Privacy Policy

2. What data we collect

Account data (controller): name, email address, password (stored only as a secure hash by Firebase Authentication), organisation name, phone number if you add one, plan and subscription status, two-factor authentication settings if you turn it on. Payment card details are collected by Stripe; we do not see or store them.

Customer data (processor, on the landlord's behalf): tenant names, email addresses and phone numbers; property addresses; rent and deposit amounts; tenancy dates; payment history; maintenance reports and photos; documents such as licence and tenancy agreements; electronic signatures; notices; messages between landlord and tenant.

Bank data (processor, only if the landlord connects a bank): see section 6.

Usage and device data: pages visited, features used, browser and device type, and IP address. Server logs are used for security and troubleshooting. Analytics data is only collected with your consent (section 11).

Error reports: technical reports when something breaks in your browser — see section 7.

Communications: support requests, emails you send us, and records of the transactional emails we send on your behalf (recipient, type, date and delivery status).

Optional feedback: if you answer the short "why didn't you sign up?" question on our website, we store your answer and, only if you choose to give it, your email address.

3. Legal basis for processing

• Contract (Art. 6(1)(b)): running your account and providing the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing fraud and abuse, fixing errors, and answering feedback you choose to send us.
• Legal obligation (Art. 6(1)(c)): keeping billing and accounting records as Irish tax law requires.
• Consent (Art. 6(1)(a)): analytics and advertising-measurement cookies. You can withdraw consent at any time.

For customer data we process on a landlord's behalf, the landlord (as controller) is responsible for having a valid legal basis for collecting that data and putting it into NestHub.

4. How we use your data

• To provide, maintain and secure NestHub
• To take subscription payments through Stripe
• To send the transactional emails the service depends on (sign-up and verification, rent reminders, signing requests, notices, maintenance updates, monthly summaries, trial reminders)
• To generate documents such as licence and tenancy agreements
• To match incoming bank payments to rent, where the landlord has connected a bank
• To provide customer support
• To find and fix errors, and — with your consent — to understand how the website and product are used
• To comply with our legal obligations

5. Who we share data with (sub-processors)

We use the following service providers to run NestHub. Each processes personal data only to provide its service to us, under a data processing agreement.

We do not sell, rent or trade personal data. We never use tenant data for advertising. We may disclose data where the law requires it, for example in response to a valid court order.

If we add or replace a sub-processor, we will update this list and tell account holders by email before the change takes effect (see the Terms of Service).

6. Bank account information

Landlords can choose to connect a bank account so that NestHub can spot incoming rent payments. This is optional and off until a landlord turns it on.

• How it works: the connection is provided by Enable Banking Oy, a Finnish company regulated as an account information service provider. You log in and give consent at your own bank. NestHub never sees your banking username, password or security codes.
• What is read: the account name and identifiers of the accounts you choose, and their transactions — date, amount, description or reference, and the payer's name and IBAN where the bank provides them. Access is read-only: NestHub cannot make payments or move money.
• Why: only to match payments to tenants' rent.
• When: NestHub checks for new transactions automatically once a day, and whenever you press Sync.
• What we keep: the connection record (bank name, the accounts you connected, consent expiry date); payments that are matched and recorded as rent (date, amount, payer name and IBAN, bank reference); payer names you confirm so future payments match automatically; and, until you deal with them, proposed matches and a limited number of recent unmatched incoming payments for you to review. We also note which payments you dismiss so they are not suggested again. Other transactions — outgoing payments, internal transfers and anything that could not be rent — are not stored.
• How long: bank consent lasts up to 180 days, after which you must reconnect. Recorded rent payments are kept with the rest of your account data (section 9).
• How to disconnect: in NestHub, open Bank Matching and choose Disconnect. This revokes the session with Enable Banking and deletes our access tokens. You can also withdraw consent directly with your bank at any time.

7. Error reports

When something goes wrong in your browser, NestHub sends us a short technical error report so we can fix it. A report contains the error message and technical trace, the page path (without any query string or link codes), your browser type, the app version and, if you are signed in, your user and organisation identifiers.

Error reports never include what you typed into forms, email addresses, passwords or tokens. They are grouped by error and day, are only readable by NestHub staff, and are kept only as long as they are useful for fixing problems. Our legal basis is our legitimate interest in keeping the service working.

8. International data transfers

We keep our main database and files in Google's EU regions. Where a sub-processor processes data outside the European Economic Area (for example Twilio SendGrid, Anthropic, and parts of Stripe and Google), the transfer is protected by the European Commission's Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for more detail at support@nesthub.ie.

9. How long we keep data

• Account and customer data: for as long as the account is open. Landlords can edit or delete their own tenant records at any time.
• After an account is closed: we delete account and customer data within 90 days, giving the landlord the chance to export it first. The landlord remains responsible for keeping any records they are legally required to hold (for example tenancy or tax records).
• Our billing records: 6 years, as Irish tax law requires.
• Bank connection tokens: deleted when you disconnect, or unusable once the bank consent expires (at most 180 days).
• Server logs: about 30 days.
• Error reports: as long as needed to fix the problem.
• Website feedback: 12 months.
• Support emails: 2 years after the conversation ends.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected (you can edit most of it yourself in Settings)
• have your data erased, subject to legal retention obligations
• restrict processing while a complaint is resolved
• receive your data in a portable, machine-readable format
• object to processing based on legitimate interests
• withdraw consent at any time, where processing is based on consent

How to exercise them: account holders can use "Export My Data" (a JSON file) and "Request Account Deletion" in Settings → Full data & privacy. For anything else, email support@nesthub.ie. We will reply within one month. We may need to confirm your identity first.

Tenants: your landlord controls the data they hold about you in NestHub, so please contact them first. If you contact us, we will pass your request to your landlord and help them answer it.

Complaints: you can complain to the Data Protection Commission, the Irish supervisory authority, at www.dataprotection.ie. We would appreciate the chance to sort out your concern first.

11. Cookies and similar technologies

We use a small number of cookies and browser storage items. Non-essential ones are only used if you click "Accept all" on our cookie banner.

Until you accept, our Google tag runs in "consent denied" mode and does not set or read analytics or advertising cookies. Google may still receive limited, cookieless technical signals (for example that a page loaded), as part of Google Consent Mode.

To change your choice at any time, open the cookie settings.

12. Data security

We use appropriate technical and organisational measures to protect personal data, including:

• encryption in transit (HTTPS) and at rest (Google Cloud storage encryption)
• separation of each organisation's data, enforced by database and file-storage security rules
• role-based access for landlords, staff and tenants
• secure password hashing through Firebase Authentication, with optional two-factor authentication
• automatic sign-out after a period of inactivity
• secrets such as API keys held in Google Secret Manager, not in our code

No system is perfectly secure. If a personal data breach occurs, we will notify affected customers and, where required, the Data Protection Commission.

13. Data processing agreement

When a landlord uses NestHub to manage tenant data, we act as their processor under Article 28 of the GDPR. Our processor commitments — acting only on the landlord's instructions, confidentiality, security, sub-processors, help with data subject requests, deletion or return of data, and breach notification — are set out in the Data processing section of our Terms of Service, which forms our data processing agreement. You can request a signed copy at support@nesthub.ie.

14. Children's data

NestHub is not intended for anyone under 18. We do not knowingly collect personal data from children.

15. Changes to this policy

We may update this policy from time to time. We will email account holders about material changes before they take effect. The date at the top of this page shows when it was last revised.

16. Contact us

• Email: support@nesthub.ie
• Post: Linehan O'Brien Investments Ltd, Dublin, Ireland
• Data Protection Commission: www.dataprotection.ie