Nestbalm

Privacy Policy

DeutschБългарски

Version: 20 October 2026

This is a translation of the German Datenschutzerklärung. In case of any discrepancy, the German version prevails.

1. Controller

Nestbalm UG (haftungsbeschränkt)
Jägerstraße 18, 82008 Unterhaching, Germany
E-mail for privacy requests: privacy@nestbalm.com
General contact: info@nestbalm.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. The essentials in brief

3. Hosting and server log data

Our service runs on Google Cloud (Cloud Run). The application, database and key management run in Google Cloud regions within the European Union. AI processing (see section 11) also takes place in regions within the European Union. An organisation-wide policy restricts processing to locations within the European Union. When you access our pages, the server processes technically necessary data (IP address, date/time, requested resource, user agent) for provision, stability and security (Art. 6(1)(f) GDPR).

Application and access logs are deleted after 30 days; internal administrative audit logs are retained for up to 400 days for system reasons.

A data processing agreement is in place with Google Cloud EMEA Ltd.; where transfers to the USA cannot be ruled out, they take place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

4. Contacting us

If you contact us by e-mail or via our contact form, we process the data you provide (e.g. name, e-mail address, message) to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted once the enquiry has been dealt with and no retention obligations apply.

5. Launch updates (waiting list)

If you sign up for product updates on our website, you will receive e-mails about the product launch after confirming via double opt-in (legal basis: consent, Art. 6(1)(a) GDPR; unsubscribe at any time via the link in every e-mail). E-mails are sent via Google Workspace (Google Ireland Ltd.) as processor; no separate newsletter provider is currently used.

6. User account and login

(1) Registration by e-mail, via Google Sign-In or via Sign in with Apple. With Google login we receive the basic data provided by Google (e-mail address, name); the controller for the login process at Google is Google Ireland Ltd. With Apple login we receive from Apple a stable user identifier, your name (on first sign-in only) and your e-mail address; if you choose “Hide My Email” in Apple's dialog, we receive an Apple-generated relay address instead of your address (Apple Private Relay). The controller for the login process at Apple is Apple Inc. or Apple Distribution International Ltd. When you delete your account, we revoke the sign-in authorisation held at Apple.

(2) We process account data (e-mail, plan status, settings) for the performance of the contract (Art. 6(1)(b) GDPR).

(3) Content data of the app and encryption: Your content data is transmitted exclusively over transport-encrypted connections (TLS) and stored on encrypted storage in the EU. Particularly sensitive individual fields — account numbers and the payment references taken over from your bank transactions — are additionally encrypted field by field with AES-256-GCM and a separate data key per household. The remaining content data (e.g. amounts, booking dates, categories, budgets, savings nests) is held in an evaluable form, because categorisation, analyses and budget calculation would otherwise be impossible; it is protected by encryption at the storage and transport layers and by access controls.

The data key is managed through a key protected by Google Cloud KMS, which Nestbalm accesses during operation. This is technically necessary so that imports, analyses, reminders and data exports keep working even while you are not signed in. Nestbalm is therefore technically able to read your content data. Access is limited to operating the service and takes place only for the purposes stated in this policy. There is therefore no end-to-end encryption in the sense of a zero-knowledge scheme.

The passphrase you set at registration protects an additional copy of the data key (Argon2id). It is currently not requested again during normal use and is not end-to-end encryption. Losing the passphrase therefore does not mean losing your data.

7. Family sharing

In the Family plan the account owner decides on invitations; members see content according to the sharing settings. Every member has their own login. Visibility within the family is a feature of the service; every member can end their membership.

No children's data: Children do not use the service; no accounts are created for children. Child “nests” created by parents carry freely chosen nicknames; dates of birth or similar are not requested.

8. Payment processing

Payments are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). When you take out a paid plan you are redirected to Stripe's secure payment page (checkout.stripe.com); payment data collected there (e.g. card details) is processed by Stripe; we do not receive complete payment data. Where Stripe transfers data to the USA, this takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. We process billing and invoice data for the performance of the contract (Art. 6(1)(b) GDPR) and retain it under commercial and tax law (§ 147 AO: up to 10 years; Art. 6(1)(c) GDPR).

