NestFlow

Privacy Policy

Version 3.0 • Effective February 23, 2026 • iRoxanne Studios, LLC • North Carolina

PricingPrivacy PolicyTerms of ServicePrivacy Choices

This Privacy Policy is entered into between you and iRoxanne Studios, LLC, a North Carolina limited liability company ("Company," "we," "us," or "our").

iRoxanne Studios, LLC owns and operates various digital applications and platforms, including, without limitation, Bonded, Nest-Flow, Booked! Now What?, MyEventFlow, and MyBizzFlow (collectively, the "Services").

This Privacy Policy applies specifically to your access to and use of the Nest-Flow application, including through www.nest-flow.co and any related subdomains or associated mobile or web applications (the "Service").

Unless otherwise stated, references to the "Service" in this Privacy Policy refer to Nest-Flow. References to the "Services" refer collectively to all applications owned and operated by the Company.

1. Geographic Scope

The Services are intended solely for users located within the United States.

We do not intentionally market or direct the Services to individuals located outside the United States.

By using the Services, you represent that you are located in the United States at the time of account creation.

Temporary access while traveling internationally does not change the intended U.S.-only scope of the Services.

All personal information is processed and stored in the United States.

2. Categories of Information We Collect

We collect information necessary to operate the Services.

Identifiers

  • Name
  • Email address
  • Account credentials

Account and Profile Information

  • User role
  • Subscription status
  • Timezone
  • Household profile information (NestFlow)

User-Generated Content

  • Messages
  • Task and event details
  • Meal plans and recipes
  • Calendar events
  • Shopping lists
  • Uploaded photos and attachments

Technical Information

  • Session cookies for authentication
  • Local storage for user preferences and session state
  • Device and browser type
  • Push notification tokens
  • First-party analytics events

We do not use third-party advertising trackers or cross-context behavioral advertising.

Location Information

We do not collect precise GPS location unless explicitly implemented and disclosed in an updated policy.

Some Services may allow users to enter location information manually (for example, city or region) to enable location-based planning features.

3. How We Use Personal Information

We use personal information to:

  • Provide and maintain the Services.
  • Process subscriptions and payments.
  • Enable AI-powered functionality.
  • Deliver notifications.
  • Improve system performance and security.
  • Provide customer support.
  • Prevent fraud and abuse.
  • Comply with legal obligations.

We do not sell personal information.

4. Artificial Intelligence Processing

Certain features use artificial intelligence technologies provided by OpenAI.

When AI-enabled features are used:

  • User-submitted content may be transmitted to OpenAI for processing.
  • OpenAI retains submitted content pursuant to its standard API retention policies (which may change over time).
  • AI-generated outputs are stored within user accounts for functionality.
  • AI-generated content may be inaccurate or incomplete.

We do not use user content to independently train proprietary AI systems.

5. Payment Processing

Web Payments (Stripe)

  • Payments processed via web are handled by Stripe.
  • We do not store full payment card numbers.
  • Stripe processes payment information under its own privacy policy.
  • We receive limited subscription and transaction metadata necessary to manage subscriptions.

App Store Payments (Future Native Apps)

  • If a Service becomes available via Apple App Store or Google Play, payment processing will be handled by the applicable platform provider.
  • We do not receive or store full card information.
  • We may receive subscription status and transaction identifiers.

6. Data Sharing

We share personal information only with service providers necessary to operate the Services, including:

  • Stripe
  • Apple or Google (if applicable)
  • OpenAI
  • Hosting and infrastructure providers

We may also disclose personal information:

  • If required by law.
  • In response to subpoenas, court orders, or governmental requests.
  • To protect rights, property, or safety.
  • In connection with a merger, acquisition, or asset sale.

We do not sell or rent personal information.

7. Data Retention

We retain personal information while accounts remain active.

Upon account deletion:

  • Account records are removed from active systems.
  • Shared content may remain accessible to authorized users.
  • Financial records may be retained as required by law.
  • Backup systems may retain residual copies for a limited period.

8. Security Measures

We implement reasonable safeguards, including:

  • HTTPS encryption
  • Encrypted storage at rest
  • Role-based access control
  • Business-scoped data segregation
  • Secure authentication procedures

No system is completely secure.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have rights to:

  • Request disclosure of personal information categories collected.
  • Access personal information.
  • Request deletion (subject to exceptions).
  • Request correction of inaccurate information.
  • Be free from discrimination for exercising rights.

Requests may be submitted to: contactus@nest-flow.co

We will respond within 45 days of a verified request.

We do not share personal information for cross-context behavioral advertising.

10. Children's Privacy

The Services are not directed to individuals under eighteen (18) years of age.

NestFlow accounts are controlled by parents or guardians.

We do not knowingly collect personal information directly from minors without parental authority.

11. Third-Party Links and Vendors

The Services may reference or link to third-party vendors (for example, travel providers or event vendors).

We are not responsible for the privacy practices of third parties.

Users should review third-party privacy policies before engaging with external services.

12. Data Breach Notification

In the event of a confirmed data breach involving personal information, we will:

  • Investigate promptly.
  • Take reasonable mitigation measures.
  • Notify affected users without unreasonable delay as required by U.S. law.
  • Notify regulatory authorities where legally required.

13. Changes to This Policy

We may update this Privacy Policy periodically.

Material changes will be posted with an updated effective date.

Continued use of the Services constitutes acceptance of revised terms.

14. Contact

For privacy inquiries, contact:

contactus@nest-flow.co

HomePricingPrivacy PolicyTerms of ServicePrivacy Choices