Privacy Policy

1. Who We Are

Nesra is a trading name of NESRA COMPANION LTD, a private limited company registered in England and Wales. NESRA COMPANION LTD is responsible, as data controller, for the personal information described in this policy from the date shown above.

We will add NESRA COMPANION LTD's registration reference with the Information Commissioner's Office (ICO) to this policy once one has been issued.

2. Company History and 360Milieu Creatives Ltd

The Nesra brand and app existed before NESRA COMPANION LTD was incorporated on 30 October 2026. Earlier versions of this policy (Version 1.0, February 2026) identified 360Milieu Creatives Ltd (company number 16661000) as the organisation responsible for Nesra and gave the address Unit D, 4 Cwm Road, Hafod, Swansea, SA1 2AY.

360Milieu Creatives Ltd is a separate company. It holds ICO registration reference ZC130239 in its own name. That registration belongs to 360Milieu Creatives Ltd; it is not a registration of NESRA COMPANION LTD and does not cover NESRA COMPANION LTD's processing.

If you have a question or request about personal information handled while an earlier version of this policy was in force, contact us at contact@nesra.co.uk and we will make sure it reaches the organisation responsible.

3. Personal Data Collected by the App

When you use the Nesra app, we collect and process the following categories of personal data:

* May include special category (health) data — see Section 5.

4. Where App Data Is Stored

Nesra uses a combination of storage on your device and cloud services. Some app information is stored locally on your iPhone, and some is stored in or processed by cloud services operated by our providers, including Supabase for authentication and Rork for AI features (see Sections 6 and 8). Nesra does not keep all personal content only on your device.

Information sent to a cloud service is protected in transit with encrypted connections. We do not publish details of specific hosting regions, database configurations or backup arrangements in this policy; you can ask us for more information at contact@nesra.co.uk.

Uninstalling the app does not necessarily delete information held in the cloud. To remove cloud-held information linked to your account, use account deletion in the app (Section 10) or contact us.

5. Special Category Data: Mental Health Information

5.1 What your consent covers

We process this information only with your explicit consent (Article 9(2)(a) UK GDPR). Your consent covers storing and processing your journal entries, mood records and AI conversations so that Nesra can provide those features, including sending relevant content to our AI provider to generate replies, reflections and summaries.

5.2 How and when consent is requested

The app asks for this consent separately from accepting the app's terms, before features that process this information are used. Consent is given by actively choosing to agree in the app; it is not a condition of downloading the app.

5.3 Withdrawing consent

You can withdraw consent at any time using the consent controls in the app. After you withdraw, we stop processing your journal, mood and AI conversation data for those features, and features that depend on that processing stop working until you give consent again. Withdrawal does not affect processing carried out before you withdrew.

5.4 Deleting this information

Withdrawing consent stops further processing but does not by itself delete information you have already created. To have it removed, delete it in the app, delete your account (Section 10), or contact us at contact@nesra.co.uk.

6. AI Features and Rork

The app's AI features — the AI chat companion, journal reflections, mood insights and weekly or monthly summaries — use an AI integration provided by Rork, Inc. ("Rork"), a company based in the United States.

What is sent: when you use an AI feature, the content needed to produce the result is sent to Rork for processing. Depending on the feature, this can include your message, recent conversation context, journal text or mood information.

Why: to generate the AI response, reflection or summary you asked for.

Retention, model training and subprocessors: Rork's published privacy policy states that it uses service providers for AI generation, but it does not specifically describe how content sent through the AI integration used by apps such as Nesra is retained, whether it may be used to train AI models, or which AI model providers process it. We have not verified these points and do not make promises about them. We are seeking written confirmation from Rork and will update this section when we have it.

International transfers: AI requests are processed outside the UK, including in the United States (see Section 9).

We do not use your content to train AI models of our own. AI-generated content can be inaccurate and is not professional advice. You can stop AI processing by not using AI features or by withdrawing consent (Section 5.3).

7. Lawful Bases for Processing

8. Service Providers and Other Recipients

We share personal information with the providers below only as needed to run Nesra. Their role differs: some process information on our behalf, while others, such as Apple, act as independent controllers under their own terms.

We may also disclose information to professional advisers, or where required by law or to protect someone's safety.

We do not sell your personal data. We do not share it with third parties for their own marketing, and we do not use advertising cookies or advertising pixels.

9. International Data Transfers

Several of our providers are based in, or process data in, the United States or other countries outside the UK. When personal data is transferred outside the UK, UK GDPR requires the transfer to rely on an adequacy regulation or on appropriate safeguards, such as the ICO International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses.

