Privacy Policy
Last updated November 6, 2026
This Privacy Policy explains what personal information NestEggo, Inc., a Delaware corporation ("NestEggo", "we", "us") collects when you use our website and services (the "Service"), how we use and share it, how long we keep it, and the choices and rights you have. NestEggo is the controller of this information, except where we process it for a brand as described in section 6.
1. What we collect
You give us:
- Account details: your full name, work email, password (stored only as a secure hash by our authentication provider), job title, profile handle and, if you add one, a profile photo.
- Brand details: your brand's name, website and email domain, and later its logo and description. Your role on each brand you belong to.
- What you post: chats you suggest, experiences, replies, brand responses, cafe suggestions, and every earlier version of what you edit or delete.
- Your activity: votes, flags (with the reason and any note), chats and cafes you join, and the brand you post as.
- Messages to us: what you send through our contact form, including your name, email, brand and topic.
- Payments (for tokens): what your brand bought, plan, amounts and billing contact. Card and bank details go directly to Stripe; we never see or store full card numbers.
- Customer invitations: if a brand asks us to email a customer, the customer's name and email address, provided by that brand.
We collect automatically:
- Sign-in and security data: sign-in times and methods, and session cookies.
- Anti-abuse signals: a one-way, keyed hash of your IP address (we don't store the raw IP in our database), and at sign-up a record with your email, email domain and that IP hash. We use these to limit repeated sign-ups and spam.
- Sign-up risk signals: we compute a risk score from things like whether your email is from a personal or disposable provider, whether your email domain matches your brand's website, unusual names or email aliases, whether you used our sign-up form, and how many sign-ups came from the same network recently. A high score sends your account to manual review; it doesn't by itself reject you.
- CAPTCHA: Cloudflare Turnstile checks that you're a person on sign-up, sign-in and contact forms. Cloudflare collects browser and device signals to do this.
- Usage and analytics: pages viewed, searches and URL searches (the words or web address you search for, tied to an anonymous session ID or, if you're signed in, your account ID), clicks on Brand promo links through our
/outredirect, referring site and campaign tags, browser and device type, and an anonymous session ID. Our hosting provider also keeps standard server logs, including IP addresses, for a short time. - Ad measurement (Brand promo): opens and clicks on a Brand promo, tied to the placement and chat, and, if you're signed in, your account.
We don't ask for sensitive information (such as health, religion or government IDs), and please don't post it.
2. What's public
- Your experiences, replies and brand responses show your first name, job title, level and the brand you post as. Your profile page (
/u/{handle}) shows the same details, your brands and your public experiences. - Never shown publicly: your email address, last name, IP data, risk score, votes, flags and the chats you suggested.
- Brand admins can see the work email of colleagues who ask to join their brand, so they can recognize them, and the names and roles of their team.
- Public content can be indexed by search engines and read by AI assistants and other services that respect our
robots.txt. We can't control copies others make.
3. How we use it, and our legal bases
| Purpose | Examples | Legal basis (EU/UK) |
|---|---|---|
| Run the Service | Accounts, brands, teams, posting, votes, levels, joins | Contract |
| Keep the community verified and safe | Sign-up review, risk scoring, rate limits, CAPTCHA, spam and duplicate detection, moderation, enforcing our rules | Legitimate interests (a trustworthy, spam-free community); legal obligation where it applies |
| AI-assisted moderation | Reviewing suggested chats, checking own-brand mentions, reviewing ads | Legitimate interests |
| Search and recommendations | Matching your query to chats, related chats | Contract; legitimate interests |
| Payments and tokens | Charging, crediting and expiring tokens, invoices, fraud prevention | Contract; legal obligation (tax and accounting) |
| Service emails | Confirmation and sign-in links, password resets, receipts, replies to your messages, renewal and low-token notices | Contract; legitimate interests |
| Measure and improve NestEggo | Product analytics, performance, reporting ad results to brands | Legitimate interests; consent where required for analytics cookies |
| Legal and security | Responding to lawful requests, protecting rights, keeping audit records | Legal obligation; legitimate interests |
Automated decisions. Our sign-up risk score and AI moderation tools can send an account or post to manual review, or hold a suggested chat as "being reviewed". They don't ban, suspend or permanently reject anyone on their own; a person makes those decisions, and you can contact us to contest one.
We don't sell your personal information and don't share it for cross-context behavioral advertising. We don't use your content to train our own AI models.
4. AI processing of your content
We send some content to AI providers to help moderate and organize NestEggo:
- Anthropic (Claude): the text of chats and cafes you suggest, experiences that might mention your own brand, Brand promo content and the text of a web page you ask us to match (URL search). We send the text and, where needed, brand names; we don't send your email or IP data.
