Privacywith care.

Who is responsible

Nestlybot’s public website is operated by Fabio Alcantara, an individual based in North Carolina, United States. Contact [email protected] for privacy questions or requests.

This notice covers the public discovery pages, documentation, film, optional measurement, and guidance panel. Account workspaces, Things, files, conversations, and connected agent services have separate processing purposes and are outside public-site measurement.

Registration and account emails

Registration is open. Email sign-in verifies control of your address with a one-time link that expires after 15 minutes. ChatGPT sign-in supplies a verified account identity. We use your email and account identity to create and protect your account, deliver sign-in links, and send a one-time welcome. These necessary account messages do not subscribe you to marketing.

Account records and workspace content are processed by the application runtime on Google Cloud Run and Cloud SQL, separately from public-site measurement. Transactional email passes through the Nestlybot email gateway and Cloudflare Email Sending. Replies to [email protected] forward to the operator’s monitored support mailbox.

We store a hash of each temporary sign-in token; the raw token is kept out of request URLs sent to the server. A successful email sign-in uses a necessary, secure, HttpOnly cookie for up to seven days. Expired or consumed challenges and rate-limit counters are removed during subsequent sign-in requests. Request limits use a keyed digest of the network address in an hourly rate-limit counter, never a raw IP in the application rate-limit table; those counters are cleared after 48 hours during subsequent requests.

Beta AI allowance records track the account, estimated used or reserved credits, and the UTC period. A free-extension request records the account, amount, request time, review decision, reviewer account, and decision time. Account holders see their own requests; platform administrators review pending requests to manage the shared service budget. These are necessary service records, separate from optional public-site analytics, and do not create a payment account. They remain while the account is active; contact support for access or deletion requests and applicable operational-retention details.

A welcome receipt records the account, recipient, send state, attempt count, immutable welcome-message version or payload, and timestamps to avoid repeat messages. Account and welcome records remain while the account is active. Contact support for account access, export, or deletion requests; we verify the requester and explain any required operational or recovery retention. Provider acceptance of an email does not prove inbox delivery. Do not send passwords or sign-in links to support.

Service quality and launch reporting

The founding administrator can view aggregate counts of verified registrations, account welcome send states, committed Space and Thing setup receipts, and hosted AI estimates or reservations to operate and improve the beta. The report does not display account names, email addresses, Space or Thing names, private content, or individual activity histories.

Account service records remain separate from anonymous public-site events. This report does not join those events to accounts or attribute a registration to a social campaign. A saved Thing or approved draft is not counted as an accepted customer workflow. Recommendations are fixed rules for human review; they do not publish, spend, change access, or send information to an AI provider. The underlying account records follow the account-retention and support procedures above.

Optional measurement

Analytics stays off until you allow the recipients shown in Privacy choices. Nestlybot Event Intelligence measures a fixed set of public page views, story and film interactions, documentation links, MCP endpoint copies, and call-to-action clicks. A click is not a completed signup.

Events contain a random event ID, event and receipt times, public page path, a bounded interaction value, and the consent version, time, and selected recipients. They contain no account or visitor ID, email, IP address, fingerprint, user-agent string, private content, query string, URL fragment, or referrer. The transport sends no browser cookies. We use these events to understand and improve the public site; we do not sell them or use them for cross-site advertising.

Google Analytics and advertising tags are separately controlled and are disabled for this public-site release. Adding a recipient requires another choice. The authenticated app’s service-reliability system is separate and does not receive marketing events.

Choices and removal

Privacy choices remembers your analytics recipients, advertising choice, notice version, and decision time in localStorage for up to 180 days. Reject optional declines analytics and advertising and resets guidance. You can reopen these controls at any time.

For Event Intelligence, this browser keeps up to 256 event-ID/timestamp receipts for eight days so withdrawal can request removal of events that may have arrived. These receipts are deletion capabilities, not a visitor profile. No receipt storage, a full receipt list, or a pending removal stops further delivery.

Withdrawing cancels pending delivery and requests deletion of the known event IDs. Failed requests remain pending and are retried on a later visit. Deletion markers remain seven days to prevent an in-flight request from restoring a removed event. Clearing browser storage loses this browser’s removal receipts; another browser has independent choices. Information already received by an external provider cannot be recalled by this control.

Public web research

When you submit a question through Tools and connections in an agent conversation, Nestlybot sends that question and any source-domain restriction you choose to OpenAI’s web research service. Conversation history, private Things, and attachments are not included in that search request. Avoid confidential details in a public search question. Search providers may process the query to retrieve public sources.

The question, cited findings, search receipt, and any prepared Thing-update reference are stored with your account work. They are separate from optional Event Intelligence measurement. You can restrict accepted citations to selected domains; search may consult other sites. This citation restriction limits source location; it does not certify accuracy or primary-source status. You must confirm source review before preparing a new Thing update, then review and execute the proposed content; preparing a GitHub issue does not submit it. For access or deletion requests, contact [email protected].

Optional guidance

You may choose Things or MCP guidance for this tab. Manual choices stay in sessionStorage or document memory for up to 30 minutes and do not need analytics permission.

If you choose “Guide me as I explore,” the site sends only the most recent Things/MCP section choice and a separate, time-limited personalization grant to Nestlybot’s first-party decision endpoint. A fixed policy selects one of two existing guide suggestions. It reads no account context, builds no persistent visitor profile, and sends nothing to a model provider. The request and decision are not stored in Event Intelligence. Manual choice takes precedence. Reset focus or Reject optional stops guidance.

The complete product explanation remains available without personalization.

Retention and hosting

Raw measurement events expire seven days after receipt. Hourly scheduled cleanup removes expired rows; an outage can delay physical cleanup, and collection is disabled when the maintenance heartbeat becomes stale. Event budgets are short-lived operational counters. Browser removal receipts last up to eight days and the consent choice up to 180 days.

Hosting and delivery use OpenAI Sites and Cloudflare, including Cloudflare D1. These infrastructure providers necessarily process network information, including IP addresses, to deliver the site, prevent abuse, and investigate failures. Cloudflare may set necessary security cookies. Those records and cookies are separate from the Event Intelligence payload. Infrastructure security and diagnostic records follow the providers’ service settings and retention policies. D1 recovery copies can retain operationally deleted information for up to 30 days before aging out; recovery is restricted to service recovery, not analytics use.

Infrastructure processing can occur in the United States and other locations used by these providers. See OpenAI’s privacy policy and Cloudflare’s privacy policy.

Purposes and requests

We rely on your choice for optional measurement and personalization, and use necessary storage and infrastructure processing to provide the site, honor your choices, and protect the service. Where applicable law requires a particular legal basis or safeguard, it governs that processing.

You may ask about access, correction, deletion, portability, objection, or withdrawal by emailing [email protected]. Tell us the request category and public page involved; do not email passwords or access tokens. We may request proportionate verification when necessary. We cannot reliably connect an unlinked measurement event to a person without its browser-held receipt. We respond within the period required by applicable law and explain any limitation. You may contact your competent privacy regulator where that right applies.

The public site is not directed to children under 13. If you believe a child supplied personal information, contact us so we can investigate and address it.

Changes to this notice

This notice took effect October 15, 2026 and was updated October 17, 2026. Changes appear here with an updated date. A new optional purpose or recipient requires an appropriate new choice before activation.