Privacy Policy

Effective from 31 October 2026.

This policy explains how we process personal data when you visit nestro.cz or use the Nestro web and mobile apps. It applies to users, visitors, people who contact support and people whose data is entered into Nestro by someone else, such as a landlord or property manager.

1. Who is responsible for processing

Nestro is operated by AIVANNA s.r.o., company ID (IČO) 23754885, with its registered office at Litobratřice 196, 671 78 Litobratřice, Czech Republic. For questions about personal data protection, contact us at support@nestro.cz. You can also send requests to exercise your rights to this address.

When administering user accounts, operating and securing the service, handling support communications and complying with its own legal obligations, AIVANNA s.r.o. acts as the data controller. It determines the purposes and means of that processing.

When a landlord, property manager, estate agent or organisation uses Nestro to keep records of tenants, contact persons, agreements and payments, that party generally determines the purposes of the processing. Nestro processes the data on its behalf as a processor and follows its instructions. The actual relationship and purpose of the processing determine these roles, regardless of the role labels in the app.

This policy provides information about data processing. It does not replace an Article 28 GDPR data processing agreement between Nestro and a customer who controls other people's data. If you need such an agreement to use the service, contact support.

2. What data we process and where it comes from

• Account and sign-in: first name, surname, email address, username, account type, verification status, settings and registration details. For password sign-in we store a cryptographic hash of the password, as well as data needed for verification, access recovery and sessions.

• Sign-in with Google or Apple: account identifier, email address, name where available and, if applicable, profile photo. Apple may provide a relay email address. The data received depends on the sign-in method and the provider's settings.

• Profile and contacts: photo, phone number, address, date of birth, gender, contact and delivery details, and any other information you provide, such as a short bio, employment, education, languages or interests. For companies this also includes company and tax IDs (IČO and DIČ) and contact or representative details.

• Property and tenancy management: property addresses and photos, ownership and tenancy relationships, tenant and other contact details, agreements, handover and other documents, payment schedules, deposits, insurance, payments, account numbers, notes, maintenance issues, requests, inspections and tasks.

• Communication and collaboration: messages, comments, attachments, shared contacts, participation in conversations and workspaces, permissions, invitations, reactions, read receipts, typing and online status, notifications and reports of abusive content or users.

• Bank connections: connection and account details and transactions available through a connection you have authorised, such as date, amount, counterparty, account, payment reference and payment message. For email imports, we process forwarded bank notifications and technical logs of that processing.

• Technical and operational data: IP address, browser and device information, request timing and activity, error and security logs, session identifiers, interface settings and notification delivery data. For mobile notifications we also process a device token and an installation identifier.

• Support and account closure: the contents of your communications and requests, and any reason you choose to give for deleting your account.

We obtain data directly from you, through use of the service and from people who invite you to Nestro, save you as a contact or share content with you. When you use the relevant feature, we also obtain data from sign-in and bank connection providers and from the public ARES register when completing company details. Nestro may therefore process data about people who have not yet created an account.

The scope depends on which features you use and what you enter into the service. We need the data marked as required during registration or a specific action to carry it out. Without that data, you may be unable to create an account or use the feature. Other profile data and optional features can be omitted. Do not include health data, copies of identity documents or other sensitive information in notes and attachments unless it is necessary for the purpose and you have an appropriate lawful basis for processing it.

3. Why we use the data and our lawful bases

• Creating and administering your account, signing in, verification, providing features, storing content and handling service-related requests: steps prior to entering into a contract and performance of a contract under Article 6(1)(b) GDPR where you are a party to the contract.

• Working with representatives of organisations, handling routine enquiries and communicating with contact persons about operations: our legitimate interest under Article 6(1)(f) GDPR in providing the service and communicating with its users and customers.

• Securing accounts, limiting misuse, diagnosing errors, handling reports and protecting legal claims: our legitimate interest under Article 6(1)(f) GDPR in secure and reliable operation, protecting users and defending rights.

• Aggregate website traffic measurement: our legitimate interest under Article 6(1)(f) GDPR in understanding usage and improving the service. The tool is described in the section on cookies and analytics.

