Privacy Policy

1. Who we are

The data controller for nestsheet.com and the NestSheet application is the operator of NestSheet ("NestSheet", "we", "us"). For data-protection enquiries, contact [email protected].

2. What data we collect

Account data

Email address, display name, and a bcrypt hash of your password. We do not store plaintext passwords at any point.

Usage data

Sheet metadata (dimensions, item counts, packing settings), export counts and formats, request logs including IP address and browser user-agent, and timestamps. We use this for operating the service, debugging and preventing abuse.

Web analytics data (marketing site)

Google Analytics runs on the marketing site behind a consent banner. Once you accept, it sets cookies and collects pages viewed, referrer, approximate location derived from IP, device and browser characteristics, and interactions such as clicks on "Open the builder". While consent is denied, Google's tag stores nothing on your device and sends only anonymous, cookieless signals used for aggregate estimates. See section 6 for the full picture.

Uploaded content

The PNG artwork you upload. We store it encrypted at rest on our servers and process it to render previews, pack sheets, and generate exports at your request.

Communications

Messages you send us at [email protected] and any product feedback you submit.

3. Legal basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) — for account data, uploaded content, and usage data needed to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention, service debugging, and limited product improvement from aggregated statistics. We balance these against your rights and you can object at any time.
• Consent (Art. 6(1)(a)) — for analytics cookies and identifier-based measurement on the marketing site (set only after you accept the cookie banner; declining leaves only the anonymous, cookieless signals described in section 6), and for optional marketing email (you must opt in). You can withdraw consent at any time without affecting prior lawful processing.

4. How we use it

• To provide the service and the features you use.
• To authenticate you and keep your account secure.
• To send transactional email (password resets and service emails from [email protected]).
• To prevent abuse, fraud, and violations of our Terms.
• To debug errors and improve the product (aggregated, not targeted at individuals).
• To comply with lawful requests from authorities.

We do not sell, rent, or share personal data for third-party advertising. We do not profile individual users for automated decision-making that has legal or similarly significant effects.

5. Third-party subprocessors

We use the following subprocessors to operate the service. Each receives only the data it needs for its specific function, under a written data-processing agreement.

6. Web analytics (Google Analytics 4)

The marketing site at nestsheet.com runs Google Analytics 4, governed by the consent banner described in the Cookie Policy. The legal basis is consent (GDPR Art. 6(1)(a)); Google acts as our processor for this data. The builder application itself currently runs without analytics tooling — if we add product analytics there, this policy and the Cookie Policy change first.

• If you accept: Google Analytics sets the cookies listed in the Cookie Policy and collects pages viewed, referrer, approximate location derived from IP, device and browser characteristics, and interactions such as clicks on the app-entry buttons. Because we enable analytics and advertising consent together, Google Signals features may also apply — aggregated demographics and interests reporting, and remarketing audiences based on your visit, linked by Google to your Google account settings where you have allowed Google such use.
• If you decline (or ignore the banner): no analytics cookies are set and no identifier persists. Google's tag sends only anonymous, cookieless signals used for aggregate modelling, with ad personalisation off — described honestly in the Cookie Policy, section 4.
• Retention: user-level Google Analytics data is kept for 14 months, aggregated reports beyond that.
• Withdrawing: use "Cookie settings" in the footer at any time; withdrawal stops collection from that moment without affecting the lawfulness of what was processed before.

We still do not run advertising networks' pixels, session-replay tools, or social-media trackers anywhere on nestsheet.com, and the server logs described above remain our own.

7. International transfers

Hetzner Online GmbH, based in Gunzenhausen, Germany, hosts NestSheet on servers in Ashburn, Virginia, United States. Primary data storage and processing takes place there.

For users in the EU, EEA and UK, the transfer is necessary to provide the service you signed up for (Art. 49(1)(b) GDPR). Cloudflare handles network traffic and encrypted off-site backups through Cloudflare R2. Resend sends password-reset and service emails from [email protected]. These processors are based in the United States.

Consented analytics data goes to Google Ireland Ltd, which may transfer it to Google LLC in the United States under Google's EU–US Data Privacy Framework certification and SCCs.

For each international transfer, we have assessed whether local law provides essentially equivalent protection to GDPR and implemented supplementary measures (encryption in transit and at rest, minimised data exposure). You can request the relevant transfer documents from [email protected].

8. Retention

• Active accounts — we keep your account data for as long as your account is active.
• Uploaded artwork — kept for 90 days from upload, then deleted automatically.
• After account closure — account data is kept for 90 days (so you can restore it), then deleted from primary storage. Encrypted backups expire on a 30-day rolling window on top of that.
• Support email — kept for 24 months from the last message, then archived or deleted.
• Security logs — rolling 90 days, except for records tied to an active incident investigation.

9. Your rights (GDPR)

Regardless of where you live, you have the following rights over personal data we hold about you. To exercise any of them, email [email protected] from the address on your account. We respond within 30 days (usually within a few business days).

• Access — a copy of the data we hold about you.
• Correction — fix anything that is inaccurate.
• Deletion — delete your account and associated data, subject to the retention periods above.
• Portability — receive your data in a structured, machine-readable format (JSON) where it was collected under contract or consent.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to pause processing while a dispute is resolved.
• Withdraw consent — for anything you consented to (analytics and marketing email), at any time.
• Complaint to a supervisory authority — in the EU/EEA you have the right to complain to your national data protection authority. A list is at edpb.europa.eu/about-edpb/members .

10. Security

We protect your data with industry-standard measures: TLS on every connection, bcrypt password hashing, encrypted storage volumes, principle-of-least-privilege access for our engineers, and daily off-site encrypted backups. Production systems run in an isolated private network at our Hetzner region; no public database access.

If a security breach affects your personal data in a way likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within the 72 hours required by GDPR Art. 33/34.

11. Cookies

The marketing site sets Google Analytics cookies only after you accept the consent banner — decline and none are set (section 6). Our own servers never send a Set-Cookie header: signing in stores a token in your browser's localStorage, not in a session cookie. Specifics, lifetimes, and how to withdraw are in the Cookie Policy.

12. Children

NestSheet is a professional tool and is not directed at people under 18. We do not knowingly collect personal data from children under 18. If you believe we have, contact us and we will delete the account.

13. Changes to this policy

Material changes (new subprocessors, new categories of data, new purposes) are announced by email to the address on your account and in-app at least 30 days before they take effect. Editorial changes are made in place and reflected in the "Last updated" date at the top of this page.

14. Contact

Data controller: the operator of NestSheet. Data-protection enquiries, access requests, and complaints: [email protected]. Business customers can request a Data Processing Addendum by emailing the same address.

---

Operator of nestsheet.com: NestSheet. Questions about this document: [email protected]. Material changes are announced by email and dated above.