9. No third-party analytics; internal event logs

We currently use no third-party analytics services. To improve the service we keep internal, server-side event logs in our own database (Art. 6(1)(f) GDPR); no information on your device is accessed for this.

10. No advertising trackers

We use no advertising pixels and no third-party trackers.

11. AI processing (assistant and PDF bank statements)

Two features transmit personal financial data to a third-party AI model: the AI assistant (section 11.1) and the reading of bank statements in PDF format (section 11.2). We use both only if you have explicitly consented beforehand (legal basis: Art. 6(1)(a) GDPR). Each household member decides for themselves; you are asked when you first open the assistant or first upload a PDF bank statement.

You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) in the application under Profile > Data & Privacy. After that no further data is transmitted to the model; the lawfulness of processing carried out before the withdrawal is unaffected. Without consent all other features remain usable. Files in OFX, QFX, CSV, CAMT.053 and MT940 format are processed without AI and are never transmitted to an AI model.

11.1 AI assistant

At the user's request, the integrated assistant evaluates the user's input and the household's financial data needed to answer it (e.g. balances, budgets, transactions) in order to produce summaries and suggestions.

AI processing takes place via Google Cloud Vertex AI in regions within the European Union under the existing data processing agreement with Google Cloud. The model used is Anthropic Claude; if it is temporarily unavailable, the same request is answered by the Google Gemini model, likewise via Google Cloud Vertex AI within the European Union. Under the Vertex AI terms, customer data is not used to train models. The assistant's access to budget data is tool-mediated: the model has no direct database access and receives only the results of defined read functions; modifying functions are additionally safeguarded.

The assistant is labelled as an AI system (Art. 50 AI Act). It does not provide investment, tax or legal advice.

11.2 Reading PDF bank statements

If you upload a bank statement as a PDF, the text of the document is transmitted to the Anthropic Claude model, which is operated for us via Google Cloud Vertex AI in the europe-west1 region (Belgium) under the existing data processing agreement with Google Cloud. If it is temporarily unavailable, the same text is transmitted to the Google Gemini model, likewise via Google Cloud Vertex AI in the europe-west1 region (Belgium). The model transfers the details contained in the statement (account holder and account details, period, balances, transactions with payment references) into structured bookings. Before import we check the result arithmetically against the statement's balances; if it does not match, nothing is imported. Under the Vertex AI terms the data is not used to train models.

Without consent a PDF bank statement is neither transmitted to the model nor imported.

12. Recipients and processors

Contracts under Art. 28 GDPR are in place with all processors. No transfer to other third parties takes place unless we are legally obliged to do so.

13. Retention period

After account deletion or the end of the user relationship we keep account and content data for a grace period of 60 days, unless you request immediate erasure under Art. 17 GDPR; during this period you can still export your data (account export). After that the data is deleted, unless statutory retention periods (e.g. for invoice data) require otherwise. Cancelling a paid plan alone does not trigger deletion — the account continues in the free demo scope. For log data see section 3; update-e-mail data is kept until consent is withdrawn.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR), as well as the right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). You can also export your data yourself at any time as a JSON file (account export).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you have the right to object at any time on grounds relating to your particular situation.

Right to lodge a complaint: you may contact a data protection supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.

15. Cookies and local storage

We use exclusively our own, technically necessary cookies and storage technologies (session/login, security tokens, language setting), § 25(2) TDDDG. We use no third-party cookies, CDN cookies or embeds with tracking. A cookie banner is therefore not required.

16. Obligation to provide data; automated decisions

Data required for the performance of the contract (e-mail, payment data) is necessary; without it the contract cannot be performed. No automated decision-making with legal effect (Art. 22 GDPR) takes place.

17. Changes

We adapt this policy when the service or the legal situation changes; the version published at the time applies.