• Compliance with legal obligations, such as responding to lawful requests from authorities and handling rights requests under the GDPR: Article 6(1)(c) GDPR.

• Processing for which we separately request your consent: Article 6(1)(a) GDPR, only for the purpose and period stated when consent is given. You can withdraw your consent at any time. This does not affect the lawfulness of earlier processing.

Reading this policy or accepting the terms of service does not constitute consent to every type of processing. We do not make account creation conditional on consent to advertising. Verification, security and service messages and invitations from other users help the service operate and do not themselves subscribe you to a newsletter.

For data we process on behalf of a customer as a processor, the customer determines the appropriate lawful basis as controller. This may include performance of a lease agreement, a legal obligation or the customer's legitimate interest. Storing data in Nestro does not itself create a lawful basis.

4. Sharing, profiles and workspaces

We make content you share in a workspace, on a property, task or request, or in a conversation available to the relevant participants according to the feature and configured permissions. The workspace administrator may also have access. Personal accounts and workspaces have separate contexts. Some features, such as conversations, work across these contexts.

Profile information introduces you to others. Your name, username and profile photo also appear in public links and shared-profile previews. Other details you enter may be available on your profile. Only include information intended for sharing in the public part of your profile. Turning off profile discoverability does not itself remove shared links or previously generated previews.

When your account is linked to a contact, Nestro may synchronise profile data to another user's address book if your sharing settings and the contact's settings allow it. In the privacy settings, you can control which data you share with contacts and who can send you messages. Restricting further synchronisation does not remove data the other person has already saved or exported separately.

Recipients may process shared content further under their own responsibility. The same applies to public links, downloaded documents, exports and content you send by email or through other services.

5. Bank connections, AI and other optional features

You or an authorised workspace member can initiate a bank connection. For API connections we use Salt Edge and the bank or provider shown during setup. The authorisation granted determines the scope and duration of access. You sign in to the bank through the relevant provider. Email import processes notifications sent to an assigned matching address. Disconnecting access does not itself delete previously imported payments or related records.

When you start an AI import of properties, expenses or price lists, we send the content of the selected files, including any personal data in them, their filenames and technical request data to the model provider through Vercel AI Gateway. We use Google models with OpenAI as a fallback. The request also includes the user identifier. Upload only documents you are permitted to process for this purpose and remove unnecessary personal data beforehand.

AI import generates a draft for you to review and save. It does not decide whether to let a property to someone, grant credit or confer a right. Nestro does not assess creditworthiness or make other decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Automated payment matching and reminders support recordkeeping.

When we send email or SMS reminders, we provide the delivery service with the recipient's contact details and the message content. Mobile push notifications may include the sender's name and a preview of a message or request and may appear on the lock screen. You can restrict their display in your device settings. Map features process the address searched for or the property's location. When you open an external link, the relevant service's rules also apply.

6. Who may receive the data

In addition to the recipients you choose through sharing, we use providers necessary to operate individual features. The data we disclose to them depends on the feature you use and the content you enter:

• Vercel – app hosting and infrastructure, technical logs, web analytics and AI Gateway.

• Supabase – database, file storage and real-time content updates.

• Hostinger – email infrastructure, sending messages and mailboxes that receive bank notifications.

• Salt Edge and the selected bank or bank access provider – connecting bank accounts and retrieving transactions.

• Google and Apple – the selected sign-in method. Google also provides map features, and Apple delivers iOS push notifications.

• Google and OpenAI through Vercel AI Gateway – processing source materials when an AI import is initiated.

• Sent.dm and its downstream delivery network – sending SMS reminders if you use this feature.

• Authorised personnel who provide support and administer the service, and where applicable legal advisers and public authorities, when disclosure is necessary for a specific legal obligation or to protect rights.

Some providers, particularly banks, bank access providers and sign-in services, may act as independent controllers for their own purposes. Their terms and policies shown when you use the service explain their own processing.

7. Transfers outside the European Economic Area

When we use global infrastructure, AI models, sign-in and delivery services, data may also be processed outside the European Economic Area, particularly in the United States. Data may therefore be processed outside the Czech Republic or the EU.