- OpenAI (embeddings only): the text of published chats and of search queries, to turn them into numbers we use for search. We cache the numbers for a search query for up to 90 days after it was last used, so repeated searches don't go to OpenAI again. No account details are sent.
We use these providers' business APIs, under terms that limit how they may use the data.
5. Who we share it with
Service providers that process data for us, on our instructions:
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Database, authentication and file storage | All account, brand, content and activity data; hosted in the United States (US West) |
| Vercel | Website hosting, edge network, firewall, page-speed measurement | Requests to our site, including IP address and browser details; server logs; anonymous page-speed data |
| Resend | Sending email | Your email address, name and the email's content |
| Cloudflare (Turnstile) | Bot and abuse protection on forms | Browser and device signals, IP address |
| Stripe (for payments) | Payment processing | Billing contact, payment details, purchase amounts |
| PostHog | Product analytics, only where allowed (see section 7) | Pages viewed, clicks, device and browser data, an approximate location worked out from your IP address, an anonymous or account ID |
| Sentry | Error monitoring | Technical details of an error, the page it happened on, and browser and device type. We remove email addresses, tokens, cookies and query strings before sending, and Sentry doesn't store IP addresses |
| Anthropic | AI moderation and summarizing | Content described in section 4 |
| OpenAI | Text embeddings for search | Chat text and search queries |
| Upstash | Rate limiting for search and other forms | Rate-limit counters keyed by a keyed hash of your IP address or by your account ID (never the raw IP address); each counter expires within the limit window (10 minutes) |
Others:
- Brands you belong to: your name, job title, work email and role are visible to that brand's admins.
- Brands that invite you: if you signed up through a brand's invitation, that brand sees the invitation's status (for example, that you signed up and shared) and a link to your public experience.
- Advertisers see aggregate ad results (impressions, clicks), not who clicked.
- Legal and safety: when required by law, or to protect the rights, property or safety of NestEggo, our members or others.
- Business transfers: if we're involved in a merger, acquisition or sale of assets, under this policy.
6. Data we process for brands
When a brand gives us a customer's name and email so we can send an invitation, we process that information on the brand's behalf, only to send the invitation (and, if enabled, one reminder) and track its status. Each invitation says who it's from and how to opt out. The brand confirms it's allowed to contact that person.
7. Cookies and similar technologies
- Essential cookies: keep you signed in, remember the brand you're acting for, and protect forms (Cloudflare Turnstile). The Service doesn't work without them.
- Anonymous session cookie (
ne_anon, 30 days): set when you search before signing up. It carries that search into onboarding if you sign up, and is deleted when you sign up or after 30 days. - Search-check cookie (
ne_sp, 30 minutes): set after you pass the CAPTCHA check on search, so we don't ask again straight away. - Invitation cookie (
ne_invite, 30 days): set when you press Sign up or Log in on a customer invitation link, so the invitation follows you through sign-up. It is deleted once the invitation is matched to your account. - Suggestion cookie (
ne_suggest, 1 day): holds a chat suggestion you typed while logged out, so it survives sign-up. - Country cookie (
ne_country, 1 day): a two-letter country code, so we know whether to ask for analytics consent. - Consent cookie (
ne_consent, 12 months): remembers your choice on the cookie banner. - Stripe cookies: fraud prevention on Stripe's checkout pages, when a brand admin pays.
All of these are strictly necessary to run the Service, except product analytics, described below.
Product analytics (PostHog). We use PostHog to see how NestEggo is used (pages visited, searches, sign-up and onboarding steps, chats joined, promos created, checkouts) so we can improve it. It keeps a random identifier in your browser's local storage, not a cookie, and our internal member ID once you're signed in. It never receives your email address. We don't record sessions or screens, and form fields are masked.
- Visitors in the EU, EEA, UK and Switzerland, and visitors whose location we can't determine: analytics are off. A banner asks you to Accept or Reject, and nothing is sent to PostHog unless you accept. You can change your choice any time with "Cookie settings".
- Members in those regions: sign-up offers an optional, unticked box to allow product analytics, separate from accepting the Terms. If you leave it empty, analytics stay off. You can change your choice any time in Settings → Privacy.
- Everywhere else, including the United States: analytics are on by default. To opt out, turn off "Product analytics" in Settings → Privacy, use a browser that sends Global Privacy Control, or contact us.
- Global Privacy Control: we treat this browser signal as a request to opt out of analytics, everywhere.
Withdrawing consent stops future collection. It doesn't undo earlier lawful processing.
Brand promo counts. When a Brand promo is shown or opened, we count it on our own servers so brands can see how it performs. These are daily totals per promo, with no cookie and no personal identifier stored with the count, so counting continues even if you decline analytics.
Page speed and errors. Vercel Speed Insights measures page speed without cookies. Sentry, our error monitoring, sets no cookies.
