Your home, your photos, your information.

Information you give us

• Account details: your email address and, if you provide it, your name. We use passwordless sign-in, so we don’t collect or store a password.
• Home photos and drawings: the photos of your home, or the architectural drawings, you upload so we can create your renders.
• Project content: your brief, notes, pin comments, revision requests and other messages about your project.
• Order and shipping information: what you bought, when, and for physical products your shipping name and address.
• Payment information: payments are processed by Stripe. We never see or store your full card number. Stripe shares limited details with us, such as the card brand, the last four digits, billing country and payment status.
• Subscription and referral details: for For Trade subscribers, your plan, billing period and referral code. When someone uses a referral code, we record which code was used.
• Messages to us: what you send through our contact form or by email, including your name, email address and message.

Information collected automatically

• Analytics: we use Vercel Web Analytics, a privacy-friendly analytics tool that doesn’t use cookies. It gives us aggregated information such as pages visited, referring sites, approximate country, and device and browser type. It isn’t used to identify you or to track you across other websites.
• Technical data: like most websites, our hosting and database providers automatically process technical information such as IP address, browser type and request logs to deliver and secure the Service.
• Essential cookies: we use only the cookies needed to keep you signed in and to keep the Service secure. We don’t use advertising or cross-site tracking cookies.

We use personal information to:

• create your account and sign you in with a one-time email link;
• create, deliver and revise your renders and manage your projects;
• process payments, subscriptions, referral discounts, orders and shipping;
• send transactional emails, such as order confirmations, delivery notices, revision updates and auto-approval reminders;
• respond to your questions and provide customer support;
• understand, in aggregate, how the Service is used so we can improve it;
• prevent fraud and abuse, keep the Service secure, and enforce our Terms of Service; and
• comply with our legal, tax and accounting obligations.

Your home photos are used only to produce your renders. We don’t sell them, and we don’t use them for advertising.

If you’re in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your personal information:

• Contract: to provide the Service you’ve requested, including your account, renders, orders and subscription.
• Legitimate interests: to secure and improve the Service, prevent fraud, and respond to enquiries, where those interests aren’t overridden by your rights.
• Consent: for example, before we feature your project in our portfolio. You can withdraw consent at any time.
• Legal obligation: to keep records required by tax and accounting laws.

We share personal information only with service providers that help us run the Service. They process it on our behalf and under our instructions:

• Supabase: database, authentication and private file storage (including your uploaded photos);
• Stripe: payment processing and subscription billing;
• Resend: sending transactional emails;
• Vercel: website hosting and cookieless Web Analytics; and
• Shipping vendors and product suppliers: for physical products you order, we share the order and shipping details needed to fulfil and deliver it.

We may also disclose information if required by law or to protect the rights, safety and property of our customers, the public or Nest & Roots. If we’re involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, and this policy will continue to apply to it.

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA and similar US state laws. We haven’t done so in the past 12 months.

We don’t use or disclose sensitive personal information for purposes that would require an opt-out under California law.

We love showing off great projects, but your home is yours. We’ll only use your completed renders or your photos in our portfolio, website or marketing if you give us permission, and we’ll ask first. You can withdraw that permission at any time by emailing hello@nestandroots.com, and we’ll stop using them in new materials.

We keep personal information only as long as we need it for the purposes in this policy:

• Account, project, photos and renders: for as long as your account is active, so your renders stay available to you. If you ask us to delete your account, we delete this information within a reasonable period, except where we need to keep it for the reasons below.
• Order, payment and tax records: for as long as tax, accounting and other laws require, typically up to seven years.
• Contact form messages and support emails: for as long as needed to help you and for a reasonable period afterwards.
• Technical logs: for a short period for security and troubleshooting.

We use reasonable technical and organizational measures to protect personal information. These include encryption in transit (HTTPS), private storage for your uploaded photos with access limited to your account and our team, passwordless sign-in, and access controls on our systems. No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If you believe your account has been compromised, contact us right away.

Depending on where you live, you may have the right to:

• Access: find out what personal information we hold about you and get a copy of it;
• Correction: ask us to correct inaccurate information;
• Deletion: ask us to delete your personal information;
• Portability: receive your information in a portable format;
• Opt-out: opt out of the sale or sharing of personal information for targeted advertising (we don’t do either) and of non-essential emails;
• Objection and restriction (EU/UK): object to, or ask us to restrict, certain processing; and
• Withdraw consent where we rely on it, such as portfolio use.

How to exercise your rights

Email hello@nestandroots.com from the address associated with your account and tell us what you’d like to do. We may need to verify your identity before acting on a request. You can use an authorized agent, and we may ask for proof of their authority. We’ll respond within the time required by applicable law, and we won’t discriminate against you for exercising your rights.

If you’re in the EEA or UK, you also have the right to complain to your local data protection authority.

The Service isn’t directed to children under 16, and we don’t knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we’ll delete it.

We’re based in the United States, and our service providers may process information in the United States and other countries. If you use the Service from outside the US, your information will be transferred to, stored and processed in the US. Where required, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK equivalent, offered by our service providers.

We may update this Privacy Policy from time to time. When we do, we’ll change the “Last updated” date above. If the changes are significant, we’ll let you know by email or with a notice on the Service before they take effect.

Questions or requests about this policy or your personal information? Email hello@nestandroots.com or use our contact form. We reply within one business day.