1. Who we are
DXNest (“DXNest”, “we”, “us”) develops and operates:
- DXNest Fabrication — the workspace for fabrication companies at fabrication.dxnest.io (office, production, field crews, clients), including its Nesting module and the client portal;
- DXNest Fabrication Solo — the personal nesting and CNC application at the same address;
- DXNest Motion — mechanism design and kinematic analysis at motion.dxnest.io;
- the DXNest mobile app for iOS and Android — the companion to DXNest Fabrication for employees (time clock, work cards) and administrators;
- the website dxnest.io.
Together these are the “Services”. This policy explains what personal data the Services handle, why, who it is shared with, how long it is kept and what choices you have. Questions go to contact@dxnest.io.
2. Your company's data
DXNest Fabrication and the mobile app are business software. A company that uses them decides what it records about its employees, clients, suppliers and projects, and why. For that data the company is the controller, and DXNest processes it on the company's behalf and on its instructions (as a processor or service provider). If you are an employee or a client of a company that uses DXNest, please send requests about that data to the company first — we will help it answer.
DXNest is the controller for the account and security data we need to run the Services (sign-in, sessions, visit and security logs), for DXNest Fabrication Solo and DXNest Motion accounts, and for messages sent to us through dxnest.io.
If your company runs DXNest Fabrication on its own server (the mobile app lets you choose the server you sign in to), your data is stored on that server, the company that operates it is responsible for it, and DXNest does not receive it.
3. Data we collect
Account data
Username, display name, company and role, the time of your last sign-in, and your password — stored only as an Argon2id hash that cannot be turned back into the password. None of the Services offers public sign-up: accounts are created by your company's administrator or by us. The Fabrication Solo demo creates a temporary account that is deleted when the demo ends; the Motion demo is one shared account that cannot save or upload files.
Content you and your company enter
- drawings, DXF files, projects, parts, mechanisms, nesting and CNC output;
- orders, quotes, invoices, purchase orders, stock, production and shipping records;
- contact details of clients and suppliers (names, e-mail addresses, phone numbers, addresses);
- employee records your company keeps (name, phone, e-mail, department, position, hourly rate, hire date, notes), timesheets and absences;
- work cards with their photos, files and comments, and messages exchanged through the client portal;
- e-mails sent from DXNest Fabrication (recipient, subject, time and attachments are logged with the record they belong to);
- a history of who changed what in the company's records.
Data from the mobile app
- Precise location — for the time clock only; see section 4.
- Photos and files — only the ones you choose to take with the camera or pick from your photo library or files, to attach to a work card. The app does not read the rest of your library.
- Push notification token, platform and device name — to deliver notifications (a new work card, a changed due date, a message); removed from our server when you sign out.
- Device name and model — shown in your list of signed-in devices, so you can recognise and end a session.
- On the phone itself — your sign-in token in the system's secure storage (iOS Keychain, Android Keystore), a cached copy of your profile and any location points waiting for a signal. All of it is cleared when you sign out.
The app does not access your contacts, microphone, calendar or health data, does not use the advertising identifier, contains no advertising, analytics or crash-reporting SDKs, and does not track you across other companies' apps or websites.
Usage and security data
- Sessions: when each was started and last used, the browser or app (user agent), and a one-way hash of the IP address — not the address itself.
- Visit log: start and end of each visit, the IP address shortened to its network (IPv4 to /24, IPv6 to /48 — enough to see the network, not the device), the approximate country, region and city, looked up from your IP address on our own server in a local GeoIP database (no third party is asked; only the shortened address and the result are stored), the browser and its language, and for demo visits the page you came from.
- Security logs: sign-in attempts, actions of site administrators and rate-limit events, used to protect accounts and investigate abuse.
AI assistant (DXNest Fabrication, optional)
If your company turns the assistant on, what you write to it, the files you attach and the records it reads to answer are processed as described in section 6.
Website enquiries
The contact form on dxnest.io collects your name, e-mail address, company, topic and message. We receive it by e-mail and keep it in the website's administration area to answer and follow up. Your IP address is used, only as a hash and for 30 seconds, to limit spam.
