Privacy Policy
Updated:Data controller
The data controller is Vojtěch Kaizr, IČO (Czech company ID number): 02905523, with a registered seat at Skalice 73, Frýdek-Místek, 738 01.
For anything concerning this document and the processing of your data, write to us at hello@nestino.cz. We answer questions about personal data at this address.
We have not appointed a data protection officer — we fall into none of the cases in which Article 37 GDPR requires one. The address above is the contact point for all questions about personal data.
Processing purposes
We process personal data only so that we can run and improve Nestino — so that you can log in, see your family, receive notifications and contact us. We do not process it for advertising and we do not sell it to anyone.
Below we describe each purpose separately: what exactly is processed, why, and on what legal basis under Article 6 GDPR.
The data needed to create and run an account — email, password and in-family name — you must provide; without it we cannot provide Nestino to you. Everything else, notifications in particular, is optional.
Account authentication
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
For your account we store your email address, your display name, your password exclusively as a hash, whether your email has been verified, your account permissions, your interface language, your onboarding state and its work-in-progress draft, your notification preferences, a flag recording that your password has appeared in a breach, and the time of account deletion if any.
At registration and on every password change we check whether the password has appeared in a known data breach. The check runs against the Have I Been Pwned service and we send it only the first five characters of the password’s checksum — neither the password nor its full digest ever leaves our server. In more detail in the Recipients section.
Logging in is built on tokens. A login session is valid for 15 minutes and is renewed by a single-use refresh token valid for 30 days.
A child account logs in with the family code, an in-family name and a password. It has no email address attached — a child therefore does not need an email of their own for Nestino.
Family scope
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
About a family we keep its name, its family code and the list of its members. For each member we record their role, their in-family name and their monthly points goal.
Tasks, expenses, points and goals are shared inside the family on purpose. That is the point of Nestino, not a data leak — the family sees what happens in the family.
What each person in the family can do is governed by their role. A new member can be invited by the family admin and by a parent. Members can be managed by the family admin only. The family can be deleted by the family admin only. A child’s completed tasks can be approved by the family admin and by a parent.
A family invitation optionally carries the invitee’s email address, an invitation token, a code and the role to be assigned. It is valid for 14 days.
When the admin removes someone from the family, they stay visible to the family for another 7 days. When a member deletes their own account, they disappear from the family’s active lists immediately.
Receipts and attachments
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
You can upload a photo of a receipt to an expense. We store the file on the same server in Germany that runs the rest of the app, under a random name, together with the original file name. Members of your family see the receipt just as they see the expense itself. What is in the photo is up to you — Nestino neither reads nor evaluates the content of a receipt.
Push notifications
Legal basis: your consent (Article 6(1)(a) GDPR), which you give by enabling notifications in your browser and can withdraw at any time by turning them off in settings or in the browser.
If you enable notifications in your browser, we store the delivery address your browser issues, the encryption keys needed for delivery, the browser designation, and the times of creation and last use.
The delivery address is issued by a service run by your browser’s vendor. Enabling notifications therefore means that service takes part in delivery — in more detail in the Recipients section.
Email communication
Legal basis: performance of a contract for operational emails (Article 6(1)(b) GDPR); for the contact form, our legitimate interest in answering an enquiry and in defending the form against automated abuse (Article 6(1)(f) GDPR).
We send operational emails through Amazon SES in the eu-central-1 region (Frankfurt, Germany) from the address noreply@notify.nestino.cz. For email delivery, personal data therefore does not leave the European Union.
The contact form on nestino.cz processes a name, an email address, a subject, a message and a language. We do not store the content of the form in a database — we forward it by email. We process the sender’s IP address in order to filter out automated submissions and to limit the rate of requests; the email address and the submitting IP address also appear in the server’s operational log. We reply to every submission automatically with a confirmation email.
Traffic measurement
Legal basis: legitimate interest in knowing which pages people use (Article 6(1)(f) GDPR).
We measure traffic on our own server in Germany. Your browser communicates only with nestino.cz; the hand-off to the measurement service happens on our side, so analytics data never reaches a third party.
The measurement uses no cookies and no persistent identifiers. IP addresses are not stored — no field for them exists in the measurement data. From a visit we derive an approximate country, region and city.
Error diagnostics
Legal basis: legitimate interest in keeping the application working and in being able to fix faults (Article 6(1)(f) GDPR).
We send technical error reports to our own diagnostic service in Germany. A report carries the internal account number, but no email address, no name, no family identifier, no task or expense content, and no headers, cookies or form content.
Performance measurement
Legal basis: legitimate interest in knowing how fast the app opens and responds on real devices, so that we can speed it up (Article 6(1)(f) GDPR).
For signed-in app users, children’s accounts included, we measure how quickly the app loads and responds and how long it takes for the overview to appear; alongside that we store the app version, the screen on which you opened the app, the device type (Android, iOS or computer), the browser engine and its major version, whether you use the app installed or in the browser, the connection type where the browser reports it, and the date without a time. A record contains no account, family or device identifier and no page address, and the measurement stores nothing on your device — no cookies and no other storage. The signed-in app sends the measurement to our own server in Germany; the sign-in only serves to authenticate the request and to limit how often one account can send measurements, and it is not attached to the stored record.
Product improvement
Legal basis: legitimate interest in knowing how families use Nestino, so that we can improve it (Article 6(1)(f) GDPR).
