Privacy
Privacy policy
This page says what personal data Nest&Quote processes, why, how long it is kept, which service providers are involved and what rights you have. It covers the website nestandquote.com and the application behind it. Last updated 11 October 2026.
Who is responsible
Metin Vural Sachsenwaldstraße 26 12157 Berlin, Germany hello@nestandquote.com
What we process, and why
Visiting the site
When you open a page, the hosting provider's server logs record the IP address, time, page, and browser type. This is needed to deliver the page and to detect misuse. Legal basis: our legitimate interest in a working and secure service (Art. 6(1)(f) GDPR). Server logs are kept for a short time by the hosting provider.
The site uses no analytics service, no advertising, no tracking pixels and no social media plug-ins. Fonts are served from our own server. We keep a first-party event log in our own database: which step was taken (a nest started, a quote sent), under a random visitor identifier from the session cookie, without the IP address. It counts how the product is used, in aggregate. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Nesting without an account
You can nest drawings without an account. We store the drawings you upload (DXF or GEO), part codes, quantities, material, sheet sizes and settings, and the result, under the visitor identifier from the session cookie. Nests without an account are deleted after 7 days, files included. Legal basis: steps before a contract and our legitimate interest in letting you try the product (Art. 6(1)(b) and (f) GDPR). To limit misuse, the number of nests per IP address is capped; the count is kept in server memory for the time window only and not stored.
Account and shop
To create an account we store your name, email address and a password, which is stored as a hash. If you sign in with Google, Google sends us your name, email address and profile picture link, and we store the sign-in token; nothing is written to your Google account. Email verification and password codes are stored as hashes and expire after a few minutes. Each sign-in creates a session with its IP address and browser type, valid for 30 days.
A shop holds its name, country, currency, settings, machines and their speeds, measured run times, materials, prices, operations, parts library, jobs with their drawings and nests, and quotes. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). The data is kept as long as the account exists. Write to us to have the account and the shop's data deleted.
Quotes and the data of your customers
When a shop writes a quote it enters its customer's company, contact name, email address, postal address, VAT number and order references. For this data the shop is the controller, and Nest&Quote processes it on the shop's behalf under Art. 28 GDPR. A data processing agreement is available on request from hello@nestandquote.com.
Quote emails are sent through our email provider in the shop's name, with the shop's reply address. We store the recipients, subject, delivery status and the sent PDF with the quote. The customer opens the quote by a link without an account. When the customer accepts or declines, we store the name entered, the order reference or reason, the time and the IP address with the quote, so that the decision is documented and misuse of the link can be traced. Legal basis: the legitimate interest of the shop and of its customer in a documented decision (Art. 6(1)(f) GDPR).
Team invitations
When a shop invites a colleague we store the email address, the role, who invited and when, and send the invitation by email. The link's token is stored as a hash. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Emails from us
We send verification and password codes, team invitations, quote emails on behalf of the shop and a notification to the shop when a customer decides. We send no newsletters and no advertising emails.
Writing to us
Emails to hello@nestandquote.com are forwarded by our domain's email routing to our mailbox. We keep them as long as needed to answer and as long as the law requires for business correspondence.
Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
naq_session | Random identifier for nests without an account and the event log | 30 days |
| sign-in session | Keeps you signed in | 30 days, renewed daily |
naq_theme | Your choice of light or dark in the app | 1 year |
All three are needed for the functions you ask for; none is used for tracking or advertising, so no consent banner is shown.
Service providers
| Provider | Purpose | Where |
|---|---|---|
| Railway Corp., USA | Hosting of the application and the database | EU West (Amsterdam, Netherlands) |
| Railway Corp., USA (bucket storage) | Storage of drawings, nests, PDFs | EU West (Amsterdam, Netherlands) |
| Resend, Inc., USA | Sending emails | — |
| Google Ireland Ltd. | Sign-in with Google, only if you choose it | — |
| Cloudflare, Inc., USA | Domain name service and forwarding of email to hello@ | — |
These providers process data on our instructions under data processing agreements. Where a provider is outside the European Union, the transfer rests on the EU standard contractual clauses in that agreement.
How long
- Nests without an account: 7 days, then deleted with their files.
- Account, shop, jobs, quotes: while the account exists, then on request.
- Sessions: 30 days; verification codes: minutes.
- Email delivery records and the customer's decision on a quote: with the quote.
- Server logs: a short time, at the hosting provider.
- Business correspondence: as long as commercial and tax law require.
Your rights
You can ask for access to your data, for correction, deletion, restriction of processing and a copy in a portable format, and you can object to processing based on legitimate interest. Write to hello@nestandquote.com. You can also complain to a data protection authority; the one for our seat is the Berlin Commissioner for Data Protection and Freedom of Information.
Changes
We update this page when the product or a provider changes. The date at the top says when.