NestFlow

NestFlow

Policies and public pages

NestFlow

Privacy Policy

Version 3.2 • Effective October 15, 2026 • iRoxanne Studios, LLC • North Carolina

Plain-language overviewEasy to scan

This Privacy Policy is entered into between you and iRoxanne Studios, LLC, a North Carolina limited liability company ("Company," "we," "us," or "our").

iRoxanne Studios, LLC owns and operates various digital applications and platforms, including, without limitation, Bonded, NestFlow, Booked! Now What?, and MyEventFlow (collectively, the "Services").

This Privacy Policy applies specifically to your access to and use of the NestFlow application, including through www.nest-flow.co and any related subdomains or associated mobile or web applications (the "Service").

Unless otherwise stated, references to the "Service" in this Privacy Policy refer to NestFlow. References to the "Services" refer collectively to all applications owned and operated by the Company.

1. Geographic Scope

The Services are intended solely for users located within the United States.

We do not intentionally market or direct the Services to individuals located outside the United States.

By using the Services, you represent that you are located in the United States at the time of account creation.

Temporary access while traveling internationally does not change the intended U.S.-only scope of the Services.

All personal information is processed and stored in the United States.

2. Categories of Information We Collect

We collect information necessary to operate the Services.

Identifiers

  • Name
  • Email address
  • Account credentials

Account and Profile Information

  • User role
  • Subscription status
  • Timezone
  • Household profile information (NestFlow)

User-Generated Content

  • Messages
  • Task and event details
  • Meal plans and recipes
  • Calendar events
  • Shopping lists
  • Uploaded photos and attachments

Technical Information

  • Session cookies for authentication
  • Local storage for user preferences and session state
  • Device and browser type
  • Push notification tokens
  • First-party analytics events

We do not use third-party advertising trackers or cross-context behavioral advertising.

Location Information

We do not collect precise GPS location unless explicitly implemented and disclosed in an updated policy.

Some Services may allow users to enter location information manually (for example, city or region) to enable location-based planning features.

3. How We Use Personal Information

We use personal information to:

  • Provide and maintain the Services.
  • Process subscriptions and payments.
  • Enable AI-powered functionality.
  • Deliver notifications.
  • Improve system performance and security.
  • Provide customer support.
  • Prevent fraud and abuse.
  • Comply with legal obligations.
  • Contact people who sign up as testers about the test they joined and, only if they choose to opt in, about future app testing opportunities from iRoxanne Studio. Tester sign-up information (name, email address, and opt-in choice with its date) is kept until you ask us to remove it. You can unsubscribe at any time by emailing info@iroxannestudio.com.

We do not sell personal information.

4. Artificial Intelligence Processing

Certain features use artificial intelligence technologies provided by OpenAI.

When AI-enabled features are used:

  • User-submitted content may be transmitted to OpenAI for processing.
  • OpenAI retains submitted content pursuant to its standard API retention policies (which may change over time).
  • AI-generated outputs are stored within user accounts for functionality.
  • AI-generated content may be inaccurate or incomplete.

We do not use user content to independently train proprietary AI systems.

5. Google User Data

NestFlow lets users optionally connect Google Calendar or Gmail. Google shows the permissions requested before a connection is approved, and users may decline or disconnect at any time.

Information We Access

  • Basic Google account information, such as the connected email address.
  • The connected Google account email address and Google Calendar event identifiers and responses needed to publish and maintain NestFlow plans in your primary Google calendar.
  • Gmail sending permission, the connected email address, recipient addresses, and message content and attachments you choose to send as family newsletters or invitations.

How We Use Google Data

  • Publish selected NestFlow events, occasions, meal plans, and dated tasks to Google Calendar through one-way synchronization from NestFlow to Google. Chores are excluded. This connection does not import your Google Calendar into NestFlow.
  • Create, update, or remove Google Calendar events when the user enables calendar synchronization.
  • Send user-directed newsletters and invitations through the connected Gmail account.
  • Confirm connection status and identify the connected Google account.

