Privacy Policy

Last updated: 2026-11-05 · Effective: 2026-08-10

1. Who we are

NestLab is the trading name of an unincorporated software studio operated by Aleks NestLab (the "operator", "we", "us"). The data controller for this site is Aleks NestLab. Our full legal identity and contact details are on the Imprint page.

For data subject requests under the EU GDPR (Art. 15-22: access, rectification, erasure, restriction, portability, objection), write to dsar [at] nestlab [dot] tech. We acknowledge receipt within 7 days and reply substantively within 30 days as required by Art. 12(3) GDPR. General (non-GDPR) inquiries remain on admin [at] nestlab [dot] tech; see the Subprocessors page for the routing configuration.

2. What this site is

nestlab.tech is a static marketing site served by Cloudflare Workers Static Assets. It presents the NestLab portfolio, four flagship products, and our open-source work. The site is informational only — there is no signup form, no payment, no user-generated content.

The site uses cookieless product analytics via PostHog Cloud EU, gated behind cookie consent. No PII is collected; no cookies or localStorage are set by the analytics script. See Cookie Policy §4 for the consent mechanism, Subprocessors for the vendor entry.

The site also exposes a contact form (/contact.html) that processes an inquiry through our edge and forwards it to our transactional email provider; see §3.4 below.

Links on this site to our EU AIGap product point at its public early-access list, at euaigap.co/waitlist. The product’s free risk classifier is publicly usable at euaigap.co/classify; the product itself is in closed beta. Clicking such a link takes you to that page — this site's own pages are never redirected automatically, so every page here stays available to you and to search engines. The list is operated by EU AIGap and is governed by that product's own privacy policy and sub-processor register.

3. What data we collect

When you browse this site, we collect only:

Cloudflare request logs — IP address, User-Agent, request path, TLS fingerprint. Retained by Cloudflare for up to 30 days for security and abuse detection. This is processing necessary for the operation of the site (Art. 6(1)(f) GDPR, legitimate interest).
Email you send us — if you write to our published email alias (`support@nestlab.tech`). We retain email correspondence for as long as the business relationship requires, then archive it.

We do not collect: name, address, phone number, payment data, browsing history across other sites, advertising identifiers, or any special-category data.

3.4 Contact form (`/contact.html`)

When you submit the contact form, we collect and process the following data:

Data categories: your name, email, optional company, message body, and a transient IP address seen by the Cloudflare edge for the duration of the request.
Purpose: to respond to your inquiry (sales or support); to keep a record of enquiries so we can answer them and follow up where you have left us one; and to enforce rate limiting against abusive or automated submissions.
Legal basis: Art. 6(1)(b) GDPR (processing necessary for pre-contractual steps at your request) for handling your inquiry; Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and protecting the form) for the edge rate-limit counter.
Retention: the email correspondence is retained for the duration of the resulting business relationship and then archived; the transient edge IP used for rate limiting is discarded within 24 hours. The contact record described below is retained on the same schedule as the correspondence — it is deleted or anonymised when we archive the thread, and in any case within 24 months of your enquiry if no relationship follows.
Recipients: Cloudflare, Inc. as transit processor (it processes the POST request at the edge before delivery to our origin); Brevo (Sendinblue) in two roles — as email processor for delivering the resulting message to support@nestlab.tech (all contact-form messages, sales and support topics alike), and as contact-record store for the entry described below.
Contact records: each submission is also saved as a structured contact in our Brevo contact list — your name, email, optional company, and the topic and product you selected — so that enquiries are trackable and we can answer them. Your message body is not copied into that record; it stays in the email thread. We use these records only to respond to and follow up on your enquiry; we do not add you to a marketing list or newsletter as a result of contacting us. Ask us at dsar@nestlab.tech to see, correct or delete your record.

3.5 Self-serve booking (`/book-a-call.html`)

Two ways to take a slot, plus the request form (since 2026-11-05). One opens the studio's calendar in a window over this page — Cal.com's own booking interface, in a frame — so the visitor picks the time and confirms it without leaving the site. The other is the request form: a paragraph reaches us and we reply with two time slots. The account behind the calendar is the studio's own — NestLab, reached at the studio's domain address — so a visitor is never routed into a person's personal calendar.

