EveryNest Privacy Policy
At a glance
This is the short version. The full detail is below - please read it.
Who we are. EveryNest is a family organisation app run by Pivotal Finance Solutions S.à r.l.-S, a company registered in Luxembourg. We are the data controller for personal data we process through EveryNest.
Where we offer it. European Economic Area (EEA) and the United Kingdom.
What we collect. Parents provide account, Household and activity information. Teen and Child profiles include a display name, role and age band and activity within the Household. A Teen may also have their own email address and password, paired Teen and Child profiles do not.
Why we collect it. To create and operate Household accounts, provide the features members use, administer subscription access, keep EveryNest secure, provide support and meet our legal obligations.
Who sees it. Information shared within EveryNest is visible only to Household members whose role allows them to see it. We also use a limited number of service providers to operate EveryNest and may disclose information where the law requires it. We do not sell personal data or use it for advertising.
Household Owner. One Parent is the Household Owner: initially the Parent who creates the Household, or a Parent who later receives Ownership through a transfer.
Minors. A Parent must complete EveryNest’s parental-authorisation process before a Teen or Child profile is created. A Parent can remove a minor from the Household; some shared Household history and limited compliance records may remain as explained below. We do not use minors’ data for advertising or behavioural profiling.
If subscription access ends. Household data is retained for 12 months from the date access ends so that the Household can be restored if the Household Owner resubscribes. If no subscription is re-established, the data is scheduled for deletion subject to limited lawful retention.
Your rights. Depending on the circumstances, you may have rights to access, correct, erase, restrict, object to or receive certain personal data, and to withdraw consent where we rely on consent. You may also complain to a data-protection authority.
How to reach us. hello@everynest.app
1. Who we are and how to contact us
EveryNest is operated by:
Pivotal Finance Solutions S.à r.l.-S
32 rue Buurg,
Gostingen, 5425 Luxembourg
Luxembourg trade and companies register: B289140
For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for personal data processed through the EveryNest app and website.
Privacy enquiries and data-protection rights requests:
- Privacy email: hello@everynest.app
- Postal: 32 rue Buurg, 5425 Gostingen, Luxembourg
2. What this policy covers
This policy applies to personal data we collect when you:
- Create an account or use the EveryNest app on Android or through the web
- Visit everynest.app or related websites we operate
- Contact us by email or through a contact or support form on our website
- Subscribe to EveryNest
It does not cover third-party services you may use alongside EveryNest (for example, your own email provider or device operating system). Those services have their own privacy policies.
This Privacy Policy is effective 11 September 2026
3. Where we offer EveryNest
EveryNest is offered to users located in the European Economic Area (EEA) and the United Kingdom. This Privacy Policy is drafted for that geographic scope. If you are not located in the EEA or the UK, EveryNest is not currently offered to you, and you should not create an account.
For users in the EEA, we process personal data under the EU General Data Protection Regulation (EU GDPR) and applicable national data protection laws. For users in the United Kingdom, we process personal data under the UK GDPR and the Data Protection Act 2018. Where this policy refers to “GDPR” without qualification, it means whichever regulation applies to you.
Because Pivotal Finance Solutions S.à r.l.-S is established in Luxembourg and offers EveryNest to users in the United Kingdom, we have appointed the UK representative identified in paragraph 11.1.
4. The accounts in EveryNest and what we collect
EveryNest is designed for whole families. There are three types of account, and each one collects different information.
4.1. Parent accounts
A Parent is an adult (aged 18 or older) who administers a household. A household may have more than one Parent - the Parent who creates the household, and any additional adult invited by an existing Parent to co-administer. We collect the same data from every Parent regardless of whether they founded the household or were invited into it:
- Email address and password (you provide these at sign-up, the password is hashed and never stored in plain text).
- Display name (you choose this, it can be a first name or nickname).
- Household name (you choose this, e.g. “Gates Family”).
- Things you create in the app - tasks, calendar events, shopping lists, rewards, points granted or redeemed.
- Subscription and entitlement information - such as whether the Household currently has subscription access and relevant subscription events received from Google Play. We do not receive or store payment-card or bank-account details.
- Communications - if you email us or use a feedback form, we keep what you sent so we can reply.
- Technical and audit information - we record the IP address and timestamp associated with acceptance of our legal documents and parental authorisation. We also process limited technical and diagnostic information generated when EveryNest is used or encounters an error, such as browser or operating-system information, timestamps and technical error details, where needed to operate, secure and troubleshoot the service. We do not use persistent identifiers for advertising or cross-service tracking.
