Last updated: 5 September 2026 · Version 2026-09-05
1. Controller and contact details
Function Labs Limited is the controller of personal data handled for Nestify. We are registered in England and Wales under company number 17129741. Registered office: Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA. Privacy enquiries and rights requests: support@functionlabs.co.uk.
2. Personal data we collect and where it comes from
We collect information you provide directly, information created when you use Nestify and limited information received from service providers: • Account data: name, email address, account identifier and authentication status. Base44 handles authentication credentials. • Project data: room or garden photos, room type, style choices, measurements, fit constraints, notes, prompts, generated designs, shopping lists and saved project state. • Purchase data: product, provider, price reference, transaction and entitlement identifiers, subscription status, refunds/disputes and the versioned pre-purchase acknowledgement. We do not receive or store full card numbers or card security codes. • Usage and diagnostic data: feature events, device/browser information, error details, timestamps and security logs. • Shopping and affiliate data: retailer, product/search term, project/design context, destination and a unique click reference when you follow a shopping link. • Support data: messages and information you send when asking for help. Data comes from you, your device, Base44, RevenueCat, Stripe, Apple, Google and the retailers or affiliate providers involved in a transaction or tracked link.
3. Purposes and lawful bases
We process personal data only where we have a lawful basis: • Contract: creating and securing your account; storing projects; processing photos and instructions through AI providers to deliver requested designs; maintaining design-pack credits and Plus access; restoring purchases; and providing support. • Legitimate interests: protecting Nestify from fraud and abuse; diagnosing faults; maintaining service security; keeping necessary audit trails; measuring essential service performance; and improving features. We balance these interests against your rights and expectations. • Consent: optional analytics is off until you choose to allow it. You may change that choice at any time without affecting earlier lawful processing. • Legal obligation: accounting, tax, consumer-rights, law-enforcement and regulatory requirements. • Legal claims: retaining limited evidence where reasonably necessary to establish, exercise or defend a claim. Nestify does not use personal data for third-party behavioural advertising and does not sell personal data.
4. AI processing
When you request a design or AI-assisted feature, the photo, prompt and relevant project details are sent to contracted infrastructure and AI providers. Providers may include Base44 and, depending on the task, Google, Anthropic and Replicate services. Processing is used to return the requested output, apply safety controls and operate the service under provider terms and contractual safeguards. Nestify does not operate its own foundation model and does not intentionally use your room photos to train a Function Labs model. Do not upload identifiable people, children, faces, special-category personal data or anything unrelated to the space being designed. AI outputs are not used to make decisions that produce legal or similarly significant effects about you.
5. Sharing and processors
We disclose only what is reasonably necessary to: • Base44 for hosting, authentication, storage, functions and service operation. • AI providers for requested generation, analysis and editing. • RevenueCat, Stripe, Apple or Google for purchase processing, entitlement verification, refunds and subscription management. • Analytics, email and support providers used to operate Nestify, subject to the relevant privacy choice. • Retailers and affiliate networks when you deliberately follow a tracked link. Their own policies apply once you leave Nestify. • Professional advisers, insurers, regulators, courts or law-enforcement bodies where necessary and lawful. • A buyer or successor if the business is reorganised or sold, subject to appropriate confidentiality and data-protection requirements. We require service providers acting as processors to handle personal data under contract and only for authorised purposes.
6. International transfers
Some providers may process data outside the United Kingdom. Where UK personal data is transferred internationally, we rely on a UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. We also consider additional technical and organisational safeguards where appropriate. Contact us if you want more information about the safeguard relevant to your data.
7. Cookies, local storage and optional analytics
Nestify uses strictly necessary cookies or device storage for authentication, security, navigation, draft recovery and remembering privacy or AI-processing choices. These are required for requested functionality. Optional product analytics is disabled unless you select “Allow optional analytics”. You can choose “Essential only” or change the choice later in Settings. Browser controls can also clear stored choices, but blocking essential storage may prevent sign-in or project recovery. Affiliate click records are created when you deliberately open a retailer link; Nestify does not place a third-party advertising cookie for that action unless separately disclosed and consented to.
8. Retention
Account and project data is retained while your account is active and until you delete it or ask us to remove it, subject to limited exceptions. Purchase, refund, accounting and tax evidence may be retained for up to six years where necessary. Security, fraud-prevention and diagnostic records are kept only as long as reasonably needed for investigation and service protection. Support correspondence is retained while the issue remains relevant. Deleted data may remain temporarily in restricted provider backups until the applicable backup cycle expires and may be retained longer where law, a dispute or fraud prevention requires it. We periodically review retention and delete or anonymise data no longer needed.
9. Security and data minimisation
Nestify uses authenticated access, row-level permissions, private photo references, server-side purchase verification, signed provider events, least-privilege service access and transport security. Payment-card details are handled by the payment provider rather than stored in Nestify project data. No online service can promise absolute security. If we become aware of a personal-data breach, we will assess it and notify affected people and the ICO where the law requires.
10. Your data-protection rights
Depending on the circumstances, UK data-protection law gives you rights to: • be informed about processing; • access personal data and receive a copy; • correct inaccurate or incomplete data; • request erasure; • restrict processing; • receive certain data in a portable format; • object to processing based on legitimate interests; • withdraw consent for optional analytics at any time; and • complain to the Information Commissioner's Office. Some rights have legal exceptions—for example, transaction evidence may need to be retained after account deletion. We may ask for reasonable information to verify identity. We normally respond within one month and will explain if a lawful extension or refusal applies.
11. Exercising rights and complaints
Use Delete Account in Settings to remove your Nestify account and associated app records, or email support@functionlabs.co.uk for access, correction, portability, restriction, objection or another privacy request. Withdrawing an optional choice does not affect processing already carried out lawfully. If you are unhappy with our response, you may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address the concern first.
12. Account deletion and subscriptions
The in-app deletion flow removes the Base44 user and associated Nestify projects, generation records, photo references, reports, shopping-click records, design-pack ledgers, purchase acknowledgements and subscription mirrors. Provider backups, transaction evidence and records required by law may remain for limited periods. Account deletion does not automatically cancel an Apple App Store or Google Play subscription; cancel with the provider first to stop renewal. See the Refund & Cancellation Policy.
13. Children
Nestify is intended for adults planning rooms or gardens and is not directed to children. Purchases must be made by an adult or with the payment-method holder's permission. Do not upload photographs containing children. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.
14. Changes to this notice
We may update this notice when providers, features or legal requirements change. The current version and effective date will be displayed here. We will provide an appropriate in-app or email notice before a material change where required. A policy update does not retrospectively turn an optional choice into consent.