or an employee installs it from the browser’s extension store. It works in Google Chrome, Microsoft Edge, and Safari on Mac, and in Microsoft Outlook.
Where meetings come from: the customer’s Google Workspace or Microsoft 365 administrator gives our servers read-only access to calendar events.
What we read from a meeting: email addresses, the start time and length, the meeting ID, and repeat-meeting details, when a new meeting is created.
What we use: the guests’ email addresses and the start time and length, to calculate the cost.
What we keep: a record for each meeting with at least three matched employees. It holds the organizer’s email address and an identifier for the organizer, the start time and length, the meeting ID, repeat-meeting details, the calculated cost, the number of matched employees, and when the record was saved.
Individual salaries: never uploaded to the Service. Cost is computed from broad salary bands that each Customer defines offline, before any data reaches us — so we never receive an individual’s pay. Cost is shown only for meetings with at least three matched employees, and as an approximate range rather than an exact figure. Together these prevent a cost figure from revealing any individual’s pay.
We do not sell personal information, use it for advertising, or use it to train AI or machine-learning models.
Your employer controls this data. We process it on their instructions. Requests to access or delete your data should go to your employer first.
1. Scope
This policy covers:
The Cost Nudge end-user component, which displays an in-context meeting-cost badge to meeting organizers inside their calendar. It is available as a browser extension for Google Chrome, Microsoft Edge, and Safari on Mac, and as an add-in for Microsoft Outlook.
The Cost Nudge admin dashboard, used by an organization’s designated administrators to view aggregate meeting-cost analytics.
The Cost Nudge backend (Google Cloud Functions and Cloud Firestore), which performs all cost calculations and stores organizational data.
Cost Nudge is a business-to-business product. An organization’s IT administrator installs it for the organization’s employees, or an employee installs it from the browser’s extension store. If you are an individual employee using the Service because your employer subscribes to it, your employer’s own privacy notices and policies also apply to you, and your employer controls certain settings and data described below.
This policy does not cover third-party websites, services, or products, including Google Workspace, Microsoft 365, or Stripe, except as described in Section 8 (Data Sharing & Sub-processors).
2. Controller vs. Processor Roles
For data protection purposes, the organization that subscribes to Cost Nudge (your employer, the “Customer”) is the data controller of the meeting, employee, and organizational data processed through the Service. Cost Nudge acts as the Customer’s data processor (or “service provider” under U.S. state privacy laws): we process data on the Customer’s behalf and according to the Customer’s instructions, as reflected in the Customer’s subscription agreement with Cost Nudge.
If you have questions about how your employer uses meeting-cost data, please contact your employer’s IT, People Ops, or Finance team directly. If you have questions about how Cost Nudge itself processes data as a processor, see Section 17 (Contact).
3. Information We Collect
3.1 Sign-in
Each person who uses the Service signs in with their organization’s workplace account. At first sign-in, we receive their email address, and we assign them a Cost Nudge user ID. On Chrome and in the admin dashboard we also receive the person’s name and profile photo. On Outlook we also receive Microsoft’s identifiers for the organization and the person. When a browser extension first opens Google Calendar after sign-in, we record that date and the browser.
Chrome. The user signs in with Google in the browser.
Edge and Safari. The user signs in with Google through a redirect via app.costnudge.com.
Google Workspace calendars. The customer’s Google administrator grants our servers read-only access to calendar events in the Google Admin console. We read the primary calendar of each person on the customer’s employee list whose browser extension has signed in and then opened Google Calendar. We read from that day until the person leaves the employee list, the trial ends without a subscription, or the subscription ends, and we record only meetings created in that time. We store no sign-in key or access token for this access, and the administrator can withdraw the permission in the Google Admin console.
Outlook. The customer’s administrator approves the add-in once for the whole organization, and each user signs in with their Microsoft work account inside Outlook. The administrator can also grant our servers read-only access to calendars. With that access, we read the calendar of every employee on the customer’s employee list, and we store each employee’s mailbox address to do so. The administrator can withdraw this access in Microsoft Entra.
Admin dashboard. The customer’s contacts sign in with their organization’s workplace account.