Household Owner. One Parent in each household - the Parent who first created it, or the Parent to whom it was subsequently transferred - is designated as the Household Owner. Household Owner is not a separate account tier, it is an attribute of one specific Parent’s account. The Household Owner holds three controls that other Parents in the household do not:
- Administering the Household’s EveryNest subscription,
- Transferring the Household Owner role to another Parent in the household,
- Deleting the Household, which removes the Household and its shared data and ends every member’s membership of it. Deleting a Household does not delete another adult’s separate EveryNest account.
Any Parent - Household Owner or not - can carry out every other function in the app, including adding or removing minor members subject to the parental-authorisation process described in paragraph 9.
4.2. Teen accounts
A Teen is a Household member using the Teen role, which is available from age 13. The Teen role is an application role and does not determine whether the user is legally a minor. A user aged 18 or over is treated as an adult for data-protection purposes even if their EveryNest role remains Teen. Where the Teen is under 18, a Parent must complete the parental-authorisation process before the Teen joins the Household, see paragraph 9. We collect:
- Email address and password (the Teen sets these when accepting the invite, password is hashed).
- Display name (chosen by the parent or the teen).
- Approximate age band (recorded by the parent at invite: Teenager 13+ - the only Teen age band captured).
- A Teen may either sign in with their own email address and password, or be set up on a paired device with no email address at all, at the Parent’s choice. Where a Teen is on a paired device we hold no email address for them.
- Things they do in the app - asks they complete, points they earn or redeem, and calendar events and shopping-list items they create or edit.
- Technical information - Limited technical and diagnostic information as described in paragraph 4.1.
- A Teen profile does not require a phone number, postal address, photo, geolocation, biometric data or contacts.
4.3. Child accounts
A Child profile is for a Household member aged 7–12. The Parent generates a one-time pairing code on their own device, and the Child enters it on the device they will use. We collect:
- Display name (chosen by the parent). Even where the display name is a nickname rather than a real name (for example, “Little Bear”), it is personal data under GDPR because it identifies a specific child within a specific household. We protect it accordingly.
- Approximate age band (recorded by the parent at the moment the pairing code is generated: Child 7-12 years old, the only Child age band captured).
- Things they do in the app - tasks they complete, points they earn or redeem and calendar events they are added to.
- Technical information - Limited technical and diagnostic information as described in paragraph 4.1.
- A Child profile does not require an email address, password, phone number, postal address, photo, geolocation, biometric data, contacts or other contact details.
- Child profiles do not contain contact details. A Child, or a person lawfully acting on their behalf, may nevertheless contact us using the contact details in paragraph 1.
5. Source of the data and categories we do not collect
Most account information is provided directly by the person using EveryNest. Some information about another Household member, including a Teen or Child’s display name, role and age band, is provided by the Parent who creates or invites that member. We also receive limited subscription and entitlement information from Google Play and technical information generated through the operation and security of the service. We do not obtain personal data from data brokers or advertising networks.
EveryNest does not ask for or require special-category personal data within Article 9 GDPR and is not designed for its storage. Some EveryNest features contain free-text fields, so a user could nevertheless enter this type of information. Our Terms & Conditions prohibit users from doing so. We do not use such information for any separate purpose and, where we become aware that it has been entered, we may remove or restrict it where appropriate.
6. Information needed to provide the service
Some information is necessary to provide EveryNest. For an adult account, this includes the account and authentication information needed to create and operate the account. To create a Teen or Child profile, the Household must provide the information required for that role. Optional information does not have to be provided. If it is not provided, the relevant optional function may not be available.
7. Why we use your data (purposes and lawful bases)
7.1. Lawful basis
Under GDPR Article 6, we must identify a lawful basis for our processing of personal data. The table below explains the purposes for which we process personal data and the lawful bases we rely on.
