Privacy Policy
Version 2026-10-16. Effective 16 October 2026.
1. Controller
Raligo AB, reg. no. 559568-8275, Krukmakargatan 18, 118 51 Stockholm, Sweden, is the controller of the personal data described here. Contact us about privacy at hello@nestifysystems.com.
This policy covers our website nestifysystems.com and the Nestify app at app.nestifysystems.com. Files our customers upload are covered by our Data Processing Agreement with them, not by this policy (section 4).
2. What we collect and why
| Purpose | Personal data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Your account and sign-in | Email, name, company, organization and role, sign-in times | Contract, art. 6(1)(b) | While the account is open, then deleted within 30 days |
| Record that you accepted our Terms and Privacy Policy | Version accepted, time of acceptance | Legal obligation and legitimate interest in proving the agreement, art. 6(1)(c) and (f) | While the account is open + 10 years (limitation period) |
| Team invitations | Email of the person invited, who invited them, status | Legitimate interest in letting customers add colleagues, art. 6(1)(f) | Until accepted or expired, then 90 days |
| Billing | Name, company, billing email, plan, invoices, Stripe customer ID. Card details are handled by Stripe, never by us | Contract, art. 6(1)(b); accounting law, art. 6(1)(c) | 7 years after the end of the financial year (Swedish Bookkeeping Act) |
| Running nests | Files you upload and the results, which may include names or logos in your artwork, plus your settings | Contract, art. 6(1)(b) | Source files, parts and exports deleted 48 hours after the nest finishes, and the job entry 7 days later; settings while the account is open |
| Dropbox and OneDrive hotfolders | Access tokens (stored encrypted), chosen folders, file names | Contract, art. 6(1)(b) | Until you disconnect or close the account |
| Keeping the Service secure and working | IP address, browser, error reports (including a recording of the screen with all text masked when an error occurs), server logs | Legitimate interest in security and fixing faults, art. 6(1)(f) | Error reports up to 90 days, logs up to 30 days |
| Product updates by email | Email, name, your opt-in and its time | Consent, art. 6(1)(a) | Until you unsubscribe |
| Service emails (sign-in codes, billing, changes to terms) | Contract, art. 6(1)(b) | As for the account | |
| Website statistics without cookies (Vercel Web Analytics) | Page views, load times and anonymized technical data; no cookies, no cross-site tracking | Legitimate interest in understanding site use, art. 6(1)(f) | Aggregated; not linked to you |
| Website statistics with Google Analytics | Pages visited, device, approximate location, a random identifier stored in a cookie | Consent, art. 6(1)(a) | 2 months |
| Support | What you write to us and our replies | Legitimate interest in helping you, art. 6(1)(f) | 2 years after the case is closed |
We do not sell personal data, and we do not use it for automated decisions with legal or similarly significant effects.
3. Where the data comes from
Mostly from you. If a colleague invites you, we get your email from them. Payment status comes from Stripe.
4. Customer files
When customers upload files, the customer is the controller of any personal data in them and we are their processor. We process those files only to run the Service, under the Data Processing Agreement that forms part of our Terms (nestifysystems.com/dpa). Questions about such data should go to the customer first.
5. Who we share data with
We use these suppliers (processors) to run the Service. They may use the data only on our instructions and under a data processing agreement.
| Supplier | What they do for us | Where the data is processed |
|---|---|---|
| Supabase | Database, sign-in and file storage, including your uploaded files and exports | EU (Ireland) |
| Resend | Sends sign-in emails (links and one-time codes) | Sent from the EU (Ireland); account data and email logs in the USA |
| Railway | Hosting of the app and the nesting engine, which processes the geometry of uploaded files | EU (Netherlands) |
| Sentry (Functional Software) | Error monitoring | EU (Germany); account metadata in the USA |
| Stripe | Payments and invoicing | EU and USA |
| Vercel | Hosting, cookieless statistics and load-time measurement for the website | EU and USA |
| Sanity | Content management for the website (no visitor data) | EU and USA |
| Google (Analytics) | Website statistics, only with your consent | EU and USA |
| Google (Fonts) | Delivers the app's fonts; receives your IP address and browser type when the app loads | USA |
| Dropbox, Microsoft OneDrive | Only if you connect them for hotfolders | Under your own agreement with them |
Stripe is also an independent controller for payment data, for example to prevent fraud; see stripe.com/privacy. We may also share data with authorities where the law requires it, and with a buyer if the business is sold.