3.2 Meetings
What we receive. For Google Workspace calendars, Google sends our servers only these details of each meeting: the email addresses of the organizer and guests, whether the organizer is the calendar’s owner, whether a guest is a room or other resource, the start and end times and their time zone, the meeting ID, repeat-meeting details, when the meeting was created, and its status and type. For Outlook, Microsoft sends our servers the full meeting, and we read the email addresses, the start time and length, the meeting ID, and repeat-meeting details.
What we use. We use the guests’ email addresses and the start time and length to calculate the cost.
What we store. We store a record only when at least three people in the meeting, the organizer included, match the customer’s employee list. The record holds the organizer’s email address and an identifier for the organizer, the start time and length, the meeting ID, repeat-meeting details, the calculated cost, the number of matched employees, and when the record was saved.
We capture each new meeting within minutes of its creation while a trial or subscription is active, whether or not the badge is showing. During the first part of a trial the badge is hidden and capture continues, so the Customer can compare scheduling before and after the badge appears. A stored record is never changed afterward, and later edits or cancellations of the meeting do not affect it.
3.3 Live cost preview (badge)
To show the badge, the end-user component sends the open meeting’s email addresses and length to a separate backend function. On Outlook, it also sends the start and end times, the meeting ID, and technical details such as the Outlook version. On Chrome, Edge, and Safari, the function returns a rounded cost range, the number of matched employees, and whether the meeting is below the three-employee threshold. On Outlook, it returns a rounded cost and range, or only a signal that no cost is shown. It does not store a record.
3.4 Employee list (provided by the Customer)
Separately from employees’ use of the Service, the Customer’s administrator uploads a file listing the organization’s employees (the “employee list,” also called the roster) — work email, assigned salary band, a midpoint value, and department — using a Cost Nudge-provided template. From the band midpoint supplied on each employee’s row we also compute and store an hourly rate, as described in Section 9. We record whether each employee is active: everyone in the latest uploaded file is active, and anyone missing from it is marked inactive. Active status is not a column in the file. This roster is used on our servers to match meeting attendees and compute cost. It comes from the Customer, not from individual employees’ use of the Service, and is described here for completeness.
3.5 Customer contacts
The Customer names contacts for its account: its administrator, Finance, and HR contacts. We collect their names and work email addresses and use them to sign those contacts in to the admin dashboard and to send them account emails.
3.6 Account and billing data
If your organization converts from trial to a paid subscription, our payment processor (Stripe) manages billing. Stripe receives only organization-level billing information, such as the organization name and an administrator’s billing contact email. Stripe never receives meeting, attendee, or salary data. Cost Nudge does not receive or store full payment card numbers.
4. How We Use Information
We use the information described in Section 3 solely to:
Authenticate users and enforce organization-scoped access to data.
Compute and display approximate meeting labor cost to meeting organizers.
Compute aggregate, organization-level analytics for the Customer’s admin dashboard.
Enforce the eligibility, privacy-tiering, and abuse-prevention rules described in Sections 3.2 and 9.
Send account emails to the Customer’s contacts.
Operate, secure, and troubleshoot the Service.
We do not use meeting or attendee data for advertising, and we do not sell personal information.
5. Use of Data from Calendar Provider APIs
Cost Nudge’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Where the Service uses another provider’s calendar APIs, we apply the same commitments. Specifically:
Limited to user-facing features. We use data obtained through calendar APIs only to provide and improve the meeting-cost features described in this policy.
No transfer for unrelated purposes. We do not transfer this data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy.
No advertising. We do not use this data for serving advertising of any kind, including retargeting, personalized advertising, or interest-based advertising.
No human reading. We do not allow humans to read this data unless (a) we have the user’s or the Customer’s explicit consent for specific data, (b) it is necessary for security purposes such as investigating abuse or a suspected incident, (c) it is required to comply with applicable law, or (d) the data has been aggregated and anonymized.
5.1 Artificial intelligence and machine learning
We do not use data obtained through calendar APIs, meeting data, attendee data, employee roster data, or any Customer data to develop, train, retrain, or improve any artificial intelligence or machine-learning model, whether our own or a third party’s. We do not provide such data to any third party for those purposes.