What we use the data for | Whose data | Lawful basis |
|---|---|---|
Creating and operating an adult account and Household | Adult users | Performance of a contract - Article 6(1)(b) |
Providing the core Household service to adult users | Adult users | Performance of a contract - Article 6(1)(b) |
Creating and operating Teen and Child profiles for users under 18 and enabling their participation in the Household | Teen and Child role users | Legitimate interests (Article 6(1)(f)): our legitimate interest, and the Parent’s legitimate interest, in providing the family Household service requested by the Parent. Where the user is under 18, we balance those interests particularly carefully against the rights and interests of the minor and apply the safeguards described in paragraph 8. Where a Teen-role user is aged 18 or over and is bound by the Terms & Conditions, Article 6(1)(b) also applies to processing that is necessary to provide their account and service. |
Administering the Household subscription and subscription entitlement | Household Owner, limited Household membership data where necessary | Performance of a contract - Article 6(1)(b), legitimate interests - Article 6(1)(f) where limited processing relates to other Household members |
Sending essential account, authentication and security communications | Adults with an account, Teens with their own email address | Performance of a contract - Article 6(1)(b) for adults, legitimate interests - Article 6(1)(f) for a Teen who is under 18 |
Recording parental authorisation and maintaining evidence of the safeguards applying to a minor profile | Parent, Teen or Child | Legitimate interests - Article 6(1)(f): safeguarding minors, demonstrating how the Household membership was authorised and establishing or defending legal claims |
Recording acceptance of Terms and legal notices | Adult users | Performance of a contract - Article 6(1)(b), and legitimate interests - Article 6(1)(f) where limited evidence must be retained |
Retaining Household data during the 12-month post-subscription restoration period | All Household members | Legitimate interests - Article 6(1)(f): enabling a Household to be restored if the Household Owner resubscribes, subject to individual data-protection rights |
Preventing fraud, misuse and unauthorised access and protecting the security of EveryNest | All users | Legitimate interests - Article 6(1)(f) |
Error monitoring, diagnostics and troubleshooting | All users | Legitimate interests - Article 6(1)(f) |
Responding to account or service-support requests | Person contacting us and relevant Household members | Performance of a contract - Article 6(1)(b) where necessary to provide contracted support, otherwise legitimate interests - Article 6(1)(f) in responding to enquiries and resolving problems |
Sending optional product updates and feedback requests | Parents who opt in | Consent - Article 6(1)(a) |
Meeting legal, accounting and regulatory obligations | Relevant individuals | Legal obligation - Article 6(1)(c) |
Retaining limited evidence where necessary to establish, exercise or defend legal claims | Relevant individuals | Legitimate interests - Article 6(1)(f) |
7.2. Parental authorisation.
EveryNest requires parental authorisation before a Teen or Child profile for a user under 18 is created. This is a safeguarding and Household-authorisation requirement. It is separate from GDPR consent relied upon for optional processing such as product-update emails. Article 8 GDPR regulates consent where Article 6(1)(a) is relied upon for an information society service offered directly to a child, it is not a separate lawful basis for EveryNest’s core processing.
7.3. What we do not do with your data
We do not use your data for any of the following:
- Behavioural advertising or ad profiling
- Selling or renting data to third parties
- Building profiles of users to predict behaviour or target marketing
- Tracking across other websites or apps
- Training artificial-intelligence or machine-learning models.
8. Children specifically
We apply additional safeguards to personal data relating to minors. In particular, we minimise the information required for Teen and Child profiles, use privacy-protective defaults, do not use minors’ personal data for advertising or behavioural profiling, do not process geolocation for minor profiles, do not use re-engagement techniques designed to extend a minor’s use of the app, and require parental authorisation before a minor joins a Household. Personal data relating to minors is visible within the Household only as described in paragraph 10 and is processed by the service providers needed to operate EveryNest as described in paragraph 11.
9. Parental authorisation for Teen and Child accounts
EveryNest requires parental authorisation before a Teen or Child profile for a user under 18 is created. The Parent giving that authorisation must confirm that they have parental responsibility for the minor or are authorised to act by a person who does.
We keep a record showing which Parent gave the authorisation, which Teen or Child profile it relates to, the age band declared by the Parent, the version of the Privacy Policy made available at the time and the applicable version of the Parental Consent Notice, the date and time, and the IP address recorded when the authorisation was given.
Parental-authorisation records are retained as internal compliance records. They are not displayed in the EveryNest app or web interface and are not included in the Household export. Personal data contained in those records remains subject to applicable data-protection rights, including the right of access.
A Parent may end the minor’s participation in EveryNest by removing the Teen or Child from the Household. The minor’s member profile is then removed. Activity that forms part of shared Household history - such as completed tasks, points ledger entries, calendar events or shopping-list items - may remain where there is a lawful basis to retain it. A minor, or a person lawfully acting for them, may exercise applicable data-protection rights in relation to that information as described in paragraph 14.
We do not routinely require documentary proof of a parental relationship. We may request further verification where reasonably necessary to verify a person’s authority or protect a minor’s rights and interests.
10. What members of your household can see
EveryNest is built around the household. Members of the same household see each other’s activity in the app, members of different households cannot see anything about each other. We want to be explicit about what household members can see, particularly for teenagers.
