Skip to content
NestBytes
Start free

Privacy Policy

Effective 12 October 2026. Version 2026-10-12

This policy explains what personal data NestBytes collects, why, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Rules made under it.

Who we are

NestBytes (nestbytes.space) is operated by Supriya Mandal, an individual, at Siliguri, West Bengal 734003, India. For the purposes of the Digital Personal Data Protection Act, 2023, Supriya Mandal is the Data Fiduciary who decides how and why your personal data is processed.

We have not published an email address yet. The ways to reach us are the in-app contact form on our Contact page and post to the address above. See the Grievance Officer page for complaints.

Data we collect

We collect only what the service needs to work.

Account data

  • Your name and email address.
  • A password, stored only as a hash computed by Better Auth using scrypt. We never store or see your plain password.
  • Your time zone, used to reset your daily allowance on your local day.
  • Your acceptance of the Terms, which require you to be 18 or older.
  • The version of the Terms you accepted and the time you accepted them.
  • Session records, including the IP address and browser user agent for each sign-in, so you can review and end sessions.
  • If you sign in with Google, the basic profile and email Google returns.

Your creative work

  • Projects, chapters, characters, your Story Bible, comic scripts and panels.
  • Chat messages with your characters and the prompts you write.
  • Generated images and the files you export.

Usage and billing records

  • Usage events that record which operations you ran and whether they succeeded.
  • Your credit ledger and allowance windows.
  • Subscription and invoice records, when paid plans become available.

Support and safety

  • Contact messages and abuse reports you send us, with any reference code.
  • Audit events for sensitive actions, and salted hashes of IP addresses (not the addresses themselves).
  • Short-lived rate-limit counters that protect the service from abuse.

Why we use it and our legal basis

Under the Digital Personal Data Protection Act, 2023, we process your personal data on the basis of your consent and, where the law allows, for certain legitimate uses. We use your data to:

  • Create and secure your account and keep you signed in.
  • Store your creative work and run the generations you ask for.
  • Count your usage against your daily allowance and credits, and bill you if you choose a paid plan.
  • Respond to your messages, grievances and reports.
  • Keep the service safe, prevent abuse, and meet our legal duties.

We do not use your data for advertising, and we do not sell it. We run no analytics or third-party tracking.

AI providers and other processors

To generate what you ask for, we send the prompt and the relevant project context to our AI providers. Text is generated by Anthropic (Claude) and images by Cloudflare Workers AI (FLUX models). Whether a provider keeps this content, or uses it to improve its own models, is decided by the terms and settings of that provider, not by us, and we cannot promise how a provider handles it. Please read the provider policies yourself: the Anthropic privacy policy and the Cloudflare privacy policy. Do not put into a prompt anything you would not want a provider to process.

These are the processors that handle data on our behalf:

  • MongoDB, Inc. (MongoDB Atlas): Database hosting for accounts and creative work.
  • Anthropic PBC (Claude API): Generating and analysing text you ask the service to write, when the service is connected to Anthropic directly.
  • Amazon Web Services, Inc. (Amazon Bedrock): Running Anthropic Claude to generate and analyse text you ask the service to write. A global inference profile may process a request in any AWS region.
  • Resend, Inc.: Sending account emails such as email confirmation and password reset. Receives your email address and name.
  • Cloudflare, Inc. (Workers AI): Generating images from prompts built from your project.
  • Cloudflare, Inc. (R2) or the hosting provider's storage: Storing generated images and exports, when production storage is enabled.
  • PayU Payments Private Limited: Processing payments for paid plans and credit packs, when PayU is enabled. Receives your name, email and the order amount; card details are entered on PayU's page and never reach NestBytes.

When paid plans are enabled through PayU, PayU receives your name, email and the order amount so it can process the payment and send you a receipt. Your card or bank details are entered on PayU's own secure page and never pass through or get stored by NestBytes.

How long we keep it

  • Account data and your creative work: until you delete the item or your account.
  • Trashed projects: kept for 30 days, then permanently removed.
  • Usage events: 180 days.
  • Audit events: 1 year.
  • Financial records: kept in anonymised form after account deletion, for as long as the law requires.
  • Rate-limit counters: short-lived, removed automatically when their window ends.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

  • Access a summary of the personal data we hold about you.
  • Correct or complete inaccurate or incomplete data.
  • Erase your data, subject to legal retention duties.
  • Raise a grievance and have it addressed.
  • Nominate another person to exercise your rights if you are unable to.

You can exercise most of these yourself in the app: open your account settings to export your data or delete your account. For anything else, use the contact form or write to our Grievance Officer.

Children

NestBytes is only for people who are 18 or older. We do not knowingly process the personal data of anyone under 18. Because Indian law requires verifiable parental consent for a child, and we do not offer that, the service is not available to minors. If we learn that a minor has created an account, we will close it and delete the data.

Security

We protect your data with measures that include:

  • Passwords stored only as scrypt hashes.
  • Session cookies that are httpOnly, so page scripts cannot read them.
  • Ownership checks on every read and write, so one account cannot reach the data of another.
  • Rate limits on sign-in, generation and the contact and report forms.
  • Encryption in transit (TLS) in production.
  • Signed webhooks for billing events.

No service can promise perfect security, but we work to keep your data safe and to fix problems quickly.

Breach notification

If a personal data breach occurs, we will notify the Data Protection Board of India and the users affected, in the manner and within the time the law requires.

Cross-border transfers

Your data is processed by the processors listed above, some of whom operate outside India. As of the effective date of this policy, transfers to the countries where these processors operate are not restricted by a Government of India notification. This may change, and we will follow any restriction the Government notifies.

Cookies and local storage

We use only strictly necessary storage and a local preference. See the Cookie Notice for the full list and how to clear them. We use no advertising or third-party tracking cookies, so no consent banner is needed.

Changes to this policy

We may update this policy as the service or the law changes. We will change the version and effective date at the top, and for material changes we will give notice in the app. The main obligations of the Act take full effect by about 13 May 2027, and we already follow them as good practice.

Contact and Grievance Officer

For privacy questions or to exercise a right, use the contact form (choose the privacy topic). Our Grievance Officer is Supriya Mandal, Grievance Officer. A published email is not available yet, so please use the form or write to the postal address above. See the Grievance Officer page for the full process and timelines.