Privacy Policy

1. Controller

The controller of your personal data is Guillaume Jerke EI — trade name "APlasma", SIREN 942 877 028, publisher of NestorCut ("NestorCut by APlasma"). You can contact us at [email protected].

Your data is hosted and processed in France.

2. Data we collect

We only collect the data strictly necessary to provide the Service:

• Account data: email address (used as the identifier), display name, hashed password.
• Uploaded content: the DXF files you submit and the nesting results we generate for you.
• Technical data: IP address, browser type, usage events (page views, clicks) collected via our internal tracking, for service operation and improvement.
• Billing data: handled by Stripe. We only keep a reference to your Stripe customer and your subscription status — never your card details.

3. Purposes and legal basis

Your data is processed for the following purposes:

• Providing the nesting Service (performance of the contract);
• Account management and authentication (legitimate interest);
• Billing and subscription management (performance of the contract);
• Security, fraud prevention and abuse mitigation (legitimate interest);
• Service improvement and statistics, anonymised wherever possible (legitimate interest).

4. File storage and encryption

Your uploaded files and nesting results are stored in our database and are only accessible from your account.

A zero-knowledge encryption vault is available as an opt-in on every plan. When enabled, your files are encrypted with a key generated on your device, which is never transmitted to us in clear text. In this mode we are technically unable to read your files, even in the event of a database compromise.

5. Data retention

Account data and files are kept for as long as your account is active. After deletion, the data is purged within a reasonable period, except where retention is required by law.

Technical logs are kept for a limited period consistent with security needs, then automatically deleted.

6. Sub-processors

We rely on the following trusted third parties, each acting as a sub-processor:

• Stripe — payment processing (PCI-DSS certified);
• Google — optional sign-in via Google account, and audience measurement on the marketing website (Google Analytics 4, IP anonymised, advertising features disabled);
• Resend — transactional email delivery;
• Cloudflare — hosting and content delivery of the marketing website (nestorcut.com).

7. Cookies and trackers

NestorCut only uses cookies that are strictly necessary for the Service, plus an exempted audience-measurement tool. No advertising or cross-site tracking cookies are used, which is why no consent banner is displayed:

• sessionId — authentication session (strictly necessary, app);
• oauth_code_verifier — Google sign-in security, expires after 10 minutes (strictly necessary, app);
• theme and locale — interface preferences (functional, exempt from consent, app);
• nest2d_session_id — anonymous first-party usage statistics (exempt audience measurement, app);
• _ga — Google Analytics 4 on nestorcut.com only, configured per the French CNIL exemption: IP anonymised, no advertising signals, no cross-site tracking, 2-month data retention (website).
• You can delete or block these cookies at any time in your browser settings. Blocking strictly necessary cookies will prevent sign-in.

8. Security

We implement reasonable technical and organisational measures to protect your data: hashing of passwords, transport encryption (TLS), per-user access controls on files, and an optional zero-knowledge encryption layer.

The security of the platform is reviewed on a regular basis. However, software security can never be guaranteed absolutely, and our Service relies on third-party tools and libraries. We cannot be held responsible for vulnerabilities that remain undiscovered in those third-party components.

9. Your rights

Depending on your jurisdiction (notably under the GDPR if you reside in the European Union), you have the following rights regarding your personal data:

• Right of access to your data;
• Right to rectification;
• Right to erasure ("right to be forgotten");
• Right to restrict or object to processing;
• Right to data portability;
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

10. Exercising your rights

You can delete your account and all associated data at any time, self-service, from your Profile page ("Account" section). Deletion is immediate and irreversible; any active subscription is then canceled immediately, without a refund.

To exercise any of these rights, contact us at [email protected]. We will respond within the legal timeframe (one month under the GDPR).

If you reside in France, you also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — www.cnil.fr).