10.1. Shared Household information.
Household members can see information made available to their role. Parents and Teens can see the shared Household calendar and shopping lists. Task visibility depends on role and assignment. Rewards and point balances are shown according to role. Household members can see the display names and roles of other Household members.
10.2. What Parents can see
- All household activity by all members, including Teens and Children - tasks completed, points earned and redeemed, calendar entries, shopping items added
- The settings of every member’s account - display name, role, age band
10.3. What the Household Owner can see and do that other Parents cannot
- Account and subscription information for the household (any Parent can see subscription status, but only the Household Owner can change it)
- The three Owner-exclusive controls: cancel the subscription, transfer the Household Owner role to another Parent, delete the whole household
10.4. What a Teen can see
- Their own activity in full
- The household calendar, shopping lists, and tasks visible to their role
- Parental-authorisation records are not visible in EveryNest. A Teen may contact us directly to exercise any applicable right of access to personal data contained in such a record
10.5. What a Child can see
- Their own tasks, points, and rewards
- The household calendar and shopping lists
- Children see a simplified, child-appropriate view of the app
10.6. What no household member can see
- Email addresses or sign-in details of other household members (only the member themselves and EveryNest see these)
- Other households - every household is fully isolated
A note for teenagers
If you use EveryNest in the Teen role, the Parents in your Household can see the Household activity described above, including tasks you complete, calendar entries you create and points you earn. If you have questions about your privacy or wish to exercise a data-protection right, you can contact us directly at hello@everynest.app, see paragraph 14.
11. Who we share your data with
We use a limited number of third-party providers to operate EveryNest. Some process personal data on our behalf as processors. Others, particularly Google in connection with Google Play purchases and accounts, process personal data as independent controllers for their own services. Their roles are described below:
Provider | Role and purpose | Main processing location / transfer position |
|---|---|---|
Supabase | Processor - database hosting and authentication | Primary EveryNest project data is stored in the EU region configured by EveryNest. Limited processing may occur elsewhere through approved subprocessors under applicable contractual transfer safeguards. |
Vercel | Processor for hosted EveryNest customer data - application hosting and delivery | United States and global infrastructure. International transfers are protected under Vercel’s applicable data-processing agreement, including the EU Standard Contractual Clauses and UK transfer provisions. |
Open-Xchange, via smtp.openxchange.eu | Processor - delivery of transactional and service emails | Germany. |
Sentry | Processor - application error monitoring | EveryNest uses Sentry’s Germany data-storage region. Sentry may also use group companies and subprocessors internationally under its applicable DPA and transfer mechanisms. |
Formspree | Processor - processing, storage and delivery of website contact and support form submissions | United States and other locations used by Formspree. Formspree states that it relies on Standard Contractual Clauses as a processor. Form submissions are stored in the Formspree account. |
Google Cloud Pub/Sub | Processor - transport of subscription-status notifications from Google Play | Google Cloud infrastructure, international processing is governed by the applicable Google Cloud data-processing and transfer terms |
Google Play / Google Commerce Limited | Independent controller for Google Play distribution, account and purchase administration. EveryNest receives limited subscription/entitlement information and does not receive payment-card or bank-account details | Google’s infrastructure and processing locations under Google’s own privacy and international-transfer arrangements. Current EEA Google Play terms identify Google Ireland Limited as provider of Google Play and Google Commerce Limited as the contracting party for Content purchases. |
We do not share your data with:
- Advertising networks
- Data brokers
- Social media platforms (we have no social login or share-to-social features)
- AI training services
We may share data without your consent only when legally required: for example, in response to a valid court order or law enforcement request. We will only disclose what is strictly required, and we will tell you about it unless legally prevented from doing so.
We do not disclose minors’ personal data for advertising or marketing. Where disclosure is required by law, we disclose only what is legally required.
11.1. UK representative
Because Pivotal Finance Solutions S.à r.l.-S is established in the European Union and not in the United Kingdom, and because we offer EveryNest to users in the United Kingdom, UK GDPR Article 27 requires us to designate a UK-based representative to act as our contact point for UK data subjects and the UK Information Commissioner’s Office (ICO).
Our UK representative is:
Prighter Ltd, 20 Mortlake, Mortlake High Street London SW14 8JN United Kingdom
Acting as representative in the United Kingdom in accordance with Article 27 UK GDPR.
