Privacy Policy

1. Who We Are

Nestalma is the data controller responsible for your personal data. We are based in the United Kingdom and operate the Nestalma platform.

If you have any questions about this Privacy Policy or how we handle your data, please contact us via our Contact page.

2. What Information We Collect

We collect the following categories of personal data:

• Account data: your email address and display name when you register.
• Profile preferences: travel setup, lifestyle choices, and filters you set within the platform.
• Usage data: cities you save to favourites, destinations you view, and features you use.
• User-submitted content: stories or guides you submit for publication, including any personal information contained within them.
• Technical data: IP address, browser type, device type, and pages visited, collected automatically when you use the platform.
• Communications: any messages you send us via the Contact page.

If you buy a city guide, payment is handled by our payment provider. We never see or store your card details. We receive your email address, the guide you bought, the amount paid and the payment status.

3. How We Use Your Information

We use your personal data to:

• Provide and maintain your account and access to the platform.
• Personalise your experience based on your preferences and saved destinations.
• Send you platform updates, new destination announcements, and community content you have opted into.
• Respond to enquiries and support requests.
• Improve and develop the platform through anonymised analytics.
• Comply with our legal obligations.

We will never sell your personal data to third parties or use it for unrelated commercial purposes.

4. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

• Contract: processing necessary to provide your account and the services you have registered for.
• Legitimate interests: improving the platform, preventing fraud, and ensuring security — where these interests are not overridden by your rights.
• Consent: sending you marketing or community emails, where you have opted in. You can withdraw consent at any time by contacting us or using the unsubscribe link in any email.
• Legal obligation: where we are required to process data to comply with UK law.

5. Who We Share Your Data With

We share your data only with trusted third-party service providers who process it on our behalf, under written data processing agreements. These include:

• Supabase: stores your account data, preferences and favourites.
• Our payment provider: processes payments when you buy a city guide.
• Website hosting and analytics providers: host the site and provide anonymous visit statistics.
• Service providers for our forms and bookings: protect forms from spam, deliver messages you send us, and manage call bookings.

We do not share your personal data with any other third parties for their own marketing purposes. We may disclose data if required to do so by law, court order, or regulatory authority.

6. International Data Transfers

Supabase may store and process your data outside the United Kingdom. Where data is transferred internationally, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved under UK GDPR, to provide an equivalent level of protection to that required within the UK.

7. How Long We Keep Your Data

We retain your personal data for as long as necessary to provide the service:

• Account data: retained for the duration of your account and deleted within 30 days of account closure upon request.
• Usage and preferences data: retained while your account is active.
• Anonymised analytics: retained indefinitely in aggregate, non-identifiable form.
• Communications: retained for up to 2 years to allow us to respond to follow-up queries.

8. Your Rights Under UK GDPR

Under UK GDPR you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no compelling reason for us to continue processing it.
• Right to restriction: request that we limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: we do not make any automated decisions that have a legal or similarly significant effect on you.

To exercise any of these rights, please contact us via the Contact page. We will respond within one calendar month.

9. Cookies

Nestalma uses essential cookies required for the platform to function, including authentication session cookies. We do not currently use advertising or tracking cookies from third parties.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from logging in or using certain features.

10. Children's Privacy

Nestalma is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email when we make material changes. The "last updated" date at the top of this page will always reflect the most recent version.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us in the first instance via the Contact page. If you remain dissatisfied, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.