Privacy policy

Who we are

RedactNest, operated by Heyrbiar Khan, an individual based in Pakistan, runs this website and the redaction tool on it. RedactNest is sold through EdiventStudio, another trading name of Heyrbiar Khan. In this policy, “we”, “us” and “our” mean RedactNest.

We are the controller for the little personal data this site involves. A controller is the one who decides how personal data is used, and why.

You can reach us about anything on this page at privacy@redactnest.com.

Your documents

When you choose a PDF, it is opened and processed only in your browser, on your own device. It is never uploaded to us or to anyone else.

The tool page is locked so that your browser itself refuses to let it connect to any other site.

We never store your document, and nothing about it is saved in your browser’s storage.

What RedactNest finds in your document, the words around each item it finds, and your file’s name all stay on your device.

When you close the page or start over, the document is gone from the page’s memory.

Apart from loading the page and its own files, the tool page asks our server one question only: which plan applies to you. That request carries your sign in cookie if you have one, and nothing about your document. To answer, our server checks your sign in cookie itself and, when it shows you are signed in, asks Polar whether you hold Pro, sending your account id and nothing else.

The cleaned file is saved wherever your browser saves downloads. We cannot see, recover or delete your documents, because we never have them.

Your account

You can use the tool without an account. You need one only to buy Pro.

Your account holds your email address and nothing else. There is no name and no password: you sign in with a code sent to that address. Clerk, our sign in provider, keeps it for us until you delete the account, which you can do in Account. Clerk also records details of each sign in, listed under Services we use.

We use your email address to sign you in and to run your Pro subscription. Our legal basis is the contract between us (Article 6(1)(b) of the UK GDPR and the EU GDPR).

When you delete your account, we delete it at Clerk and delete your customer record at Polar. Polar still keeps the records tax law requires.

No page on this site sets a cookie, except the sign in and account pages. There, Clerk sets the cookies that sign in needs, on our site and on clerk.redactnest.com, its address for us. On that address, Cloudflare, the network Clerk uses, also sets cookies that protect sign in from abuse. All of them are strictly necessary for signing in and keeping it secure.

Nothing else sets a cookie on our site or on clerk.redactnest.com, and we set none of our own. Polar’s checkout and billing pages are Polar’s own site, not ours: any cookies there are set by Polar or the services it uses, not by us.

Payments

Payments are handled by Polar, our merchant of record. Your receipt shows EdiventStudio, the studio RedactNest is sold through.

A merchant of record is the seller in law: Polar sells Pro to you, works out the tax and sends your receipts. We never see your card: Polar’s payment processor, Stripe, takes your card details.

When you start to subscribe, before you pay, we send Polar your account id and email address, so your payment is tied to your account. Polar keeps that customer record even if you leave checkout, until you delete your account.

From Polar we learn only whether you hold Pro, when your subscription renews or ends, and whether it already knows your email address.

Polar handles your details for us as our processor, as its privacy policy and data processing agreement say. As merchant of record, it also uses your billing details for fraud protection and security, and keeps the records tax law requires, under Polar’s own privacy policy. Our legal basis for sending Polar your details is the contract between us, as for your account.

What we receive when you visit

Like every website, this one reaches you through a host. Whenever your browser asks for a page or a file, our host records standard request data: your IP address, your browser and device type, the page or file asked for, and the time.

This is used to deliver the site and keep it working and secure. Our legal basis is our legitimate interest in doing that (Article 6(1)(f) of the UK GDPR and the EU GDPR). A browser cannot load a page without sending its IP address, so this data is needed for you to load a page at all.

Our host keeps it for one day. We keep no copy of it, and we do not try to identify you from it.

What we do not do

• No page sets a cookie except the sign in and account pages, and we set none of our own (see Your account).
• No analytics, advertising, tracking or error reporting. The only script from anyone else is Clerk’s, on the sign in and account pages.
• Our own code keeps no logs.
• Fonts and files come from our own site, so loading a page tells no one else that you visited. The sign in and account pages are the exception: they load Clerk’s sign in.
• We do not sell your data, share it for advertising, combine it with anything else, or make automated decisions about you. There is no profiling.

Services we use

These are the outside services involved in running RedactNest.

Transfers outside the UK and the EU

We operate from Pakistan, and the services above process data in the places listed for each. When personal data leaves the UK or the EU, it is protected like this:

• Vercel. Where: The United States and other countries where Vercel operates. Safeguard: The Data Privacy Framework between the EU and the US, and standard contractual clauses.
• Clerk. Where: The United States and other countries where Clerk and its providers operate, hosted mainly by Google Cloud and Cloudflare. Safeguard: The Data Privacy Framework between the EU and the US, with its UK Extension, and standard contractual clauses where that does not apply.
• Polar. Where: The United States, Canada and other countries outside the UK and the EU where Polar and its payment processor Stripe operate. Safeguard: Standard contractual clauses, with the UK’s International Data Transfer Addendum.

The Data Privacy Framework is an agreement under which certified US companies promise to protect personal data to the EU’s standard, and its UK Extension does the same for data from the UK. Standard contractual clauses are contract terms, approved by the European Commission, that bind the receiver to protect the data, and the UK’s International Data Transfer Addendum makes them work for data from the UK.

Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• access the personal data we hold about you
• have it corrected if it is wrong
• have it erased
• restrict how it is used
• object to how it is used
• receive it in a form you can take elsewhere (portability)

Without an account, the only personal data involved is the request data our host keeps for one day, and we cannot link it to you. So most requests will find nothing, and if that happens we will tell you. With an account, Account shows your email address and lets you delete the account, and we can help with anything else.

To ask, write to privacy@redactnest.com. We will reply within one month, and there is no fee.

Complaints

If you are unhappy with how we handle your data, please tell us first at privacy@redactnest.com. You also have the right to complain to a data protection authority:

• in the UK, the Information Commissioner’s Office (ICO)
• in the EU, your own country’s data protection authority, found on the European Data Protection Board’s list of national authorities

Children

RedactNest is not aimed at children. The tool asks no one for personal details, and an account asks only for an email address.

Links to other sites

This page links to other sites, such as the services’ own privacy policies and the data protection authorities above. Their own privacy policies apply there, not this one.

Changes

When we change this policy, we update the date at the top and add a line below saying what changed.

• 6 October 2026: First published.