NestCloud LLC ("NestCloud," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and disclose information when you use the NestCloud™ platform and associated services (the "Service"), and explains your rights regarding that information.
NestCloud LLC is the data controller for the personal information described in this Policy. We are a company based in the United States, and we serve customers internationally, including in the European Economic Area (EEA), the United Kingdom, Switzerland, and Australia. This Policy includes region-specific rights in Section 7.
When you register, we collect your name and email address, company or organization name, account role, password (stored in hashed form — we never store plain-text passwords), and subscription plan and billing status.
Subscription payments are processed by Stripe, Inc. NestCloud does not receive, store, or have access to your full credit card number, CVV/CVC, or bank account details. To calculate applicable sales tax, GST, or VAT and to comply with tax law, checkout collects your billing address (including country and, where provided, a business tax identification number such as a VAT number or ABN). Stripe provides NestCloud with a payment token and limited card metadata (brand, last four digits, expiration date) solely for billing management. Stripe's handling of your payment information is governed by Stripe's Privacy Policy.
When you create nesting jobs, we store job configuration, part lists and quantities, nesting results (placement coordinates, yield percentages), and NC program outputs. This data is retained for as long as your account remains active.
If you use quoting, customer management, or inventory features, we store the customer names, contact information, and business records you enter ("Customer Data"). This data belongs to you and is retained for as long as your account remains active. Where NestCloud processes Customer Data on your behalf, you are the controller and NestCloud is the processor.
We may collect log data (IP address, browser type, pages accessed, timestamps, error events), device information (operating system, screen resolution), and session and authentication tokens. This information is used to operate, maintain, and secure the Service.
NestCloud uses PostHog for privacy-conscious product analytics to understand how the Service is used and to improve it. PostHog is provided by PostHog, Inc. and, for our configuration, processes data on United States infrastructure.
Analytics are off by default and load only after you opt in. When you first visit the app or marketing site, a consent banner asks whether to enable analytics. Until you click "Accept," no analytics script loads and no analytics cookies are set. You may decline, and you may withdraw a prior consent at any time by clearing the site's stored preference in your browser. Cookies and local storage that are strictly necessary to operate the Service (for example, authentication and your consent choice itself) are always active and do not require consent.
We do not share your Customer Data (uploaded files, parsed geometry, job records, or the customer/business records you enter) with any analytics provider.
We use the information we collect to: provide, operate, and maintain the Service; process subscription payments, calculate applicable taxes, and manage your account; parse and analyze your uploaded files to generate nesting results; send transactional communications (billing receipts, payment notices, renewal reminders); send service-related notices (Terms or Policy updates); respond to support requests; with your consent, analyze usage to improve the Service; detect, investigate, and prevent fraudulent or unauthorized activity; and comply with applicable legal obligations.
We do not use your Customer Data to train machine learning models or for any purpose other than providing the Service to you.
If you are located in the EEA, the United Kingdom, or Switzerland, we process your personal information under the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service, managing your account, processing your files | Performance of a contract (GDPR Art. 6(1)(b)) |
| Billing, tax calculation, financial recordkeeping | Legal obligation (Art. 6(1)(c)) and contract (Art. 6(1)(b)) |
| Security, fraud prevention, service improvement, service-related communications | Legitimate interests (Art. 6(1)(f)) |
| Product analytics and any optional cookies | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
Raw uploaded files are retained in AWS S3 for a maximum of ninety (90) days from upload, then automatically and permanently deleted by an S3 lifecycle rule.
If you delete your account, all associated data — including uploaded file bytes in S3, parsed geometry, job records, customer data, and account information — is permanently and immediately deleted at the time of account closure, except where retention is required by applicable law (see 4.5).
Retained for as long as your account remains active. Deleted upon account closure.
Server log data is retained for a period not to exceed ninety (90) days, after which it is deleted or anonymized.
Records of transactions (amounts, dates, plan details, billing address, tax details, payment tokens) may be retained for up to seven (7) years to comply with applicable financial and tax recordkeeping requirements.
NestCloud does not sell, rent, or trade your personal information or Customer Data to any third party, and we do not "share" it for cross-context behavioral advertising.
