Privacy Policy

Last updated: 13 July 2026

1. Preamble

Nestora attaches particular importance to the protection of its Users' personal data. This Privacy Policy describes the data collected, the purposes of its processing, its recipients, its retention period and the rights of the persons concerned.

Processing is governed by the revised Swiss Federal Act on Data Protection (FADP). The General Data Protection Regulation (GDPR) also applies.

2. Data controller

Nestora — a sole proprietorship with its registered office at Rue du Môle 42B, 1201 Geneva.

Nestora has not appointed a data protection officer (DPO). For any question, the User may contact the data controller at the address above.

3. Data collected

3.1 Data provided by the Client

Identification: surname, first name, sex, date of birth, nationalities and passport countries, profile photo.
Contact details: email address, phone number, saved postal addresses (with their geolocation coordinates).
Family data (spouse, children): first name, sex, date of birth, nationalities, photo, allergies, spoken languages, school level, musical instruments played.
Pet data: name, species, breed, sex, date of birth, health information (vaccination, sterilisation, health record), temperament, weight, photo.
Mission data: missions posted, statuses, ratings given and received (scores and comments).
Support communications: content of requests sent to Platform support.

3.2 Data provided by the Provider

Identification: surname, first name, sex, date of birth, nationalities, profile photo.
Contact details: postal address, email address, phone number.
Professional profile: services offered, spoken languages, level of education, experience, certifications and training (with date obtained), indicative rates.
Supporting documents: identity document or passport, criminal record extract, residence permit where applicable, diplomas, liability insurance certificate, photo.
Mission data: missions accepted, statuses, ratings given and received (scores and comments).
Support communications: content of requests sent to Platform support.

3.3 Account and technical data

Account data: interface language, notification preferences, personal referral code and referrer-referee link where applicable.
Technical data: operating system, application version, push notification token.
Session data: authentication tokens, login dates.

3.4 Payment data

As purchases are made through Apple's App Store, Nestora neither collects nor stores any banking details. Apple transmits to Nestora a subscription identifier and a status (active, expired, cancelled) via the RevenueCat platform.

Some of the data listed above constitutes sensitive data within the meaning of the FADP (allergies, criminal record extract). It is only processed to the extent necessary for the matching and proper execution of Missions, and is never used for other purposes.

4. Purposes and legal bases

Client/Provider matching : performance of the contract (Terms of Use, Terms of Sale).
Account and billing management : performance of the contract and legal obligations.
Transactional notifications : performance of the contract.
Referral program : performance of the contract (allocation of bonus credits to the referrer and the referred user).
Platform security and fraud prevention : legitimate interest of Nestora and its users.
User support : performance of the contract and legitimate interest.
Usage statistics and service improvement : legitimate interest.
Non-transactional communications : consent, revocable at any time from the Application's notification settings.

5. Processors and recipients

Nestora uses the following technical providers to deliver its service:

Supabase Inc. — database and authentication hosting (Zurich region, Switzerland).
Resend, Inc. — transactional email delivery (EU-West region).
RevenueCat, Inc. — subscription and In-App purchase management (United States).
Apple Distribution International Ltd — application distribution and payment processing (Ireland / United States).
Expo (650 Industries, Inc.) — push notification service (United States).
Google Ireland Ltd — autocomplete and geolocation of addresses entered in the Application (Google Places service); audience measurement and advertising on the Site (see section 10).
Cloudflare, Inc. — content delivery and protection (United States, global infrastructure).
Hostinger International Ltd — website hosting (Lithuania / Cyprus).

Each processor is bound to Nestora by a contract compliant with the requirements of the FADP and, where applicable, the GDPR. Nestora does not sell or rent personal data to third parties.

6. Transfers outside Switzerland and the EU

Some processors are established in the United States. Transfers to these jurisdictions are governed by appropriate safeguards: standard contractual clauses adopted by the European Commission, Data Privacy Framework certifications where available, and equivalent contractual commitments for Switzerland.

7. Retention period

Active account: for as long as the service is used. The User can delete their account at any time directly from the Application; deletion is immediate and permanent.
Inactive account: Nestora reserves the right to delete an account after 24 months of inactivity, with prior notification.
Accounting and billing data: 10 years, in accordance with Swiss obligations.
Technical logs: 6 months, except in the event of a security incident justifying extended retention.
Support requests: 3 years after resolution.

8. Rights of data subjects

In accordance with the FADP and, where applicable, the GDPR, the User has the following rights:

right of access to their personal data;
right to rectification of inaccurate or incomplete data;
right to erasure (right to be forgotten) where the conditions are met;
right to object to processing based on legitimate interest;
right to restriction of processing;
right to data portability (GDPR);
right to withdraw consent at any time, without affecting the lawfulness of prior processing;
right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the competent national supervisory authority (GDPR).

These rights can be exercised by email at contact@nestora.ch. Account deletion can also be carried out directly from the Application (Support section → “Permanently delete my account”): it immediately and permanently erases the profile, missions and credits; it is unavailable while a Mission is in progress. Reasonable identity verification may be requested to prevent misuse.

9. Security

Nestora implements technical and organisational measures to preserve the confidentiality, integrity and availability of data: TLS encryption of communications, strict access control to databases, logging of administrative access, error monitoring, regular backups.

10. Cookies and trackers (Website)

The www.nestora.ch Site uses technical cookies necessary for its operation, as well as measurement tools provided by Google Ireland Ltd (Google Tag Manager, Google tag, Google Ads conversion tracking), for audience statistics and to measure the effectiveness of Nestora's advertising campaigns. These tools may set cookies and transmit usage data to Google, in accordance with Google's privacy rules. The User can object at any time, in particular by configuring their browser to block third-party cookies or via the advertising settings of their Google account. The mobile Application contains no advertising tracker.

11. Minor users

Use of the Application as a Client is reserved for adults. Minor Providers (from 15 years of age for certain services) may only register with the written consent of their legal representatives. Nestora reserves the right to request proof of this consent at any time.

12. Policy changes

Nestora may amend this Policy to reflect legal, technical or organisational developments. Any substantial change will be notified to the User via the Application or by email with reasonable notice.

13. Contact

For any question relating to this privacy policy, please contact:
Nestora — Rue du Môle 42B, 1201 Geneva — contact@nestora.ch