6. Legal Basis
Where applicable data protection law requires a legal basis for processing, Cost Nudge processes personal data as a processor on behalf of the Customer, under the Customer’s instructions and its own legal basis. Questions about the legal basis for a specific organization’s use of Cost Nudge should be directed to that organization.
7. Automated Decision-Making
Cost Nudge does not make automated decisions about individual employees. The Service computes costs and analytics at the meeting and department level only. It does not score, rank, evaluate, or profile individual employees, and it is not designed or intended for use in employment decisions.
8. Data Sharing & Sub-processors
We share data only with service providers necessary to operate the Service, under contractual confidentiality and data-protection obligations:
Google Cloud Platform / Firebase (Cloud Firestore, Firebase Authentication, Cloud Functions, Firebase Hosting) — hosting, database, authentication, and compute for the Service. Data involved: all Service data described in Section 3.
Stripe — subscription billing. Data involved: organization-level billing and contact information only (see Section 3.6); no meeting, attendee, or salary data.
Google Workspace (Gmail) — sending account emails to the Customer’s contacts. Data involved: contacts’ work email addresses and the emails we send them.
Changes to sub-processors. We will notify Customer administrators before adding a new sub-processor that processes Customer personal data, so the Customer has an opportunity to object.
The browser extensions contain no remotely hosted code: all of their code ships in the package each store reviews. The Outlook add-in is a web page that Outlook loads from Cost Nudge’s servers, together with Microsoft’s Office library. The end-user component contains no third-party analytics or advertising code. It communicates only with the calendar provider, for sign-in, with Firebase Authentication, and with Cost Nudge’s own servers.
We do not sell personal data, and we do not share data with third parties for their own marketing purposes.
We may disclose information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Cost Nudge, our customers, or others.
9. Salary Privacy Safeguards
Cost Nudge is designed so that a cost figure produced by the Service cannot be used to determine any individual employee’s salary or compensation. Three layered safeguards produce this result:
Minimum-attendee threshold. A cost figure is computed and shown only when at least three matched employees are in a meeting, so a cost estimate cannot be attributed to a single individual’s rate.
Salary bands, not individual salaries. Cost is computed from organization-defined salary bands (currently six), using a midpoint value provided on each roster row — never from an individual employee’s actual salary. Each Customer defines its own bands offline, using a Cost Nudge template, and assigns each employee to a band before uploading the roster. The upload carries a midpoint value on each roster row, but has no column for an individual’s salary or hourly rate. If a file includes one anyway, that column is never read — each row is projected onto the four expected columns and nothing else is consulted — and the uploaded file itself is not retained. From the band midpoint you supply for each employee, we compute and store an hourly rate. That rate comes from a band-level figure you chose, not from the employee’s own pay. No individual salary figure is read into or stored in the Service at any point.
A range, snapped outward — never an exact figure. The badge shows the organizer an approximate cost with a range around it, for example ~$150 ($100–$200). Both ends are snapped outward to a fixed grid (currently $25): the low end down, the high end up, and the low end never below $0. Snapping outward is a privacy control rather than a rounding preference. The untouched distance between a meeting’s true low and high is exactly the sum of its attendees’ band widths across the meeting’s hours — so an unsnapped range would let someone read a meeting’s band composition off a single badge with one subtraction. Snapping both ends outward smears that distance across the grid, keeping what a badge can reveal at the level of bands rather than people.
Together these mean a badge is approximate by construction: pay enters only as a band, every figure is a blend of at least three people, and even the blend is shown as a snapped range rather than a number.
The dashboard works differently. Its figures are not snapped to a grid. They are organization- and department-level totals aggregated across many meetings and rounded to whole dollars. Aggregation, not snapping, is what protects individual pay on that surface — the underlying safeguards in points 1 and 2 apply to every record that feeds it.
No hourly rate, salary band midpoint, or per-attendee rate data is sent to or stored in the end-user component; all cost computation happens on our servers.
Administrative access. As with any hosted service, a limited number of Cost Nudge personnel hold administrative credentials to production infrastructure for operations, security, and support. Where that access would involve reading data obtained through calendar provider APIs, it is restricted to the limited circumstances permitted under Section 5(4) above. Because individual salaries are never present in the Service, no level of administrative access can expose an individual employee’s salary.
