Privacy Policy

Who we are

Nestor Studio (“we”, “us”) is a web design and digital marketing studio operating at nestorstudio.com. Nestor Studio is a trading name of YourCars Andover Ltd, registered in England and Wales (company no. 14970300), registered office 3 Marsh Court Farm, Romsey Road, Stockbridge, SO20 6DF, United Kingdom. YourCars Andover Ltd is the data controller for the processing described here. Contact: ops@nestorstudio.com.

What data we collect

Website visitors. When you browse this site we collect standard technical data (IP address, browser type, pages visited) through privacy-respecting analytics, used only to understand aggregate site usage. If you submit a contact or booking form, we collect the details you provide (name, email, phone, message) solely to respond to your enquiry.

Clients of Nestor Studio Publisher. We operate publishing software, Nestor Studio Publisher, that plans, schedules and publishes content to our clients’ own business accounts on Facebook, Instagram, Google Business Profile, LinkedIn, X, TikTok and YouTube. It is used only by Nestor Studio and its clients under a service agreement, and nothing is published without approval. When a business account is connected through the platform’s official login, we store:

• the access and refresh tokens the platform issues, encrypted at rest (AES-256-GCM) and never shown in the software’s interface or logs;
• the basic identifiers the platform returns for that account and for the person who authorised it (such as account id, account name, profile picture, and the platform’s app-scoped user id);
• the content scheduled for publication (text, images, video) and the link to each published post;
• aggregate performance figures for the connected business accounts and their published posts (for example followers, reach, views, likes and comments counts), used for the client’s reporting.

We do not read or store private messages, follower lists, or personal data about other users of those platforms.

How we use data

Data is used only to provide the agreed services: responding to enquiries, publishing client-approved content to client-authorised accounts, checking that published posts are publicly visible, and reporting on that activity to the client. We do not sell personal data, and we do not use platform data for advertising, profiling, or to train AI models.

Google user data

Nestor Studio Publisher’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request access to Google Business Profile (scope business.manage) only to publish client-approved posts to the client’s own Business Profile and to read the profile details needed to do so. Google user data is not transferred to others except as needed to provide this feature, to comply with law, or with the user’s consent, and is never used for advertising.

YouTube. Nestor Studio Publisher uses YouTube API Services. When a client connects a YouTube channel, we request two permissions: youtube.upload, used only to upload videos the client has approved to that channel, and youtube.readonly, used only to identify the connected channel and to read the view, like, comment and subscriber counts of that channel and of the videos we uploaded, for the client’s reporting. We store the channel id and title, the encrypted access and refresh tokens, and the id, link and counts of each video we uploaded. This data is shown only to the client and to Nestor Studio staff working for them, and is not shared with anyone else except Google itself. Google’s processing is governed by the Google Privacy Policy. In addition to our own deletion procedure below, you can revoke Nestor Studio Publisher’s access to your Google and YouTube data at any time on the Google security settings page at https://security.google.com/settings/security/permissions. Questions or complaints about our privacy practices: ops@nestorstudio.com.

Cookies and third-party content. The Publisher web application sets a single strictly necessary, httpOnly session cookie to keep signed-in users logged in. It uses no advertising or tracking cookies, and it does not allow third parties to serve content or advertisements.

Storage, security and retention

The publishing software and its database run on access-controlled servers in the European Union (France). Images and videos scheduled for publication are held in cloud storage (Cloudflare R2) at unlisted addresses, because each platform fetches them from there when publishing. Access tokens are encrypted at rest and only decrypted on the server at the moment of use. Tokens are kept only while the client engagement is active and are deleted, and where the platform allows revoked, when a client disconnects an account, when the engagement ends, or on request. Form enquiries are retained for up to 24 months.

Third parties

Publishing requests are sent to the relevant platform APIs (Meta, Google including YouTube, LinkedIn, X, TikTok) on the client’s behalf, and each platform’s own privacy policy governs its processing. We use trusted infrastructure providers (Hostinger for hosting, Cloudflare for media storage) under data processing terms. We use AI services (Anthropic) to help draft content; client data sent to them is not used to train their models.

Deleting your data

You can ask us to delete the data we hold about you or your connected accounts at any time by emailing ops@nestorstudio.com. If you remove Nestor Studio Publisher from your Facebook account (Settings, Security and login, Business integrations) or ask Facebook to delete your data, Facebook notifies us automatically and we delete the stored tokens for your login. Full instructions: Data deletion.

Your rights

Under UK GDPR and EU GDPR you may request access, correction, deletion or portability of your personal data, and you may withdraw consent at any time. To exercise any right, or to revoke our software’s access to your accounts, email ops@nestorstudio.com. You may also revoke access directly in each platform’s settings. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) or your local supervisory authority.