If you book in the calendar window, you are typing into Cal.com's own form, and what you type goes directly from your browser to Cal.com, Inc. (US), which acts as our processor for the booking record. It does not pass through our server, and we do not see it. The calendar's page load, inside the frame, carries the request metadata and the IP address Cal.com logs like any web host. Cal.com sets its own cookies inside its own frame; this site sets none for it, and no third-party script runs on this domain. Cal's own consent flow applies inside the frame; our analytics banner governs this site only, so the booking window works whether or not you accept analytics cookies.

Our own booking API is also published, for agents (the endpoints are listed in our agents.json): it lists the available slots and creates the booking server-side. A booking made through it sends your name, e-mail address and the process description to our own server (which runs on Cloudflare's edge, so Cloudflare, Inc. acts as transit processor for that request as it does for every request to this site), and our server passes them to Cal.com, Inc. (US). Cal.com holds the event type and the availability and acts as our processor for that data.

Either way the call runs on Cal Video, which Cal.com carries through Daily, Co. (US): Daily receives the participants' names and your audio and video for the duration of the meeting. The recording and the transcription of the meeting are switched off, so no recording or transcript is produced or stored. Cal.com acts as our processor for that data and Daily as its sub-processor; see the Subprocessors page for the transfer mechanisms and the full scope of each.

The purpose is to arrange the call (Art. 6(1)(b) GDPR — steps at your request before a contract). The booking record is kept by Cal.com for as long as the studio's account is open, and the meeting link expires with the meeting.

4. Cookies

This site uses only Cloudflare's _cfuvid cookie, which is a functional cookie (bot detection, security). It does not require consent under ePrivacy. See Cookie Policy. The booking window on /book-a-call.html shows Cal.com's own calendar in a frame; any cookie that page sets belongs to Cal.com and is set in Cal.com's own context, not on this domain.

5. Subprocessors

We use the following subprocessors to operate this site:

Cloudflare, Inc. — CDN, edge compute, DNS. EU edge, US headquarters. DPA in place.
PostHog, Inc. — cookieless product analytics, EU region. Gated behind cookie consent. No PII; see Subprocessors for the full entry.
Cal.com, Inc. — self-serve call booking. US-hosted; EU-US Data Privacy Framework adequacy decision, with the 2021 EU Standard Contractual Clauses as the fallback. See Subprocessors for the full entry and § 3.5 for what the booking panel sends.
Daily, Co. — the video platform Cal Video runs on; it carries the meeting itself, so the participants' names, their audio and video for the duration of the call, and the IP addresses of the connections that carry it. The recording and the transcription of the meeting are switched off, so no recording or transcript is produced or stored. US-hosted; EU-US Data Privacy Framework adequacy decision. See Subprocessors for the full entry and § 3.5 for the scope.
Google Calendar and Google Meet — the calendar a confirmed booking is written to, and the video meeting it opens. Paused: the studio account's meeting runs on Cal Video and no Google Calendar is connected to it, so nothing reaches Google; the entry is kept because it describes the flow that opens if the studio ever connects a studio-owned Google Calendar. US-hosted; EU-US Data Privacy Framework adequacy decision. See Subprocessors for the full entry and § 3.5 for the scope.

Typography is served from our own origin — we do not use a third-party font service, so no font request leaves the visitor's browser to a third party.

Full subprocessor list for our products: Subprocessors.

For contact-form submissions specifically, Cloudflare processes the request at the edge and Brevo delivers the resulting email. See the Subprocessors page for full scope.

6. International transfers

Cloudflare processes EU-edge traffic. Cloudflare's own US-border transfer is covered by Standard Contractual Clauses.

A self-serve booking (§ 3.5) transfers your booking details to the United States: to Cal.com, Inc. and, for the call itself, to Daily, Co. Cal.com is certified under the EU-US Data Privacy Framework for non-HR data, and Daily, Co. is an active participant in that framework; the 2021 EU Standard Contractual Clauses are the fallback for both, and Cal.com completes its own SCC Schedule, which covers the sub-processor it uses for the video. These are the only US-border transfers this site makes beyond Cloudflare's own operations.

7. Retention

Cloudflare logs: 30 days. Email correspondence: business-relationship lifetime. After retention expires, data is deleted within 30 days.

