Privacy Policy — Nesteries

Last updated: August 20, 2026

This Privacy Policy explains how Nesteries ("Nesteries," "we," "us") collects, uses, shares, and protects your personal data when you use the Nesteries service (the "Service").

Nesteries is currently operated by an individual, without a registered company. As required by data protection law, the responsible party ("controller") is:

Data controller: Nikita Kutsakivskyi, operating the Nesteries service. Contact: info@nesteries.com

1. Scope

This policy applies to anyone who creates an account or otherwise interacts with the Service, regardless of location. Because we cannot yet predict every jurisdiction our users will be in, this policy is written to meet the EU General Data Protection Regulation (GDPR), which is currently the strictest applicable standard, and we aim to honor equivalent rights for users elsewhere.

2. What data we collect

We do not currently ask for or store government ID documents or other identity documents. If a stronger identity-verification tier is introduced in the future, this policy will be updated before that feature goes live, and the categories of data involved will be described explicitly.

3. Why we process your data (legal bases)

• Performance of a contract (GDPR Art. 6(1)(b)): creating your account, showing you and matching you with other profiles, enabling chat.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure (session/device logging, fraud and abuse prevention), handling reports and blocks, improving the Service.
• Consent (Art. 6(1)(a)): optional features you actively opt into (e.g., submitting verification information). You can withdraw consent at any time; this does not affect processing carried out before withdrawal.
• Legal obligation (Art. 6(1)(c)): responding to lawful requests from authorities, retaining records where required by law.

We do not intentionally collect special categories of data (e.g., health, religion, sexual orientation, race). The gender field is standard demographic data used for basic matching, not a special category under GDPR.

4. Who we share data with

We use the following service providers ("processors") to operate Nesteries:

We do not sell your personal data. We do not share your data with advertisers. Your matches can see the profile information you make visible to them and the messages you send them; other users cannot see private account data (email, session history, verification email domain).

5. International data transfers

Our database, Redis, and application servers are hosted on a VPS located within the European Union. As a result, your data generally stays within the EU/EEA. Google (Sign-In) and Cloudflare (photo storage) may process data outside the EEA as part of their global infrastructure; both rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses as their transfer safeguard under GDPR Chapter V.

6. How long we keep your data

• Session/device data (IP, user agent): kept for up to 30 days, matching our refresh-token session length, then automatically expires.
• Profile deletion ("Delete my profile" in Settings): your photos are permanently deleted from storage, and your profile details (bio, budget, move-in date, birth date, lifestyle answers) are cleared. Your underlying account (email, Google sign-in link, verification status, and messages already sent to matches) is not automatically deleted by this action, since your matches' conversation history is preserved on their side.
• Full account deletion: if you want your account (email, verification records, and message history) permanently deleted as well, contact us at info@nesteries.com and we will process the request within 30 days, subject to any legal retention obligations (e.g., records needed to investigate an active safety report).
• Reports and blocks: retained for as long as needed for safety, moderation, and legal-defense purposes.

7. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten") — see Section 6.
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority — in Poland, the Urząd Ochrony Danych Osobowych (UODO), or your local data protection authority.

To exercise these rights, contact us at info@nesteries.com.

8. Security

We use industry-standard measures to protect your data, including hashed refresh tokens, encrypted connections (HTTPS/TLS), and access controls. No system is perfectly secure; if a data breach occurs that is likely to result in a risk to your rights, we will notify affected users and relevant authorities as required by law.

9. Age requirement

The Service is intended for users 18 years of age or older. We do not knowingly collect data from minors. If we learn that a minor has created an account, we will delete the account and associated data.

10. Cookies

We currently use only strictly necessary cookies required for you to log in and stay logged in (authentication session cookie) and to remember your language preference. We do not use advertising or analytics cookies. Because these cookies are strictly necessary for the Service to function, no separate consent banner is required under GDPR/ePrivacy rules; if we later add analytics or marketing cookies, we will update this policy and request your consent where required.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the Service before they take effect.

12. Contact

Questions about this policy or your data: info@nesteries.com