We share limited information with the trusted service providers below, who process data on our behalf under contractual data-protection obligations. Current sub-processors:
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Amazon Web Services, Inc. (AWS) | Application hosting, database, and encrypted file storage (S3) | United States (us-east-1) |
| Stripe, Inc. | Subscription payments, billing, and tax calculation | United States / global |
| PostHog, Inc. | Product analytics (only with your consent) | United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (magic links, receipts, notices) | United States |
We will update this list when sub-processors change. A material change to sub-processors that affects the protection of your personal information will be reflected here with an updated "Last Updated" date.
We may disclose your information if required by applicable law, regulation, subpoena, or court order, or if necessary to protect the rights, property, or safety of NestCloud, our customers, or the public.
If NestCloud is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
NestCloud implements industry-standard security measures including: encryption of data in transit (TLS/HTTPS); encryption of data at rest in AWS S3 and our database; hashed storage of passwords; access controls limiting data access to authorized personnel on a need-to-know basis; and regular review of security practices.
No method of transmission over the internet is 100% secure. While we use commercially reasonable means to protect your information, we cannot guarantee absolute security. In the event of a data breach reasonably likely to result in a risk to your rights, NestCloud will notify affected users and, where required, the relevant supervisory authority in accordance with applicable law (including within 72 hours where GDPR applies).
You may access and update your account information at any time through your account settings. Contact support@getnestcloud.com for assistance with corrections not available through the settings interface.
You may permanently delete your account and all associated data at any time through your account settings. Account deletion is irreversible.
If you are located in the EEA, the UK, or Switzerland, you have the right to: access your personal data; have it rectified; have it erased ("right to be forgotten"); restrict or object to its processing; data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority — for example, your national Data Protection Authority in the EEA, the Information Commissioner's Office (ICO) in the UK, or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland. To exercise these rights, contact support@getnestcloud.com. We do not use solely automated decision-making that produces legal or similarly significant effects.
If you are in Australia, you may request access to and correction of your personal information, and may complain about our handling of it. As described in Section 8, your personal information is disclosed to and stored in the United States. If we cannot resolve your complaint, you may contact the Office of the Australian Information Commissioner (OAIC).
If you are a California resident, you have the right to know what personal information we collect, use, and disclose; the right to delete personal information we have collected; the right to correct inaccurate personal information; and the right to opt out of the sale or sharing of personal information (NestCloud does not sell or share personal information). You will not be discriminated against for exercising these rights. To exercise them, contact support@getnestcloud.com. We will respond to verifiable requests within forty-five (45) days.
We do not send marketing or promotional emails without your consent. Contact support@getnestcloud.com to opt out of any communications.
NestCloud is based in the United States, and your information is stored and processed in the United States (AWS us-east-1 region, Northern Virginia) and by the sub-processors listed in Section 5. If you access the Service from the EEA, the UK, Switzerland, Australia, or elsewhere outside the United States, your personal information will be transferred to and processed in the United States.
For transfers of personal data from the EEA, the UK, or Switzerland to the United States, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss addendum where applicable) with our sub-processors, and, where a sub-processor is certified, the EU-U.S. Data Privacy Framework and its UK Extension and Swiss-U.S. framework. A copy of the relevant safeguards is available on request at support@getnestcloud.com. For customers in Australia, this constitutes notice under Australian Privacy Principle 8 that your personal information is disclosed to overseas recipients in the United States.
[PLACEHOLDER — appoint only if required.] To the extent NestCloud is required under Article 27 of the GDPR and/or the UK GDPR to designate a representative in the European Union and/or the United Kingdom, that representative and its contact details will be listed here:
EU Representative: [name / address / email — to be appointed if required]
UK Representative: [name / address / email — to be appointed if required]
Until a representative is appointed, EEA/UK data subjects may contact us directly at support@getnestcloud.com.
The Service is intended for individuals who are at least eighteen (18) years of age. NestCloud does not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a minor, we will promptly delete it.
The Service may contain links to third-party websites or integrate with third-party services. NestCloud is not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party services you interact with through the Service.
NestCloud may update this Privacy Policy from time to time. Material changes will be communicated by email and/or by notice within the Service at least fourteen (14) days before taking effect. The "Last Updated" date at the top of this Policy reflects the most recent revision. Continued use of the Service after the effective date of any change constitutes acceptance.
If you have questions about this Privacy Policy, your data, or NestCloud's privacy practices, or to exercise any of your rights, contact us at: