Privacy Policy

1. Who we are

The data controller for nestsheet.com and the NestSheet application is the operator of NestSheet ("NestSheet", "we", "us"). For data-protection enquiries, contact [email protected].

2. What data we collect

Account data

Email address, display name, and a bcrypt hash of your password. We do not store plaintext passwords at any point.

Usage data

Sheet metadata (dimensions, item counts, packing settings), export counts and formats, request logs including IP address and browser user-agent, and timestamps. We use this for operating the service, debugging, billing, and preventing abuse.

Web analytics data (marketing site)

Google Analytics runs on the marketing site behind a consent banner. Once you accept, it sets cookies and collects pages viewed, referrer, approximate location derived from IP, device and browser characteristics, and interactions such as clicks on "Open the builder". While consent is denied, Google's tag stores nothing on your device and sends only anonymous, cookieless signals used for aggregate estimates. See section 6 for the full picture.

Uploaded content

The raster and vector artwork you upload. We store it encrypted at rest on our servers and process it to render previews, pack sheets, and generate exports at your request.

Billing data

Payment card numbers and billing addresses are never collected by NestSheet. They go directly to Paddle, our Merchant of Record (see Subprocessors below). We receive only Paddle's invoice reference, the plan purchased, the country used for VAT, and the billing status.

Communications

Messages you send us at [email protected] and any product feedback you submit.

3. Legal basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) — for account data, uploaded content, and usage data needed to deliver the subscription you signed up for.
• Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention, service debugging, and limited product improvement from aggregated statistics. We balance these against your rights and you can object at any time.
• Consent (Art. 6(1)(a)) — for analytics cookies and identifier-based measurement on the marketing site (set only after you accept the cookie banner; declining leaves only the anonymous, cookieless signals described in section 6), for optional marketing email (you must opt in), and for optional AI features (each AI-assisted action is a fresh, explicit click). You can withdraw consent at any time without affecting prior lawful processing.
• Legal obligation (Art. 6(1)(c)) — for retaining billing records to meet tax and accounting laws.

4. How we use it

• To provide the service and the features you use.
• To authenticate you and keep your account secure.
• To send transactional email (password reset, receipts, important service notices).
• To prevent abuse, fraud, and violations of our Terms.
• To debug errors and improve the product (aggregated, not targeted at individuals).
• To comply with legal obligations (tax records, lawful requests from authorities).

We do not sell, rent, or share personal data for third-party advertising. We do not profile individual users for automated decision-making that has legal or similarly significant effects.

5. Third-party subprocessors

We use the following subprocessors to operate the service. Each receives only the data it needs for its specific function, under a written data-processing agreement.

Subprocessor	Purpose	Location	Data
Hetzner Online GmbH	Hosting & backups	Germany (EU)	Everything stored on our servers
Cloudflare, Inc.	Network / CDN in front of our servers	United States (global edge network)	Traffic between your browser and our servers, in transit
Paddle.com Market Limited	Merchant of Record — payments, VAT, invoicing	United Kingdom / USA	Billing details, card number, address
Anthropic PBC	Claude API for optional AI features (background removal / mask generation) — only when you click an AI-assisted action	United States	The specific image you acted on + minimal prompt
Google Ireland Ltd / Google LLC	Google Analytics 4 on the marketing site — cookies and identifiers only after you accept the cookie banner; anonymous cookieless signals otherwise	Ireland (EU) / United States	Site usage data described in section 6

6. Web analytics (Google Analytics 4)

The marketing site at nestsheet.com runs Google Analytics 4, governed by the consent banner described in the Cookie Policy. The legal basis is consent (GDPR Art. 6(1)(a)); Google acts as our processor for this data. The builder application itself currently runs without analytics tooling — if we add product analytics there, this policy and the Cookie Policy change first.