Contact-form submissions: correspondence retained for the duration of the business relationship, then archived; the transient IP address used at the edge for rate limiting is discarded within 24 hours.

8. Your rights under GDPR

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with your supervisory authority. To exercise these rights write to dsar [at] nestlab [dot] tech (see § 1).

8.1 Supervisory authority (current jurisdiction)

Our current jurisdiction for EU data-protection matters is Poland. The competent supervisory authority is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO). If you are not satisfied with our response to a data-subject request, you may lodge a complaint with UODO. Their contact details are published at uodo.gov.pl.

If your habitual residence is in a different EU member state, you may also contact your national supervisory authority — under GDPR Art. 77 you can lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement, regardless of which member state the controller is established in.

The EU Commission's online dispute resolution platform at ec.europa.eu/consumers/odr is referenced on the Imprint page.

8.2 Jurisdiction changes

NestLab is registered and operating in Poland (EU). The registered entity, its NIP and REGON, and the registered statutory address are published on the Imprint page once business registration is complete. A relocation of jurisdiction to Cyprus is not in progress; any future change will be reflected on both pages and in the changelog below before it takes effect, with a fresh "Last updated" date and a summary of what changed.

9. Analytics on this site

The site uses cookieless product analytics via PostHog Cloud EU. The PostHog script tag stays type="text/plain" on every page until the visitor accepts the Analytics category in the consent banner; nothing fires before opt-in. Once activated, PostHog records page views, referrer, country, viewport size, and any custom events fired from the site. No PII, no cookies, no localStorage writes, no fingerprinting — PostHog's disable_persistence: true + person_profiles: "never" config means the script never identifies a visitor. EU residency (Frankfurt); 90-day retention. See Subprocessors for the vendor entry and Cookie Policy §4 for the consent mechanism.

10. Changes

Material changes will be posted on this page with a new "Last updated" date and a summary of what changed.