6. Transfers outside the EU/EEA
Your files and our systems are hosted in the EU: the database and your files in Ireland, the app and the nesting engine in the Netherlands, and error reports in Germany. Some suppliers are US companies: Sentry stores account metadata in the USA, Resend stores email logs in the USA, Stripe processes payment data in the USA, and Google LLC receives your IP address when the app loads its fonts. We rely on the EU–US Data Privacy Framework where the supplier is certified, and otherwise on the EU Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the safeguards.
7. Your rights
You have the right to:
- get a copy of your personal data (access);
- have incorrect data corrected;
- have your data deleted, unless we must keep it, for example for accounting;
- restrict our processing in some cases;
- receive your data in a machine-readable format (portability);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting processing before the withdrawal. Unsubscribe links are in every product email; cookie consent can be changed via "Cookie settings" at the bottom of the website.
Email hello@nestifysystems.com to use your rights. We reply within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the supervisory authority where you live.
8. Security
Data is encrypted in transit (TLS) and at rest. Access tokens for connected services are encrypted with a separate key. Access is limited by role, and we keep error reports free of file contents.
9. Cookies
See our Cookie Policy below for what we store in your browser and how to change your choice.
10. Changes
We update this policy when our processing changes. For material changes we tell you by email or in the app before they take effect. The version date at the top shows the current version.
Cookie Policy
We only store what the site and app need to work, unless you say yes to statistics. Google Analytics is not loaded at all until you accept, and declining is as easy as accepting. You can change your choice at any time via "Cookie settings" at the bottom of nestifysystems.com.
Website: nestifysystems.com
| Name | Type | Purpose | Category | Duration |
|---|---|---|---|---|
| nestify.consent | Local storage | Remembers your cookie choice | Necessary | Until you change it or clear site data |
| _ga | Cookie (Google) | Distinguishes visitors in Google Analytics | Statistics – only with consent | 13 months |
| _ga_[ID] | Cookie (Google) | Keeps session state in Google Analytics | Statistics – only with consent | 13 months |
Vercel Web Analytics and Speed Insights count page views and measure load times without cookies or anything else stored on your device.
App: app.nestifysystems.com
The app uses no statistics or marketing cookies. Everything below is needed for the features you ask for, so it does not require consent.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sb-[project]-auth-token | Local storage | Keeps you signed in | Until you sign out |
| nestify:access-ok | Session storage | Skips repeat account checks while the tab is open | Until the tab closes |
| nestify:settings, nestify:settings-updated-at | Local storage | Your nesting settings, also saved to your account | Until you clear site data |
| nesting-v2:last-layout, nesting-v2:last-progress | Local storage | Restores your latest layout if the page reloads | Until replaced or cleared |
| nestify-session | IndexedDB | Keeps the parts of your current nest on your device so the page can reload | Until the nest is replaced or cleared |
| nestify:file-number | Local storage | Numbers your export files | Until you clear site data |
| sentryReplaySession | Session storage | Groups error reports from the same tab | Until the tab closes |
| __stripe_mid, __stripe_sid | Cookie (Stripe) | Fraud prevention when you pay | 1 year / 30 minutes |
How to control cookies
Use "Cookie settings" on the website to change your choice. You can also delete cookies and site data in your browser settings; you will then be signed out of the app.
Questions: hello@nestifysystems.com.