Privacy Policy — NestorCut

1. Controller

The controller of your personal data is the operator of NestorCut. You can contact us at [email protected].

2. Data we collect

We only collect the data strictly necessary to provide the Service:

Account data: email address (used as the identifier), display name, hashed password.
Uploaded content: the DXF files you submit and the nesting results we generate for you.
Technical data: IP address, browser type, usage events (page views, clicks) collected via our internal tracking, for service operation and improvement.
Billing data: handled by Stripe. We only keep a reference to your Stripe customer and your subscription status — never your card details.

3. Purposes and legal basis

Your data is processed for the following purposes:

Providing the nesting Service (performance of the contract);
Account management and authentication (legitimate interest);
Billing and subscription management (performance of the contract);
Security, fraud prevention and abuse mitigation (legitimate interest);
Service improvement and statistics, anonymised wherever possible (legitimate interest).

4. File storage and encryption

Your uploaded files and nesting results are stored in our database and are only accessible from your account.

On the Pro plan, a zero-knowledge encryption mode is available. When enabled, your files are encrypted with a key generated on your device, which is never transmitted to us in clear text. In this mode we are technically unable to read your files, even in the event of a database compromise.

5. Data retention

Account data and files are kept for as long as your account is active. After deletion, the data is purged within a reasonable period, except where retention is required by law.

Technical logs are kept for a limited period consistent with security needs, then automatically deleted.

6. Sub-processors

We rely on the following trusted third parties, each acting as a sub-processor:

Stripe — payment processing (PCI-DSS certified);
Google — optional sign-in via Google account;
Resend — transactional email delivery;
Our hosting and database provider.

7. Cookies

The Service uses only essential cookies and local storage:

A session cookie, required for authentication;
An anonymous tracking cookie, for usage statistics;
A preference cookie, to remember your theme.

8. Security

We implement reasonable technical and organisational measures to protect your data: hashing of passwords, transport encryption (TLS), per-user access controls on files, and an optional zero-knowledge encryption layer.

The security of the platform is reviewed on a regular basis. However, software security can never be guaranteed absolutely, and our Service relies on third-party tools and libraries. We cannot be held responsible for vulnerabilities that remain undiscovered in those third-party components.

9. Your rights

Depending on your jurisdiction (notably under the GDPR if you reside in the European Union), you have the following rights regarding your personal data:

Right of access to your data;
Right to rectification;
Right to erasure ("right to be forgotten");
Right to restrict or object to processing;
Right to data portability;
Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

10. Exercising your rights

To exercise any of these rights, contact us at [email protected]. We will respond within the legal timeframe. You also have the right to lodge a complaint with your data protection authority.