10. Data Retention
Cost records are retained while the Customer’s subscription or trial is active.
When a trial expires without converting to a paid subscription, the badge is switched off and our servers stop reading calendars. The organization’s cost records, employee list, and salary bands stay available on the dashboard for 30 days so the organization can review its results. Then they are permanently deleted, together with the calendar connection records and employees’ sign-in records.
On termination of a Customer’s subscription, our servers stop reading calendars immediately. The organization’s data — cost records, employee list, salary bands, calendar connection records, and employees’ sign-in records — is permanently deleted within 15 days. Two things can extend that. The Customer has 10 days after termination to ask us for an export; if it does, we hold that data until the export is delivered, then delete it. And we keep data longer where the law requires.
When an employee leaves the employee list, we stop reading that employee’s calendar when the new list is uploaded.
Employee list data is retained and updated as the Customer uploads new lists. Records for employees no longer on an uploaded list are retained for historical reporting but excluded from future attendee matching, until deletion under the termination timeline above.
Customer contacts. We keep the work email addresses and sign-in records of the Customer’s contacts, and a history of account events such as setup, list uploads, and trial dates, as our own business records after the account closes.
Operational logs. Our cloud provider generates platform-level logs recording information such as request timing, status codes, and originating network address. Our server that reads Google Workspace calendars also logs one summary line per run, with counts, reason codes, and the meeting IDs of the cost records it wrote. These logs hold no attendee or salary data, are retained on the provider’s standard schedule, and are used only for security and troubleshooting.
Customers may request deletion of their organization’s data at any time by contacting us (Section 17), subject to the terms of the Customer’s subscription agreement.
11. Security
We rely on Google Cloud Platform / Firebase infrastructure security, including encryption in transit and at rest and access-controlled service accounts, to protect Service data. Within the Service, access to organizational data is restricted by role-based Firestore security rules: dashboard-level aggregate data is limited to users holding an assigned administrative role (System Admin, People Ops, or Finance) within their own organization, and all cost-record writes are performed exclusively by server-side Cloud Functions — no client application can write cost, employee, or salary-band data directly. The credential our servers use to reach Microsoft is kept in Google Cloud Secret Manager.
Incident notification. If we become aware of a security incident affecting Customer personal data in the Service, we will notify the affected Customer’s administrators without undue delay, and will provide the information reasonably available to us about the nature of the incident, the data involved, and the steps we are taking in response.
Cost Nudge does not currently hold a formal security certification such as SOC 2, and does not conduct scheduled third-party penetration testing. We will update this section if that changes.
12. Your Rights / Your Organization’s Rights
Because Cost Nudge acts as a data processor for the Customer organization, individual employees who want to access, correct, or delete personal data processed through the Service — such as their own captured meeting data or roster entry — should direct that request to their employer, who controls the data. Where applicable law gives us direct obligations to individuals, or where the Customer directs us to fulfill such a request, we will respond as required by law and by our agreement with the Customer.
Organizations may contact us directly (Section 17) regarding access, export, correction, or deletion of their organization’s data. A Data Processing Addendum is available to Customers on request.
13. Children’s Data
The Service is a workplace tool intended for use by employees of business customers. It is not directed to, marketed to, or knowingly used by children, and we do not knowingly collect personal information from children.
14. International Data Transfers
Cost Nudge stores and processes all Service data on Google Cloud Platform / Firebase infrastructure located in the United States. The Service is offered and distributed only to organizations headquartered in the United States. We do not market the Service outside the United States, and we do not transfer Service data to infrastructure outside the United States.
15. Governing Law
This policy is governed by the laws of the State of Colorado, United States, without regard to its conflict-of-laws provisions.
16. Changes to This Policy
We may update this policy from time to time to reflect changes in the Service or applicable law. We will update the “Effective date” above when we do. Material changes affecting how we process data on behalf of Customers will be communicated to Customer administrators in advance.
17. Contact
Questions about this policy, or about how Cost Nudge processes data as a processor, can be directed to:
Cost Nudge Industries, LLC
Attn: Jonathan Epstein
210 Ken Pratt Blvd Ste 140
Longmont, CO 80501
jonathane@costnudge.com