You can contact the UK representative directly on any matter relating to how EveryNest processes personal data of users in the United Kingdom via app.prighter.com. You can equally contact us directly at hello@everynest.app, you are not required to route through the UK representative if you prefer to contact us.
Designating a UK representative does not limit our own responsibilities or your rights under UK GDPR. It provides you and the ICO with an additional UK-based point of contact.
11.2. International transfers
The primary EveryNest database is configured in an EU region. Some of our service providers process personal data outside the EEA and the United Kingdom, including in the United States. Where personal data is transferred internationally, we use the transfer mechanism required by the law that applies. This may include an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or another legally recognised safeguard. Where a provider participates in an applicable adequacy framework, such as the EU–US Data Privacy Framework or its UK Extension, that framework may also provide the transfer basis. You may contact us at hello@everynest.app for information about the safeguards applying to a particular transfer.
12. How long we keep your data
We keep data only as long as we need it. Our retention schedule is:
Data | Retention |
|---|---|
Active Household and account data | While the Household has active subscription access and the account or profile remains in the Household |
Household data after subscription access ends | 12 months from the date subscription access ends. If no subscription is re-established, the data is deleted through the next regular deletion cycle, normally within 30 days after the 12-month period |
Teen or Child profile removed from a Household | The member profile is removed when the member is removed. Activity that forms part of shared Household history may remain while the Household exists where there is a lawful basis to retain it, subject to the individual’s data-protection rights |
Unused or withdrawn invitations | Until the invitation expires or is withdrawn, plus only the short operational period required for security and audit purposes. Where an invitation results in creation of a minor profile, the relevant parental-authorisation record is retained separately as described below |
Pairing codes | Deleted once used or after 30 minutes if unused |
Parental-authorisation records | While the related minor profile exists and for up to 6 years afterwards where reasonably necessary to demonstrate the authorisation that applied and to establish, exercise or defend legal claims |
Terms and legal-notice acceptance records | While relevant to the active account and for up to 6 years after account deletion where reasonably necessary to demonstrate contractual acceptance or defend legal claims |
Deletion-request records | Up to 6 years after the request is completed, so that we can demonstrate that the request was received and acted upon |
Subscription-event audit records held by EveryNest | During the active subscription period and the 12-month post-subscription retention period, then deleted through the next regular deletion cycle unless longer retention is required for a security investigation, legal claim or legal obligation |
Transactional email records | During the active account period and the 12-month post-subscription period, then deleted through the next regular deletion cycle unless longer retention is reasonably required for complaint handling, security or legal claims |
Google Play payment records | Retained by Google under Google’s own privacy and retention terms |
Accounting and transaction records held by Pivotal Finance Solutions S.à r.l.-S | 10 years from the end of the financial year to which the records relate where required by Luxembourg accounting law. Luxembourg’s Code de commerce requires relevant accounting documents to be retained for 10 years. |
Customer-support emails and Formspree contact/support submissions | 2 years from the last substantive contact, unless longer retention is reasonably required for an unresolved dispute or legal claim |
Product-update and feedback consent records | Until consent is withdrawn, with a limited suppression record retained afterwards where necessary to ensure the preference continues to be respected |
Server, security and diagnostic logs | For the shortest operational period reasonably necessary for security and troubleshooting. A relevant log may be retained longer where required to investigate a security incident or establish, exercise or defend a legal claim |
Retired OG Nester number | The number, retirement status and retirement date are retained indefinitely so that the number is never reissued. The former holder’s name, email address and other identifying information are not retained indefinitely for this purpose |
Where an adult account is deleted but the person previously contributed to shared Household history, their identifying display name is replaced with a neutral label where it is no longer necessary to identify them. Records that must be retained under law, or that are reasonably required to establish, exercise or defend legal claims, are retained only for the applicable period and purpose.
13. Post-subscription window
When subscription access ends, all Household members lose access and we notify the Household Owner using the email address on their account. The Household data is retained for the 12-month period described in paragraph 12. If the Household Owner resubscribes during that period, access is restored once the subscription entitlement is confirmed. Data-protection rights remain available throughout the retention period and can be exercised by contacting hello@everynest.app. When data is deleted from active systems, copies may remain temporarily in backup systems until those backups are overwritten in accordance with the applicable backup cycle. Backups are retained for disaster-recovery purposes and are not used to circumvent a deletion request.
14. Your rights
Under GDPR, you have a set of rights over your personal data. You can exercise all of them by emailing hello@everynest.app.
Right of access. You can ask for a copy of the personal data we hold about you. We will respond within the time required by applicable data-protection law, normally within one month. Where the law permits additional time for a complex or numerous request, we will tell you.