Storage, Sharing, and Retention

  • OAuth credentials are handled securely by our authentication and integration service providers and are not displayed to other users.
  • NestFlow stores the family plans and newsletter or invitation content you create, recipient addresses, delivery status, Google event identifiers, synchronization mappings, and connection settings needed to provide these features.
  • Base44 provides NestFlow’s application hosting, database, backend functions, authentication, and Google connector infrastructure. Base44 processes the connection credentials and feature data needed to operate these integrations on our behalf. Google processes Calendar requests and messages submitted to Gmail.
  • When you send a newsletter or invitation, its content and selected attachments are disclosed to the recipients you select and processed by their email providers. Family plans and content saved in the shared NestFlow account may be visible to household members using that account, subject to profile controls.
  • We do not sell Google user data or use it to build advertising profiles.
  • Stored Google-derived data is retained while the feature or account remains active, unless the user deletes it sooner.

User Control and Deletion

Users can disconnect Google Calendar or Gmail from NestFlow settings and may also revoke access through their Google Account permissions. Disconnecting stops future authorized access through that connection; it does not recall delivered emails or automatically delete existing Google Calendar events. Users may delete their NestFlow content or request account deletion to remove associated stored data, subject to the retention exceptions described below. Recipients may retain messages they have received.

NestFlow’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. Payment Processing

Web Payments (Stripe)

  • Payments processed via web are handled by Stripe.
  • We do not store full payment card numbers.
  • Stripe processes payment information under its own privacy policy.
  • We receive limited subscription and transaction metadata necessary to manage subscriptions.

Mobile App Purchases

  • Subscriptions are purchased on our website and processed by Stripe. Purchases are not made inside the mobile app.
  • The mobile app reads your subscription status from your account so it can unlock access.
  • We do not receive or store full card information.

7. Data Sharing

We share personal information only with service providers necessary to operate the Services, including:

  • Stripe
  • Google, when a user connects Google Calendar or Gmail
  • OpenAI
  • Base44, our application hosting, database, authentication, and integration provider
  • Email recipients you select and their email service providers, when you send content

We may also disclose personal information:

  • If required by law.
  • In response to subpoenas, court orders, or governmental requests.
  • To protect rights, property, or safety.
  • In connection with a merger, acquisition, or asset sale.

We do not sell or rent personal information.

8. Data Retention

We retain personal information while accounts remain active.

Upon account deletion:

  • Account records are removed from active systems.
  • Deleting the owner’s NestFlow account removes the associated family data from active NestFlow systems. Copies already delivered to email recipients or published to Google Calendar may remain with those recipients or in Google until separately removed.
  • Financial records may be retained as required by law.
  • Backup systems may retain residual copies for a limited period.

9. Security Measures

We implement reasonable safeguards, including:

  • HTTPS encryption
  • Encrypted storage at rest
  • Role-based access control
  • Business-scoped data segregation
  • Secure authentication procedures

No system is completely secure.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have rights to:

  • Request disclosure of personal information categories collected.
  • Access personal information.
  • Request deletion (subject to exceptions).
  • Request correction of inaccurate information.
  • Be free from discrimination for exercising rights.

Requests may be submitted to: info@iroxannestudio.com

We will respond within 45 days of a verified request.

We do not share personal information for cross-context behavioral advertising.

11. Children's Privacy

The Services are not directed to individuals under eighteen (18) years of age.

NestFlow accounts are controlled by parents or guardians.

We do not knowingly collect personal information directly from minors without parental authority.

12. Third-Party Links and Vendors

The Services may reference or link to third-party vendors (for example, travel providers or event vendors).

We are not responsible for the privacy practices of third parties.

Users should review third-party privacy policies before engaging with external services.

13. Data Breach Notification

In the event of a confirmed data breach involving personal information, we will:

  • Investigate promptly.
  • Take reasonable mitigation measures.
  • Notify affected users without unreasonable delay as required by U.S. law.
  • Notify regulatory authorities where legally required.

14. Changes to This Policy

We may update this Privacy Policy periodically.

Material changes, including changes to how NestFlow accesses, uses, stores, or shares Google user data, will be described in an in-app notice and the revised policy before the changed practices take effect. Where additional permission is required, we will request it before accessing data for the new purpose.

Continued use of the Services constitutes acceptance of revised terms.

15. Contact

For privacy inquiries, contact:

info@iroxannestudio.com

Mailing address:

10612 Providence Rd STE D - PMB 747, Charlotte, NC 28277

NestFlow keeps every public page calm, clear, and consistent across devices.