Changelog

2026-07-31 — Initial publication. NestLab portfolio site relaunch.
2026-08-01 — Disclosed contact-form processing. Subprocessor scope widened; zero new subprocessor entries.
2026-08-07 — Added dedicated data-subject rights contact channel (dsar [at] nestlab [dot] tech) under EU GDPR Art. 15-22. The address forwards via Cloudflare Email Routing to the same Gmail Workspace recipient already named on the Subprocessors page — no new subprocessor. § 1 and § 8 updated; the Privacy Policy and the Imprint now route GDPR requests to dsar@ and keep admin@ for general inquiries.
2026-08-08 — Surfaced the jurisdictional claim inside § 8 with two new sub-sections: § 8.1 Supervisory authority (current jurisdiction) names Poland and the President of the Personal Data Protection Office (UODO) as the competent authority, with the right to also complain to the visitor's national supervisory authority under GDPR Art. 77; § 8.2 Jurisdiction changes restates the registration-in-progress notice and explicitly reaffirms that a Cyprus relocation is not in progress (mirrored from the Imprint). Previous single-sentence UODO mention in § 8 was replaced by the new sub-section structure; no facts changed, only their prominence.
2026-08-10 — Replaced the § 2 paragraph that previously claimed "no analytics tracker" with an accurate statement: cookieless product analytics via PostHog Cloud EU, gated behind cookie consent, no PII. Replaced § 9 ("When we add analytics — currently NOT deployed") with a concrete § 9 describing the live PostHog integration (purpose, cookieless config, EU residency, retention). Added PostHog to § 5 (Subprocessors) as a sub-bullet pointing at the full entry. Cross-reference: see Cookie Policy §4 and Subprocessors for the matching entries.
2026-10-09 — Corrected the § contact-form recipient statement: all contact-form messages, for both the sales and the support topic, are delivered to support@nestlab.tech; there is no separate sales mailbox routing. The published-alias list under "Email you send us" now names only support@nestlab.tech, because sales@nestlab.tech no longer receives mail.
2026-10-24 — Added the "Contact records" disclosure to § 3.4: a contact-form submission is now also stored by Brevo as a structured contact record (name, email, optional company, topic, product). The message body is not copied into that record. The retention rule for the contact record is stated in § 3.4, and § 5 now names Brevo in its two roles. No new subprocessor.
2026-10-24 — Removed the Google Fonts entry from § 5 and the corresponding sentence from § 6: typography is served from our own origin, so no font request reaches a third party.
2026-10-25 — Disclosed that links to the EU AIGap early-access list (euaigap.co/waitlist) are the product's public entry point while it is in closed beta. The list is governed by the product's own privacy policy; this site itself is unchanged and is never redirected automatically. §2 updated.
2026-10-31 — Disclosed the self-serve booking panel on /book-a-call.html: a new § 3.5 states what the panel sends (name, email address and the free-text message typed into the panel), to whom (Cal.com, Inc. and Google Calendar and Google Meet, both US) and on what basis. § 5 now names both vendors; § 6 now states the US-border transfers the booking makes. Two new subprocessor entries on the Subprocessors page.
2026-11-01 — Paused the self-serve booking panel. The only Cal.com account available was a personal one, so a visitor of this studio site was being routed into a person's personal calendar under a personal name, and their name, e-mail and message were travelling to a US vendor. The panel is switched off; a call request now goes through our own form only, and nothing about it leaves the site. § 3.5, § 5 and § 6 are updated to say so: the two vendors stay named but are marked paused, and § 6 now states plainly that while the panel is off this site makes no US-border transfer beyond Cloudflare's own. The disclosure itself is unchanged — it describes what happens when the panel is switched back on, which will be when the studio operates its own Cal.com account. The "Last updated" date moves to 2026-11-01.
2026-11-03 — The self-serve booking panel is live again, on the studio's own Cal.com account. The account holder is NestLab and it is reached at the studio's own domain address, so the reason for the pause is gone. § 3.5 now describes the panel as live and names the video platform it runs on; § 5 lists the two vendors that actually receive data, and the third entry (Google Calendar and Google Meet) stays marked paused because no Google Calendar is connected to the studio account; § 6 states the US-border transfer that a self-serve booking makes. The recording and the transcription of the meeting are switched off on the event type, so no recording or transcript is produced or stored. The "Last updated" date moves to 2026-11-03.
2026-11-03 — The self-serve booking is now a picker on the page. The panel that linked out to Cal.com's own booking page is replaced by a slot picker that lists the available times and takes the booking without the visitor leaving /book-a-call.html. The data flow changed and § 3.5 now says so: the name, work e-mail address and process description are sent to our own server, which passes them to Cal.com — the browser no longer opens Cal.com, and no third-party script or cookie is loaded on this site to book a call. § 3.5 also discloses the company-address check behind the picker (the domain part of the address you type decides whether the calendar is offered). The set of vendors named in § 5 is unchanged — Cal.com, Inc. and Daily, Co. — and § 6 still states the US-border transfer a booking makes.
2026-11-05 — The studio's Cal.com calendar is back as a first-class way to book, and the picker no longer asks for a company address. The booking page offers two self-serve paths again: the studio calendar on Cal.com, where the visitor picks the time in Cal.com's own calendar and confirms there, and the picker on the page itself. § 3.5 now states both flows: opening the calendar carries the name and e-mail you already typed over in the link, in your browser, so they do not pass through our server and the booking is made directly with Cal.com — and the picker still sends name, e-mail and the process description to our own server, which passes them to Cal.com. No third-party script and no third-party cookie is loaded on this site either way, because the calendar is a navigation and not an embed. The company-address check is gone: the picker no longer looks at the domain of the address you type, and a free-mail address may book a slot. The set of vendors named in § 5 is unchanged — Cal.com, Inc. and Daily, Co. — and § 6 still states the US-border transfer a booking makes.
2026-11-05 — The studio's calendar now opens in a window over the booking page. The booking page shows Cal.com's own booking interface in a frame inside a dark window, instead of linking out to a new page. § 3.5 now describes that flow: what you type in the calendar goes directly from your browser to Cal.com, Inc. and does not pass through our server; Cal.com's cookies live in Cal.com's own frame context, this site sets none for it, and no third-party script runs on this domain. Our own booking API stays published for agents and is described with its own data flow. § 4 notes the frame's own cookies. The set of vendors named in § 5 is unchanged — Cal.com, Inc. and Daily, Co. — and § 6 still states the US-border transfer a booking makes.