What we hold, and why
Last updated 7 October 2026
Nestled holds the ordinary details of a life shared between two people. That deserves a straight answer about where it goes, so this page names every company that touches it rather than hiding behind “trusted partners”.
The short version. Your data is stored in the UK. It is never sold, never advertised against, and never used to train AI models. Seven companies process parts of it so the app can work, all named below. You can have a copy or have it deleted by emailing hello@joinnestled.com.
1. Data we collect
What you give us
- Your email address and the display name you choose
- Everything you put in your home: tasks and chores, grocery lists, meals and recipes, calendar events, reminders, spending entries, budgets and savings goals, trips and trip journals, pets and their vet dates, memories, and links to documents
- Photos you choose to keep (a trip, a journal day, your pets, a dish you cooked). Only the two of you can open them, and only while signed in. Photos of receipts and bookings are read to fill in the details and then deleted, so we never keep them.
- Your Telegram chat ID, if you connect the bot, so we know which messages are yours
- Anything you write in the feedback box
What the service creates
- Which of you added or completed what, and when
- Your subscription status and renewal date
- Ordinary server logs, including IP addresses, kept briefly for security and debugging
What we deliberately do not collect
No tracking, no profiles.There is no Google Analytics, no advertising pixel and nothing that follows you around the internet. The public pages count visits using Vercel's privacy-friendly analytics, which sets no cookies and builds no profile of you. It is not switched on inside the app, so what you and your partner do in your own home is never measured.
No card details.Payment happens on Stripe's own pages. We learn that you paid and when you renew, never your card number.
No document files. The Documents feature stores a title, a category, a year and a link. Your files stay in your own Drive and Nestled never opens or copies them.
2. How we use your data
Under UK GDPR we rely on three lawful bases:
- Performing our contract with you — your account and everything in your home. Without this data there is no product.
- Legitimate interests — keeping the service secure, preventing abuse and fixing faults.
- Legal obligation — keeping payment and tax records as long as HMRC requires.
Because a home is shared, everything either of you adds is visible to the other. That is the product working as intended, and worth understanding before you pair with someone.
3. Third-party services
These companies process parts of your data on our instructions. None may use it for their own purposes.
| Who | What they handle | Where |
|---|---|---|
| Supabase | Database, sign-in and photo storage — the bulk of your data | London, UK |
| Vercel | Runs the site and app; short-lived server logs; counts visits to the public pages | EU / US |
| Anthropic | Reads captured messages, receipts and recipes to work out how to file them | US |
| Telegram | Carries bot messages, if you connect it | Varies |
| Stripe | Takes payments and holds billing details | UK / EU / US |
| Brevo | Delivers sign-in emails | EU |
| Unsplash | Stock photos for trips and meals. We send a search word, never your data | US |
On the AI specifically: your content is used to answer the one request it was sent for and nothing else. It is not used to train AI models, by us or by Anthropic under the API terms we use.
4. Data storage and retention
- While your account is open — everything, for as long as you want it. A lapsed subscription deletes nothing; the home just closes until you restart.
- After you ask for deletion — removed from live systems within 30 days and from backups within 90.
- Payment records — six years, because tax law requires it.
- Server logs — a few weeks at most.
5. Cookies
The only cookies we set are the ones that keep you signed in. There are no advertising or analytics cookies, which is why you have never seen a cookie banner here.
6. Your rights
Under UK GDPR you can ask us to:
- give you a copy of your data in a portable format
- correct anything that is wrong
- delete your account and everything in it
- restrict or object to what we do with it
Email hello@joinnestled.com and we will respond within one month, at no charge.
One caveat worth stating: because a home is shared, deleting your account does not by itself remove shared content the other person still relies on. Tell us what you want done with it and we will explain what is possible.
If you think we have handled your data badly, please tell us first — but you can complain to the Information Commissioner's Office at ico.org.uk at any time.
7. Data security
Data is encrypted in transit and at rest. Access to a home is enforced at the database level, so one couple's data cannot be read by another even if the app has a bug. Sign-in uses one-time links and codes rather than passwords, so there is no password of yours for us to lose.
8. Children
Nestled is for adults and is not directed at anyone under 18.
9. International data transfers
Your data is stored in the UK. Some of the processors above operate in the EU and the US, so parts of your data are transferred there. Those transfers are covered by the UK International Data Transfer Addendum or equivalent safeguards.
10. Changes to this policy
If we change how we use your data in a way that affects you, we will email you before it takes effect. Smaller clarifications get a new date at the top of this page.
11. Contact
Nestled is operated by a sole trader based in the United Kingdom, who is the data controller for the purposes of UK GDPR. Full trading details, including registered name and postal address, are available on request by email.
See also Terms and Cancelling.