Privacy without the fine print.

1. Who is responsible?

Nesli determines why and how personal data is used in the app and at nesli.app and is therefore the data controller.

Controller: Turned Online, trading under the registered trade name Nesli
Chamber of Commerce: 73882747
Address: P.O. Box 1236, 8001 BE Zwolle, the Netherlands
Telephone: +31 6 81393060
Email: hallo@nesli.app

Nesli currently has no data protection officer because the nature and scale of the processing do not require one. You may contact us directly with privacy questions.

2. Scope of this notice

This notice applies to the Nesli iPhone and Android apps, widgets, invitation links, push notifications, account and subscription functions, and nesli.app. Apple, Google and other parties also apply their own privacy notices when you interact with them directly.

Nesli is intended for everyday household coordination. Do not use it for medical records, financial secrets, identity documents or other special or highly sensitive data.

3. Which data does Nesli use?

Nesli does not use an advertising ID, create advertising profiles, or sell or rent personal data. The current website uses no analytics or marketing cookies.

4. Why does Nesli use data?

Performance of the contract

To create and protect accounts, synchronise households and lists, show widgets, process invitations, provide Plus features, restore purchases and offer support.

Consent

Your operating system asks for consent before push notifications are enabled. You can change permission and preferences at any time. Consent also applies when you voluntarily join a waitlist or request marketing updates.

Legitimate interests

To secure the service, prevent fraud and abuse, diagnose errors and keep synchronisation reliable, subject to a balancing of those interests against your privacy.

Legal obligation

Where necessary to meet tax, accounting, consumer, privacy or other legal duties and to establish, exercise or defend legal claims.

Nesli does not make solely automated decisions that produce legal or similarly significant effects and does not use your content to train AI models.

5. What can household members see?

Members of the same household can see the household name, member profiles and content stored in that household. Depending on the feature, they may also see who added, completed or deleted an item, who sent a poke and when a change occurred.

Only add other people's data when you have a valid reason to do so, and do not add information that is not meant for every member. The owner manages membership and may delete the household or transfer ownership.

6. Who receives data?

Nesli shares data only for the purposes above, on instruction, or where required by law. The principal parties are:

• Supabase for authentication, database, real-time synchronisation and server functions. Nesli's core environment is configured in the European Union.
• Cloudflare for DNS, security and worldwide delivery of the website.
• Apple for Sign in with Apple, App Store purchases, subscription status and Apple Push Notification service on iPhone.
• Google for Google sign-in, Google Play purchases and Firebase Cloud Messaging on Android.
• Necessary technical and professional providers for hosting, security, support, accounting or legal advice, subject to appropriate terms.
• Authorities or rights holders only where required by law or necessary for legal claims.

Apple and Google are independent controllers for data they process for their stores, accounts and payments.

7. Processing outside the EEA

Nesli's core data is stored in the European Union. Apple, Google, Supabase and their subprocessors may process certain account, push, support or technical data outside the European Economic Area.

Where the GDPR requires it, transfers rely on an adequacy decision, approved Standard Contractual Clauses or another lawful safeguard. Email hallo@nesli.app to request information about the relevant safeguards.

8. How long is data retained?

• Account and active household content: while the account or shared household exists and the information is needed to provide the service.
• Activity history: up to 90 days in the active database.
• Invitations: normally expire after 14 days; expired and used tokens are removed periodically.
• Device and push data: until sign-out, notifications are disabled, the device is inactive for an extended period, or the account is deleted.
• Subscription and accounting data: as long as needed for the subscription, fraud prevention, legal records and disputes.
• Waitlist: until you withdraw consent or no later than three months after launch. If Nesli has not launched within 24 months after registration, we delete the waitlist entry.
• Support and privacy correspondence: while needed to handle the request and then for a reasonable accountability and dispute period.

Protected copies may remain temporarily in routine backups until overwritten in the normal backup cycle. They are not used for ordinary service and are restored only for disaster recovery.

9. How is data protected?

Nesli applies appropriate measures including encrypted connections, secure authentication, household-level access restrictions, row-level database policies, separated server privileges, limited tokens and software updates.

No digital service is risk-free. Report a suspected issue promptly to hallo@nesli.app and do not disclose vulnerability details publicly before we can investigate.

10. Your privacy rights

Depending on the circumstances, you have rights of access, correction, erasure, restriction, portability and objection. You may withdraw consent at any time without affecting earlier lawful processing. You may complain to the Dutch Data Protection Authority or your local supervisory authority.

Email hallo@nesli.app, preferably from the address linked to your account. We may request proportionate identity verification. We normally respond within one month; the GDPR may permit an extension for complex requests.

Rights are not absolute. Some data may need to remain for legal duties, other household members' rights or legal claims. We will explain any full or partial refusal.

11. Deleting your account and data

Start deletion in the app through More → Account → Delete account. If you cannot access the app, email hallo@nesli.app from the account email with “Delete account and data” as the subject. This page is also the public deletion route for Google Play.

For a shared household, we may ask you to transfer ownership or confirm what should happen to the household so other members' data is not deleted unintentionally. Joint content needed by remaining members may remain without your account identity. Your profile, authentication data and data linked only to you are deleted unless a legal exception applies.

After verification, we process deletion without undue delay and within the legal deadline, and send confirmation when complete.

12. Children

Nesli is not directed specifically at children. A person under 16 may use an account only with the permission and guidance of a parent or legal guardian where required by law. Contact us if you believe a child provided data without valid permission.

13. Website, cookies and local storage

The current website places no advertising or analytics cookies. Light/dark and Dutch/English preferences are stored only in your browser's local storage and are not sent to Nesli by the website.

When you tick the consent box and submit the waitlist form, Nesli stores your email address, language and consent time in its secured Supabase environment. We use this information only to notify you about the Nesli launch. You can withdraw consent by emailing hallo@nesli.app.

The website is delivered through Cloudflare. Cloudflare processes necessary technical request data, such as your IP address, to keep the website secure and available. External links are governed by the linked website's privacy notice.

14. Changes and contact

We update this notice when the app, providers or legal duties change. The current version is always available here. We provide appropriate advance notice of material changes where required.