• If you accept: Google Analytics sets the cookies listed in the Cookie Policy and collects pages viewed, referrer, approximate location derived from IP, device and browser characteristics, and interactions such as clicks on the app-entry buttons. Because we enable analytics and advertising consent together, Google Signals features may also apply — aggregated demographics and interests reporting, and remarketing audiences based on your visit, linked by Google to your Google account settings where you have allowed Google such use.
• If you decline (or ignore the banner): no analytics cookies are set and no identifier persists. Google's tag sends only anonymous, cookieless signals used for aggregate modelling, with ad personalisation off — described honestly in the Cookie Policy, section 4.
• Retention: user-level Google Analytics data is kept for 14 months, aggregated reports beyond that.
• Withdrawing: use "Cookie settings" in the footer at any time; withdrawal stops collection from that moment without affecting the lawfulness of what was processed before.

We still do not run advertising networks' pixels, session-replay tools, or social-media trackers anywhere on nestsheet.com, and the server logs described above remain our own.

7. International transfers

Primary data storage and processing is in Germany (Hetzner EU), so EU-origin data stays in the EU at rest. When you invoke AI features we transmit the image to Anthropic in the United States; this transfer is covered by the EU Standard Contractual Clauses (SCCs, 2021/914). Paddle processes card data in accordance with their own SCC-backed transfer framework. Consented analytics data goes to Google Ireland Ltd, which may transfer it to Google LLC in the United States under Google's EU–US Data Privacy Framework certification and SCCs.

For each international transfer, we have assessed whether local law provides essentially equivalent protection to GDPR and implemented supplementary measures (encryption in transit and at rest, minimised data exposure). You can request the relevant transfer documents from [email protected].

8. Retention

• Active accounts — we keep your account data and uploaded content for as long as your account is active.
• After cancellation — account and uploaded content are kept for 90 days (so you can restore them), then deleted from primary storage. Encrypted backups expire on a 30-day rolling window on top of that.
• Billing records — kept for 7 years to meet tax and accounting law in Ukraine and the EU.
• Support email — kept for 24 months from the last message, then archived or deleted.
• Security logs — rolling 90 days, except for records tied to an active incident investigation.

9. Your rights (GDPR)

Regardless of where you live, you have the following rights over personal data we hold about you. To exercise any of them, email [email protected] from the address on your account. We respond within 30 days (usually within a few business days).

• Access — a copy of the data we hold about you.
• Correction — fix anything that is inaccurate.
• Deletion — delete your account and associated data, subject to billing-record retention above.
• Portability — receive your data in a structured, machine-readable format (JSON) where it was collected under contract or consent.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to pause processing while a dispute is resolved.
• Withdraw consent — for anything you consented to (marketing email, AI features), at any time.
• Complaint to a supervisory authority — in the EU/EEA you have the right to complain to your national data protection authority. A list is at edpb.europa.eu/about-edpb/members .

10. Security

We protect your data with industry-standard measures: TLS on every connection, bcrypt password hashing, encrypted storage volumes, principle-of-least-privilege access for our engineers, and daily off-site encrypted backups. Production systems run in an isolated private network at our Hetzner region; no public database access.

If a security breach affects your personal data in a way likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within the 72 hours required by GDPR Art. 33/34.

11. Cookies

The marketing site sets Google Analytics cookies only after you accept the consent banner — decline and none are set (section 6). Our own servers never send a Set-Cookie header: signing in stores a token in your browser's localStorage, not in a session cookie. Paddle's checkout sets Paddle's own cookies inside its iframe. Specifics, lifetimes, and how to withdraw are in the Cookie Policy.

12. Children

NestSheet is a professional tool and is not directed at people under 18. We do not knowingly collect personal data from children under 18. If you believe we have, contact us and we will delete the account.

13. Changes to this policy

Material changes (new subprocessors, new categories of data, new purposes) are announced by email to the address on your account and in-app at least 30 days before they take effect. Editorial changes are made in place and reflected in the "Last updated" date at the top of this page.

14. Contact

Data controller: the operator of NestSheet. Data-protection enquiries, access requests, and complaints: [email protected]. Business customers can request a Data Processing Addendum by emailing the same address.

---

Operator of nestsheet.com: NestSheet. Questions about this document: [email protected].

Launch-v1 baseline. Drafted by the NestSheet team for public compliance at launch; it will be refined by counsel post-launch and any material change will be announced via email and dated above.