Nestli Privacy Policy

Last updated: 28 July 2026

This Privacy Policy describes how Nestli ("we", "our", or "the app"), a mobile application for tracking baby care activities, collects, uses, stores, and shares information about you when you use the app. It should be read alongside our Terms & Conditions.

1. Information We Collect

We collect the following categories of information:

2. Camera, Photo Library, and Microphone Access

Nestli requests access to your device camera and photo library so that you can capture or select photos of your baby to attach to your records. Microphone access is requested only when you use the voice-log feature. These permissions are used only when you explicitly invoke the corresponding feature inside the app.

You can deny or revoke any of these permissions at any time via your device settings. Denying them will disable the relevant features but will not affect other parts of the app.

3. How We Use Information

We do not sell your personal information. We do not use your data for advertising.

4. Data Storage and Security

Text records (feeding, diaper, sleep, growth, etc.), account data, and authentication are stored on Supabase, a managed backend provider, using encrypted connections and row-level security so that only you and the family members you explicitly invite can access your baby records.

Photos are stored on Amazon Web Services (AWS S3) in the Asia Pacific (Sydney) region, in a private bucket that is not publicly readable. They are served to your device through Amazon CloudFront, a global content delivery network, using short-lived signed URLs — this lets users in different regions (including mainland China, via CloudFront edge locations in Hong Kong, Tokyo, or Singapore) load photos quickly without making the bucket public.

Photos uploaded to Nestli pass through an automated image-moderation step that screens for content that breaches our policies or applicable law. This screening is automated and best-effort: we do not warrant that it will catch every prohibited image, and we may remove a photo we subsequently determine to be in breach. Concerns about a specific photo can be reported to the contact address in section 12.

All data is encrypted in transit (HTTPS). Supabase and AWS S3 encrypt data at rest using their standard provider-managed keys.

5. Third-Party Service Providers

Nestli uses the following service providers to operate the app. Limited user data is shared with each only as required for the listed purpose, and none of them sell your data.

By using the Service you agree to these sub-processors being used. The list may be updated as our infrastructure evolves; material additions will be communicated in-app.

6. Family Sharing

You may invite other users (for example, a partner or caregiver) to view or edit records for a specific baby. Invited members only gain access after accepting an invite code or email invitation. You can revoke their access at any time from the app. Revoking access removes a member's ability to view future data but does not erase entries they previously created.

7. Children's Privacy

Nestli is designed for use by adult caregivers to record information about their own children. The app is not directed at children under 13, and we do not knowingly collect personal information directly from children. The data stored about an infant or child within Nestli is provided by the parent or legal guardian on behalf of that child.

8. Your Rights

You can:

9. European Economic Area, United Kingdom, and Switzerland

This section applies if you use Nestli from the European Economic Area (EEA), the United Kingdom, or Switzerland, and supplements the rest of this policy. Where the two differ, this section governs for those users.

9.1 Who is responsible for your data

The controller of your personal data is Xin Chen, trading as Nestli, 2 Cassinia Way, Thornleigh NSW 2120, Australia. Data protection enquiries go to [email protected].

Representative in the Union (Article 27 GDPR). Nestli has no establishment in the European Union. Our designated representative is: not yet appointed. This entry is to be completed before Nestli is offered to users in the EEA.

9.2 The legal bases we rely on

Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect anything we did while it was in force.

9.3 Sending data outside the EEA

Nestli is operated from Australia and uses providers in several countries. Neither Australia nor Singapore is covered by a European Commission adequacy decision, so those transfers rely on the Commission's Standard Contractual Clauses.

9.4 Your rights

Under the GDPR and the UK GDPR you may:

Write to [email protected] to exercise any of these. We reply within one month, and will tell you if we need the further two months that Article 12(3) allows.

We take no decisions about you by automated means that produce legal or similarly significant effects (Article 22). AI+ produces informational answers; it decides nothing about you.

9.5 Complaints

You may lodge a complaint with your national supervisory authority (Article 77). The European Data Protection Board lists them at edpb.europa.eu; in the United Kingdom the authority is the Information Commissioner's Office (ico.org.uk). You do not have to contact us first, though we would rather you did.

10. Data Retention

We retain your data for as long as your account is active. When you delete your account, your personal information and uploaded photos are removed from live systems within a reasonable period. Routine backups may retain data for up to 30 days before being purged. Voice-log audio is not retained at all by Nestli — it is passed through to the transcription provider in memory and discarded.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. Continued use of Nestli after a change constitutes acceptance of the updated policy.

12. Contact

Questions about this policy or your data can be sent to:
[email protected]