4. Location in the mobile app
The time clock in the DXNest mobile app uses your phone's precise location only to record where you work while you are at work.
- Clocking in and out. When you clock in, start or end a break, switch to another site or clock out, the app takes one location reading and stores it with that time entry. Your company can require you to be at the site to clock in.
- While you are clocked in, and only if your company has turned tracking on, the app records where the phone is at the interval your company sets (every 5 minutes by default, or sooner when you have clearly moved). If you choose “Allow all the time” / “Always”, this continues while the app is in the background: Android shows a permanent “DXNest · at work” notification and iOS shows the location indicator. Without that permission, location is recorded only while the app is open.
- Never off the clock. Recording stops when you clock out, when the office closes your time entry or when you sign out. The server discards any point that does not fall inside one of your working periods.
- Without a signal, points wait on the phone and are uploaded later.
- Who sees it: your company's administrators and managers, together with your hours (who is at work, where, since when, and the day's route). DXNest staff access it only when needed to support your company or keep the Service running.
- How long: the route and the individual readings are deleted automatically after 180 days. The clock-in and clock-out positions stay with the time entry as part of your company's timesheet for as long as the company keeps it.
- Location is not used for advertising, not sold and not shared with anyone outside your company except the hosting provider that stores it.
- You can withdraw the permission at any time in the phone's settings (the app's Profile screen has a shortcut). Without it you may not be able to clock in from the phone if your company requires a location; your office can record your time instead.
5. How we use data
| Purpose | Legal basis (where the law requires one) |
|---|---|
| Provide the Services: sign-in, storing and processing your work, nesting and CNC jobs, documents, e-mails and notifications | Performance of our contract with you or your company |
| Time and attendance, including location in the mobile app | Your company's legitimate interest in accurate working-time records and its legal obligations; on the phone, your permission |
| Security, preventing abuse, troubleshooting | Our legitimate interest in keeping the Services and your data safe |
| Support and service messages | Contract; legitimate interest |
| Answering enquiries from dxnest.io | Steps you ask for before a contract; legitimate interest |
| Complying with the law | Legal obligation |
We do not sell personal data, use it for advertising or share it for cross-context behavioural advertising, build marketing profiles, use your content to train AI models, or make decisions with legal or similarly significant effects about you by automated means alone.
6. Who we share it with
Inside your company, according to the roles your company assigns. A client sees in the client portal only what the company shares with them.
Service providers that process data for us, under contract, only to provide the Services:
- Namecheap, Inc. — hosting of the servers that run the Services and of this website.
- Expo (650 Industries, Inc.), Apple Push Notification service and Google Firebase Cloud Messaging — delivery of push notifications (the push token and the notification's text).
- Google Maps (Android) and Apple Maps (iOS) draw the maps in the mobile app, and OpenStreetMap serves the map tiles in the web app. They receive the map area being shown and your IP address, under their own privacy policies.
- E-mail sent from DXNest Fabrication goes through your company's own mail server (for example Gmail or Microsoft 365) or through our e-mail provider. To use its own server, your company enters the server's address and a sign-in, often an app password made for DXNest. We use that sign-in only to send the messages sent from the Services; we never read, download or change the mailbox. The password is stored encrypted, is replaced when your company enters a new one and is deleted with the company, and it can be revoked at any time in the mail account (for Google, at myaccount.google.com/apppasswords).
Integrations your company chooses to turn on:
- AI assistant — Anthropic (Claude) or OpenAI (ChatGPT), whichever the site administrator has selected. When you use the assistant, your message, the files you attach and the records it reads to answer are sent to that provider's API. Under these providers' API terms the data is not used to train their models. Conversations are kept on our server for 30 days and files given to the assistant for 24 hours.
- Accounting — QuickBooks Online (Intuit Inc.) or Xero (Xero Limited). Invoices, bills, payments and the related client and supplier contacts are exchanged with the account your company connects. Access tokens are stored encrypted.