We don't use advertising or cross-site tracking cookies. You can block cookies in your browser, but signing in requires essential cookies.
8. How long we keep it
| Data | How long |
|---|---|
| Sign-up attempt records (email, email domain, IP hash) | Deleted after 30 days |
| Accounts whose email was never confirmed | Deleted after 7 days |
| Search queries and URL searches | Deleted after 90 days. Searches that found no good match are also kept, as the search words only (no account or session IDs), until we act on them, and are deleted 90 days after they were last seen |
| Cached search-query embeddings (the numbers we get back from OpenAI, stored under a hash of the query text) | Deleted 90 days after they were last used |
| Pages you ask us to read (URL searches) | Deleted after 7 days |
| Anonymous session cookie and the record that carries a pre-sign-up search into onboarding | Deleted after 30 days. When you sign up, the saved search and chats are carried into your onboarding and the record is deleted within 2 days |
| Customer invitations a brand sends through NestEggo (the recipient's name and email address, and the brand's note) | The name, email address and note are deleted 12 months after the invitation's last status change; the invitation's status is kept without them |
| Email addresses that unsubscribed from invitations | Kept only as a one-way hash (not the address itself), so we never email them again |
| Records of emails we sent (masked address, status) | Deleted after 90 days |
| Team invitations | Deleted 30 days after they expire, are withdrawn or are answered |
| Notifications you've read | Deleted after 180 days |
| Your account and profile | Until you delete your account in Account settings; your profile, brand memberships, notifications and settings are then deleted at once. Team invitations sent to your email address, and invitations a brand sent you, follow their own rows above (they are kept by email address, not by account) |
| A deleted account's email address | Kept only as a one-way hash of its normalized form (not the address itself) for 90 days after the deletion, so a new sign-up with the same address is reviewed by a person; then deleted |
| Requests to change the role of a brand's founder | Kept with the moderation record (account IDs, the requested change and the decision; no contact details) |
| Published content | Until you or a moderator delete or remove it |
| Deleted or removed content and earlier versions of edited content | Kept privately for moderation, safety and legal purposes for 2 years, then deleted or anonymized |
| Votes, flags and joins | For the life of your account; flags are kept with the moderation record |
| Admin audit log (records of moderation and admin actions) | 7 years; it is append-only and survives account deletion, holding account IDs rather than contact details |
| Contact form messages | 2 years, then deleted |
| Payment and token records | As long as tax and accounting law requires, typically 7 years |
| Analytics and server logs | Kept for a limited period set in our analytics and hosting providers' settings, then deleted |
When you delete your account, we delete your profile right away. Your published experiences and replies stay so the conversations still make sense, but they show as written by a "Former member", without your name, job title or photo. A brand you were the only member of is archived and its page taken down. Records we must keep for the reasons above are kept as described.
9. Your choices and rights
- In your account: update your profile and email preferences, leave a brand, and delete your account.
- Everyone: you can ask us to access, correct, delete or export your personal information, and we'll respond within the time the law requires.
- EU, UK and similar laws (GDPR): you also have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent at any time (without affecting earlier processing), and to complain to your local data protection authority.
- California (CCPA/CPRA) and other US states: you have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale or sharing for cross-context behavioral advertising (we do neither) and of certain profiling. We don't use or disclose sensitive personal information except to provide the Service (for example, your account sign-in). We won't discriminate against you for using these rights. You can use an authorized agent; we'll verify your identity (and the agent's authority) before acting, usually by confirming your account email.
- Categories (California). In the past 12 months we collected: identifiers (name, email, IP hash), professional information (job title, brand), commercial information (purchases), internet activity (usage, clicks), and inferences (sign-up risk score). Sources: you, your brand, your browser and our service providers. We disclosed them for business purposes to the service providers listed above.
To use any of these rights, use our contact form with the topic "Account or login".
10. Children
NestEggo is for people 18 and over and isn't directed at children. We don't knowingly collect information from anyone under 18. If you think a minor has an account, contact us and we'll delete it.
11. International transfers
We're based in the United States and our main providers store data in the United States. If you use NestEggo from outside the US, your information is transferred to and processed in the US, where privacy laws may differ. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data processing agreements.
12. Security
We protect your information with measures such as encryption in transit (HTTPS), access controls that limit each member and each brand to its own data, hashed passwords, keyed hashes instead of raw IP addresses in our database, CAPTCHA and rate limits, and an append-only log of administrative actions. No system is perfectly secure; if we learn of a breach that affects you, we'll notify you as the law requires.
13. Changes to this policy
If we change this policy in a meaningful way, we'll tell you by email or on the site before the change takes effect. The "Last updated" date shows the current version.
14. Contact
Questions or requests: contact us.
NestEggo, Inc., 447 Sutter St Ste 405 PMB1104, San Francisco, CA 94108.