When you register, finish the initial setup, join a family, complete or approve a task, record an expense, earn a reward or send us feedback, we store which action happened and when, together with the internal account and family number — never the content, so no task names, amounts, notes or messages. This includes children’s accounts. We use these records to improve the app and delete them together with the account.
Feedback sent from the app — the message and whether it is a bug, an idea or something else — is stored together with the internal account and family number, the screen you sent it from, the app version, the language and the device and browser type, and is forwarded by email to our address together with your account’s email address, so that we can reply to you. The beginning of the message (roughly the first 140 characters), with the internal account and family number, also appears in a weekly internal summary we send ourselves by email. The stored record is deleted together with the account; the copies in these emails stay in our mailbox just like messages from the contact form.
GDPR requests
Legal basis: compliance with a legal obligation under Articles 12 to 22 GDPR (Article 6(1)(c) GDPR).
For a data request we record who filed it, when they filed it, what state it is in (pending, fulfilled, rejected) and internal notes on handling it.
If you file the same request again within 24 hours, no new request arises — it attaches to the one already pending. We handle a data export as a request, within 30 days. It is not an instant file download.
Retention periods
A login session is valid for 15 minutes. A refresh token is valid for 30 days and can be used only once. A password-reset link is valid for 1 hour. A family invitation is valid for 14 days. A repeated data request attaches within 24 hours to the one already pending. A member removed by the admin stays visible to the family for 7 days. The appearance and language cookies are valid for 1 year.
When you delete your account, you disappear from the family’s active lists immediately. The account itself stays for another 7 days so that the deletion can be undone; once that period passes, we remove it. We carry out full removal as an operational act — it does not run automatically on a timer.
We keep technical error reports for 30 days. We keep the operational records of server access, which contain IP addresses, for 30 days as well. We keep performance-measurement records for 90 days and then delete them automatically. We keep records of app usage and feedback sent from the app for as long as the account exists and delete them together with it.
Messages from the contact form stay in the mailbox we forwarded them to for 24 months from the last message in the thread; we then delete them.
We keep the record of a GDPR request — who filed it, when, what state it is in and the internal notes — for 36 months after it was handled, so that we can show it was handled. We keep an uploaded receipt for as long as the expense it belongs to exists; deleting the expense or the account deletes the file too.
Recipients
For sending operational emails we use Amazon Web Services in the eu-central-1 region (Frankfurt, Germany).
Our agreement is concluded with Amazon Web Services EMEA SARL, seated in Luxembourg. We have also accepted a data processing agreement (DPA) with them.
The servers on which the data runs are operated by Hetzner Online GmbH in Germany. For both suppliers, the contracting entity and the processing region are in the European Union. Amazon Web Services EMEA SARL belongs to the US Amazon group; should data reach any of its entities outside the EU, such transfers are covered by the standard contractual clauses that form part of the DPA we have accepted.
When checking whether your password has appeared in a data breach, we query the Have I Been Pwned service, which is operated outside the European Union. We send it only the first five characters of the password’s checksum — a value that on its own matches hundreds of thousands of different passwords and cannot be tied to a particular person. We pass it neither your password, nor its full digest, nor your email, nor any other information about you.
We run both traffic measurement and error diagnostics on our own servers in Germany, so no analytics data reaches a third party. The diagnostic service runs on infrastructure we operate ourselves and on which we also have our other applications.
If you enable notifications in your browser, a service run by your browser’s vendor takes part in delivering them — Google, Apple or Mozilla, depending on which browser you use. Without notifications enabled, no such hand-off occurs.
Data-subject rights
You have all the rights GDPR gives you — to access your data, to have it corrected and erased, to have processing restricted, to portability, and to object to processing.
You can exercise each of these rights with us. How to do so specifically, including what each request does, is described on the GDPR page.
We use no automated decision-making and no profiling within the meaning of Article 22 GDPR — nothing concerning you is decided by a computer on its own.
If you believe we process your data contrary to the rules, you have the right to lodge a complaint with the supervisory authority, which is the Úřad pro ochranu osobních údajů (the Czech Office for Personal Data Protection).
Cookies
On this website — that is, on nestino.cz, where you are reading this document — we set no cookies. The app’s login cookies are restricted exclusively to the app domain, so they never reach the marketing site at all.
In the app itself we set four cookies. The login session cookie is valid for 15 minutes. The session refresh cookie is valid for 30 days. The nestino_theme cookie keeps your choice of light or dark appearance for 1 year. The i18n_locale cookie keeps your chosen interface language for 1 year.
The app additionally stores a few preferences directly in your browser: display density and colour accent, recently used commands, saved defaults, saved reward rules, and the time data was last loaded. These are preferences only, they stay in your browser and we do not send them anywhere.
We use no tracking cookies
None of the cookies listed serves advertising or cross-site tracking. All of them are either essential for logging in or remember a preference of yours.
Traffic measurement uses no cookies at all. We therefore do not need your consent to tracking, nor a cookie banner.
Contact
For anything concerning this document or your personal data, contact us at hello@nestino.cz.
We answer questions about privacy within 30 days.
References
The processing of personal data is governed by Regulation (EU) 2016/679 (GDPR) and by Act No. 110/2019 Coll., on personal data processing.
How to exercise your rights is described on the GDPR page. The technical measures with which we protect data are summarised on Security.