Privacy Policy

We use personal information to create and secure accounts; provide, personalise, publish, and administer registries; show the correct regional defaults and currency; support invitations, RSVPs, gift coordination, and owner notifications; answer support requests; remember privacy choices; detect abuse and fraud; troubleshoot and improve the service; measure feature use when permitted; send marketing only with the required permission; attribute affiliate activity; enforce our terms; and meet legal, accounting, and safety obligations.

Where applicable law requires a legal basis, we process information as needed to perform our contract with you or take steps you request, for our legitimate interests in operating and securing NestBub, with your consent, or to comply with a legal obligation. Our legitimate interests include preventing abuse, maintaining the service, understanding aggregate product use, and supporting ordinary business operations, balanced against your rights. You may withdraw consent at any time, although this does not affect processing already carried out lawfully. Some essential information is required for us to provide an account or requested feature.

Registry owners choose whether a registry is public, unlisted, or private. Public registries and the information deliberately displayed on them can be viewed broadly and may be indexed or copied by others. Unlisted registries can be viewed by anyone who has the link. Private registries are restricted to authorised access. Delivery details are displayed only according to the owner's visibility choice. Please avoid publishing information you do not want other people to see.

We use strictly necessary cookies and comparable storage to keep you signed in, protect forms, remember the current registry and region, apply rate limits, and store your cookie preferences. Optional analytics and marketing categories are off unless you choose them, and are used only when the related feature is enabled. When enabled with your permission, Google Analytics uses first-party identifiers and usage events to help us understand visits and feature use; advertising storage and personalisation remain disabled. You can accept, reject, or change optional categories at any time at /privacy/cookies. Withdrawing analytics consent stops further collection through the Google tag and removes accessible Google Analytics cookies from your browser, but does not affect earlier lawful processing.

We disclose information to other users and visitors only as needed for the registry visibility and interactions you choose. We may also use service providers for hosting, databases, backups, security, and website operations. Depending on which features are enabled, these providers can include Mailgun for email, Cloudflare R2 for image storage, Google for optional sign-in and consented Google Analytics measurement, Sentry for privacy-scrubbed error monitoring, and ipapi.co for IP-to-country lookup.

When someone follows an outbound retailer or affiliate link, the retailer or affiliate network may receive the link identifier and ordinary browser-request information, such as IP address, user agent, and referrer, under its own privacy policy. Current affiliate integrations can include Commission Factory, Amazon Associates, and direct retailer programs.

We may disclose information when reasonably necessary to comply with law, respond to lawful requests, protect a person or the service, investigate misuse, or establish or defend legal claims. If NestBub is involved in a merger, financing, reorganisation, or sale of assets, information may be disclosed as part of that transaction subject to appropriate confidentiality and notice requirements.

NestBub does not sell personal information for money and does not currently share personal information for cross-context behavioural advertising. If applicable law treats a disclosure as a sale or sharing, we will provide the notice and choice that law requires.

NestBub is available internationally, and personal information may be processed outside the country where you live when we or our providers operate there. Privacy protections can differ between countries. Where applicable law requires a transfer safeguard, available mechanisms may include an adequacy decision, contractual protection, or another lawful arrangement. We limit providers to the information needed for their services and you may contact info@nestbub.com for more information about a relevant transfer.

We keep information only for as long as reasonably needed for the purposes in this policy, including providing the service, maintaining security, resolving disputes, and meeting legal, tax, and accounting requirements. Retention can therefore vary by record and location.

Account data is normally kept for the life of the account. A self-service deletion request disables the account immediately and schedules its remaining personal data for deletion after a 30-day recovery period. Registry ownership transferred to an active partner remains under that partner's account. Data in rotating backups may remain until the applicable backup expires and is securely replaced. We may retain narrowly limited records where law, fraud prevention, payment disputes, or enforcement requires it.

Registry gift, RSVP, and affiliate records are generally retained while the related registry or account remains active or for the period needed to support the interaction and legal records. Registry-view IP hashes and user agents are deleted after 365 days. Short-lived security and rate-limit records expire with their operational window, and service logs are rotated and retained for limited operational and security periods.

We use reasonable technical and organisational safeguards designed to protect personal information, including encrypted transport, password hashing, access controls, request validation, rate limiting, provider-secret controls, backups, and monitoring with sensitive fields scrubbed where supported. No website, storage system, or transmission method can be guaranteed completely secure, so please use a unique password and protect registry links and account credentials.

NestBub accounts are intended for adults aged 18 or older and the service is not directed to children for independent use. An adult may choose to add limited information about a baby or child to a registry. Please add only information you are authorised to share and avoid unnecessary sensitive details. If you believe a child has provided personal information to us without appropriate authorisation, contact info@nestbub.com.

All users can update core profile details and notification choices in account settings, change cookie choices at /privacy/cookies, unsubscribe from marketing, and request access, correction, an export or portable copy, or deletion by emailing info@nestbub.com. We may need to verify your identity or an authorised agent's authority before completing a request. We will respond within the period required by applicable law and generally aim to complete verified requests within 30 days. Some rights and exceptions depend on your location, the type of information, and why it is processed.

Depending on where you live, your rights may include being informed; accessing, correcting, or deleting information; restricting or objecting to processing; receiving portable data; withdrawing consent; opting out of targeted advertising or qualifying sale or sharing; limiting certain uses of sensitive information; appealing a refusal; and making a complaint without discrimination. NestBub does not use personal information to make solely automated decisions that produce legal or similarly significant effects.

These protections may arise under laws including the Australian Privacy Principles, New Zealand Privacy Act 2020, Singapore Personal Data Protection Act 2012 (PDPA), EU General Data Protection Regulation (EU GDPR), UK GDPR and Data Protection Act 2018, applicable United States state privacy laws including the California Consumer Privacy Act (CCPA) where it applies, Canadian federal or provincial privacy laws including PIPEDA where it applies, and other applicable local privacy laws. Naming these laws does not limit rights available elsewhere or mean that every law applies in every situation.

Email info@nestbub.com with a privacy question, request, or complaint. Please explain the issue and how we can contact you. We will investigate and respond within the time required by applicable law. If you are not satisfied, you may be able to complain to the privacy or data-protection authority where you live, such as the OAIC in Australia, Office of the Privacy Commissioner in New Zealand, PDPC in Singapore, ICO in the United Kingdom, an EU or EEA supervisory authority, the Office of the Privacy Commissioner of Canada, or an applicable United States state regulator.

We may update this policy as NestBub, our providers, or applicable laws change. We will post the revised policy here with a new "Last updated" date and provide additional notice when a change is material or when required by law.