Legal reasons — when the law, a court order or a valid request from an authority requires it, or to protect the rights, property or safety of people and of the Services.
Business transfer — if DXNest or its products are sold or merged, personal data may pass to the new owner, who must keep protecting it as this policy describes.
7. Cookies and local storage
DXNest Fabrication and DXNest Motion use only cookies that are strictly necessary: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. The browser's local storage keeps your preferences on your own device (the remembered company domain, view and zoom settings). We use no advertising or analytics cookies.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data and your company's content | While the account or the company's subscription is active; deleted when the account or company is deleted. Copies in backups disappear as the backups are replaced. |
| Location route and readings (mobile app) | 180 days |
| Clock-in and clock-out positions | With the time entry, as long as your company keeps its timesheets |
| Visit logs | 365 days |
| Site administrators' audit log (DXNest Fabrication) | 2 years |
| Security audit log (DXNest Motion) | 90 days |
| Sign-in sessions | 12 hours in the browser, 60 days in the mobile app, or until you sign out |
| Nesting jobs not saved to a project | 24 hours after the job finishes |
| AI assistant conversations / files | 30 days after the last message / 24 hours |
| Push notification tokens | Until you sign out or the token stops working |
| Fabrication Solo demo accounts | Deleted when the demo session ends |
| Website enquiries | As long as needed to answer and follow up, or until you ask us to delete them |
Your company can delete its own records sooner, and decides how long it keeps the records it is responsible for.
9. Security
- All connections to the Services use HTTPS (TLS).
- Passwords are stored only as Argon2id hashes; on the phone the sign-in token is kept in the system's secure storage.
- Secrets such as mail-server passwords, AI provider keys and accounting tokens are encrypted (AES-GCM).
- Each company's data is kept apart, and access inside a company is limited by role.
- Sign-in attempts are rate-limited, and IP addresses in our logs are shortened or hashed.
No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.
10. International transfers
Our servers and service providers may be in a country other than yours, including the United States. Where the law requires it, we protect such transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
11. Your rights and choices
Depending on where you live — for example under the GDPR in the EU and the UK, PIPEDA in Canada, the CCPA/CPRA in California or the personal data protection law of Ukraine — you may have the right to:
- access your personal data and receive a copy of it in a portable format;
- have it corrected or deleted;
- restrict or object to its processing;
- withdraw a consent or permission you gave, at any time;
- complain to your data protection authority.
To use these rights, write to contact@dxnest.io. We may need to confirm who you are, and we answer within 30 days or the shorter time the law sets. If the data belongs to your company (see section 2), we pass the request to the company and help it answer. We do not sell or share personal data as those terms are defined in California law, and we will not treat you differently for using your rights.
On the phone you can turn off location, camera, photo library and notification access at any time in the system settings. The app keeps working; only the features that need that access stop.
12. Deleting your account
This section applies to DXNest Fabrication, the DXNest mobile app, DXNest Fabrication Solo and DXNest Motion.
- Company accounts (DXNest Fabrication and the mobile app): ask your company's administrator, who can delete your account in DXNest Fabrication. You can also ask us directly, as described in step 2.
- Any account: e-mail contact@dxnest.io with the subject “Delete my DXNest account”, your username and, for a company account, your company's domain. Write from the e-mail address your company or we have on file, or we will confirm the request with you or your company.
- We delete the account within 30 days and confirm by e-mail.
What is deleted: your account, sign-in sessions, push tokens, AI assistant conversations and, for Fabrication Solo and Motion, your projects and files.
What may be kept: records that belong to your company — such as orders, invoices and timesheets that it must keep by law — stay under the company's control and may still show your name; the company can delete them, including your employee record and location history. Visit and security logs are kept for the periods in section 8 and then deleted.
Uninstalling the mobile app removes the data stored on the phone, but does not delete your account.
13. Children
The Services are made for businesses and professionals. They are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to this policy
When this policy changes, we update the date at the top of this page. If a change is significant, we tell you in the Services or by e-mail before it takes effect.
15. Contact us
DXNest
E-mail: contact@dxnest.io
Toronto, ON, Canada