Privacy policy

1. Who we are

Nestr is operated by Devarno Ltd, 29 New Caledonian Wharf, 6 Odessa Street, SE16 7TN, company number 15040535 (“we”, “us”). We are the controller of the personal data described here. Contact: hello@nestr.tools.

2. What this policy covers

• this website, nestr.tools;
• the Nest dashboard at app.nestr.tools;
• the hosted Pellets registry at registry.nestr.tools.

3. Data we collect

This website

This website has no sign-up form and sets no analytics cookies. Our hosting provider processes standard request logs (such as IP address, user agent and requested URL) to serve and protect the site. This website runs no analytics.

Accounts on the dashboard

• Name and email address.
• Password (stored only as a hash), or the identifier from GitHub or Google if you sign in with them.
• Organisation name, membership and invitations.
• Session and security logs.

Publishing to the registry

When a pellet is published, its name, version, content hash, publisher identity claim, signature and provenance data, and publish time are recorded in the transparency log. Transparency-log entries are append-only by design and cannot be deleted (specification requirement PEL-LOG-005). Do not use a personal identity you do not want permanently recorded as a publisher.

Payments

Payments are handled by Polar, which acts as merchant of record. We receive subscription status and billing contact details; we do not receive or store full card numbers.

Support

Emails you send us and our replies.

4. Why we use it (legal bases)

• To provide the service you signed up for (contract).
• To secure the service and prevent abuse (legitimate interests).
• To meet tax and accounting obligations (legal obligation).

We rely on these bases under the UK GDPR and the Data Protection Act 2018. Our supervisory authority is the UK Information Commissioner’s Office (ico.org.uk).

5. Who we share it with

We use these processors to run the service:

• Vercel — hosting for this website and the dashboard.
• Railway — hosting for the API and registry.
• Polar — payments, as merchant of record.
• Hostinger — transactional email.
• GitHub and Google — only if you choose to sign in with them.

We do not sell personal data. Where these providers process data outside the UK or EEA, they do so under their data processing agreements, which include standard contractual clauses or an equivalent safeguard.

6. How long we keep it

Account data is kept while your account exists and is deleted within 30 days of a deletion request. Usage counts are kept for 13 months. Billing records are kept as long as tax law requires. Transparency-log entries are kept permanently (see section 3).

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict its use, and to complain to a data-protection authority. Email hello@nestr.tools to make a request.

• Export: email us from the address on your account. We will send your data to that address as JSON files within 30 days. An organisation owner or admin can also ask for the organisation’s data. Invoices and receipts are available from Polar’s customer portal.
• Deletion: email us from the address on your account. We will confirm with you first, offer you an export, and then delete your account, sign-in methods, sessions, memberships, invitations and usage records within 30 days. Organisations you are the only member of are deleted with your account. If you have an active subscription we cancel it first. We email you when it is done.
• What we cannot delete: pellets you have published and their transparency-log entries, which are permanent by design (see section 3), and billing records that Polar and we must keep for tax purposes.

8. Security

See our Security page, including its list of known limitations.

9. Changes

We will post changes here and update the date at the top. For material changes we will notify account holders by email.