We are confirming the transfer mechanism used by each provider. You can request details by contacting contact@nesra.co.uk.

10. Account Deletion and Data Export

10.1 Deleting your account

You can delete your Nesra account from the account settings in the app. Account deletion is intended to delete your account and the personal information linked to it that we hold in cloud services, including your authentication record and cloud-held journal, mood, AI conversation and other account records. Information stored only on your device is removed when you delete it in the app or remove the app.

We may keep limited information after deletion where the law requires or allows it, for example records needed to meet legal obligations, resolve disputes or establish or defend legal claims. Copies in routine backups may persist for a limited period before being overwritten.

Deleting your account does not cancel an App Store subscription. Subscriptions are managed by Apple; cancel in your Apple ID subscription settings (see the Terms).

If you cannot use in-app deletion, email contact@nesra.co.uk from the address linked to your account.

10.2 Exporting your data

You can export your data from the app's settings. We recommend exporting anything you want to keep before deleting your account.

11. How Long We Keep Your Data

12. Your Rights Under UK GDPR

You have the rights below. We will respond to a valid request within one month, which may be extended in limited circumstances allowed by law. There is normally no charge.

• Access — ask for a copy of your personal data.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data in certain circumstances; you can also use account deletion (Section 10).
• Restriction — ask us to limit how we use your data, for example while accuracy is checked.
• Data portability — receive data you provided in a structured, machine-readable format; you can also use in-app export.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, using in-app consent controls or by contacting us (Section 5.3).
• Automated processing — see Section 13.

To exercise a right, contact contact@nesra.co.uk. We may need to confirm your identity before acting on a request.

13. Automated Processing and Profiling

The AI features use automated processing to generate reflections, summaries and mood insights from your content. This may involve profiling, because it evaluates information about your wellbeing.

Nesra does not make decisions based solely on automated processing that have legal or similarly significant effects on you. AI outputs are wellbeing suggestions only. You can avoid this processing by not using AI features or by withdrawing consent.

14. Children's Privacy

The app is not directed at children under 13. In the UK, children under 13 cannot give their own consent to the processing of their personal data for online services; a parent or guardian must consent on their behalf.

If you are a parent or guardian and believe a child under 13 has used the app without your consent, contact contact@nesra.co.uk and we will delete the relevant data.

Some Nesra users may be under 18. We are reviewing the app against the ICO's Age Appropriate Design Code (Children's Code). This policy does not describe age-verification or child-specific technical controls in the app.

15. Personal Data Collected by the Website

15.1 Enquiries

When you send an enquiry through the website, we store your name, email address, organisation (if given), enquiry type, message and any school or programme details you provide, in our website database hosted by Neon. A copy of the enquiry is emailed to our inbox at contact@nesra.co.uk using Resend so we can reply. We use these details only to respond and to discuss the service or collaboration you asked about. Enquiries are not added to marketing lists and no confirmation email is sent to you.

Please do not include pupil names or sensitive health information in an enquiry. To protect the form from spam, we keep short-lived counters based on one-way hashes of your IP address and email address; these reset after an hour.

15.2 Update registrations

If you registered for Nesra updates, we store your email address, the time you signed up and the IP address of the request, and use your email only for the updates you asked for. You can withdraw consent and ask us to delete these details at any time by emailing contact@nesra.co.uk.

15.3 Website analytics

We use Vercel Web Analytics to understand how the website is used in aggregate: pages viewed, referring websites, campaign (UTM) parameters, country, device type and browser, and clicks on links such as the App Store and Instagram, together with a successful-enquiry count. It does not use cookies or store identifiers on your device. Before any event is sent, we remove all web address parameters other than standard UTM campaign parameters. We never send names, email addresses, enquiry messages or app content to analytics.

15.4 Hosting logs

Our hosting provider, Vercel, processes technical request information such as IP address, browser details and the pages requested, to deliver the website and protect it from abuse.

16. Cookies

The website does not set advertising cookies and does not use cookies for analytics. See our Cookie Policy for details.

17. Security

We use technical and organisational measures appropriate to the information involved, including encrypted connections and restricted access to systems that hold personal data. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

18. Changes to This Policy

We may update this policy. If we make material changes, we will tell you in the app or by email before they take effect where we are able to.

19. How to Contact Us

For any question or request about this policy or your personal data, email contact@nesra.co.uk.

Post: NESRA COMPANION LTD, 13 Market Street, Morriston, Swansea, Wales, SA6 8DA.

20. Your Right to Complain

If you are in the EU or EEA, you can complain to your local data protection authority. We would appreciate the chance to address your concerns first, so please contact us before going to a regulator if you can.