Transfers must have appropriate legal safeguards under Chapter V GDPR: a European Commission adequacy decision applicable to the recipient, or appropriate safeguards, in particular standard contractual clauses and any supplementary measures. You can request information about a specific recipient, the country of processing and the safeguards in use, including how to obtain a copy, at support@nestro.cz.

8. How long we keep data

• We retain your account and the content necessary to provide the service for as long as we maintain the account and you use the relevant feature. You can delete individual records using the available controls or discuss erasure with the relevant controller.

• When you confirm account deletion, we mark the account as deleted and end its sessions. A 30-day recovery period follows. After it expires, the account is included in our routine permanent deletion process. Confirming the request does not immediately delete every copy.

• We retain data needed to handle a support request or a specific incident for as long as it takes to resolve the matter and, where applicable, to protect rights afterwards. For legal claims, the applicable limitation period and duration of proceedings determine retention. For legal obligations, the relevant law determines the period. This applies to the records needed for the purpose and does not automatically extend to the entire account.

• For technical logs, verification data and backups, retention depends on their security and operational purpose, their validity and the relevant service's retention cycle. Expiry of an access token or code does not by itself confirm that the associated record has been erased. On request, we will tell you the specific period for the data concerned.

• For data processed on behalf of a customer, retention depends on the customer's instructions, how long the service is provided and the relevant legal obligations. Deleting your own account does not remove your landlord's separate records or copies another recipient has lawfully saved outside your account.

You can request account deletion in privacy settings. If you cannot access your account or need to address specific data, contact support. You can exercise the right to erasure without deleting the entire account. Requests are assessed according to the specific purpose and lawful basis for processing.

9. Cookies and traffic measurement

The website uses cookies and similar storage for sign-in, security, invitations, workspace selection and remembering interface preferences. Essential technical storage makes it possible to provide the requested service. Blocking it in your browser may limit sign-in and other features.

The website uses Vercel Web Analytics to measure traffic in aggregate. According to the provider's documentation, it does not use analytics cookies. It processes information such as the page visited, referrer, device type, browser and approximate geographic area. A short-lived visitor identifier is generated from the request and discarded after 24 hours. See the Vercel Web Analytics privacy documentation. This analytics method differs from storing analytics or marketing cookies.

10. Security

We use user authentication, access permission checks, request limits and separation of personal and workspace content. Passwords are stored as cryptographic hashes. Access to private files is controlled by permissions and time-limited links. Data is transmitted through the web interface over HTTPS.

Nestro content is generally not protected by end-to-end encryption between participants. Operations such as storage, previews, message delivery and AI imports you initiate require processing content on servers. Protect access to your account and consider what data, attachments and permissions you share.

11. Your rights and how to exercise them

Under the conditions set by the GDPR, you may request access to your personal data and a copy, correction of inaccurate data, erasure or restriction of processing. For automated processing based on consent or a contract, you also have the right to portability of data you have provided and, where technically feasible, direct transfer to another controller.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to any direct marketing at any time. If processing is based on consent, you may withdraw it at any time as easily as you gave it.

Send your request to support@nestro.cz. State which data or account the request concerns and which right you wish to exercise. If we have reasonable doubts, we may request proportionate identity verification. We handle routine requests free of charge, without undue delay and normally within one month of receipt. For complex or numerous requests, the GDPR allows an extension of up to two further months. We will inform you of the extension and the reason for it within the first month.

If your request concerns records maintained by your landlord, property manager or an organisation, contact that party directly as the controller as well. We will help identify the relevant controller and handle your request within the scope of our role. You can exercise your rights without a Nestro account of your own.

You have the right to lodge a complaint with a supervisory authority, in particular where you habitually reside, work or where the alleged infringement took place. In the Czech Republic this is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7. You do not need to contact Nestro before lodging a complaint.

12. Changes to this policy

The current version is available at nestro.cz/help/privacy. If we materially change how we process data, we will inform you through the app or by another appropriate means. If the new processing requires consent, we will request it separately. Use of the service is also subject to the terms of service.