Right to rectification. You can ask us to correct anything that is inaccurate.
Right to erasure (“right to be forgotten”). You can ask us to delete your data. We may need to keep some records for legal reasons (for example, payment records for accounting), and we will tell you which.
Right to restrict processing. You can ask us to pause processing in certain circumstances.
Right to data portability. Where Article 20 GDPR applies, you may ask to receive personal data concerning you that you provided to us in a structured, commonly used and machine-readable format. EveryNest also provides a Household export function for Parents. That product function is separate from, and does not determine the scope of, the statutory right to data portability.
Right to object. You can object to processing based on legitimate interests, including any direct marketing.
Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.
Rights related to automated decision-making. We do not make automated decisions that have legal or similarly significant effects on you.
For Children and Teens: Children have data-protection rights in their own personal data. A person with parental responsibility, or another person lawfully authorised to act for the child, may exercise rights on the child’s behalf where appropriate. A Child or Teen may also exercise rights directly where they are capable of understanding and exercising those rights. We will take account of the individual’s age, maturity, circumstances and best interests and may request information reasonably necessary to verify identity or authority.
14.1. Complaints
You may complain to the data-protection authority in the country where you habitually live or work, or where you believe an infringement occurred. Our supervisory authority is the Commission nationale pour la protection des données (CNPD) in Luxembourg. UK users may also complain to the Information Commissioner’s Office (ICO). A directory of EEA supervisory authorities is available from the European Data Protection Board.
14.2. A note on household-level deletions
Any account holder may request erasure of their personal data under Article 17 GDPR. This right is subject to the conditions and exceptions provided by applicable data-protection law; membership of a Household does not prevent a person from making such a request. If you are the Household Owner and another Parent is in your household, we will offer you the option of transferring ownership first so the household can continue without you. That is an option, not a condition - if a transfer does not happen, you can still delete your account through a route that ends the household. We tell you what that removes before you confirm, and other adults keep their own EveryNest accounts.
Deleting a Household removes the Household, its shared content and each member’s association with that Household. It does not delete another adult’s separate EveryNest account, although personal data held only as part of the deleted Household is dealt with in accordance with this policy.
14.3. Your rights do not depend on paying us
Your data-protection rights continue whether or not the Household has an active subscription. Some self-service functions are unavailable once subscription access ends, but you can always exercise your rights by contacting hello@everynest.app.
14.4. Rights during retention window
During the 12 months when your data is retained after a subscription ends (paragraphs 12 and 13), you cannot sign in to EveryNest. You can still exercise all of the rights above by emailing us at hello@everynest.app. We will respond within the time required by applicable data-protection law.
15. Security
We use technical and organisational measures appropriate to the nature of the personal data we process and the risks involved, with particular attention to data relating to minors. These measures include secure password handling and authentication, encryption in transit and at rest, access controls and database-level restrictions designed to isolate Household data, time-limited pairing credentials, restricted production access, processor-management measures, and security and incident-response procedures. We maintain a Data Protection Impact Assessment for processing involving minors and review our safeguards when material changes are made to the service.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay, unless an applicable exception applies.
16. Cookies and similar technologies
EveryNest does not currently set cookies. The EveryNest app and website use local storage and session storage that are strictly necessary to provide the service, including authentication and Household functionality. We do not use advertising cookies, social-media tracking tools or third-party behavioural analytics.
For more details, see our Cookie Policy.
17. Product updates and feedback requests
We send two kinds of emails.
Transactional emails, such as password resets, account notifications, security alerts and material policy notices, are sent where relevant to account holders who have an email address. These communications are not marketing and are necessary to operate or administer the account or service.
Product updates and feedback requests are optional. If you tick the relevant box at sign-up (or turn the setting on later in Settings), we’ll occasionally email you about new features, EveryNest news, and short feedback requests where we ask what you’d find useful. You can change your preference at any time in Settings, or by using the unsubscribe link at the bottom of any such email.
We do not send product updates or feedback requests to Teen or Child accounts.
18. Automated decision-making and profiling
We do not carry out any automated decision-making producing legal effects or similarly significantly affecting you within the meaning of GDPR Article 22. We do not profile users to predict behaviour. We do not use algorithmic recommendation, targeting, or ranking systems on minor accounts.
19. Changes to this policy
If we make a material change to this policy, we will provide appropriate notice before the change takes effect, taking account of the nature of the change and the people affected. This may include notice by email or in EveryNest. We will keep previous versions available so that you can see what has changed.