This Privacy Policy explains how NestMatch Ltd(“NestMatch”, “we”, “us”) collects, uses, and shares personal data when you use our website and services. It is written for users in the United Kingdom, the European Economic Area, and other regions including the United States, and is designed to comply with the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, the California Consumer Privacy Act / CPRA, and equivalent laws.
1. Who is the controller?
NestMatch Ltd is the controller of your personal data. You can contact us about this policy or your rights at hello@nestmatch.co.uk.
2. What we collect
- Account data — if you sign in, your name, email address, profile image, and a stable user ID from your authentication provider (e.g. Google).
- Onboarding answers — your responses to the NestMatch quiz, including life stage, lifestyle preferences, settlement type, budget, commute destinations, and dealbreakers.
- Search inputs & results — the matches we generate for you and any feedback you give on them.
- Anonymous device identifier — if you use the Service without signing in, we generate a random ID stored on your device so we can deliver results and remember your consent choices.
- Consent records — the version of the Terms and Privacy Policy you accepted, the date/time, your IP address, and your user agent.
- Technical data — IP address, browser type, device type, operating system, referring URL, and access logs, collected automatically when you use the Service.
- Communications — messages you send us, including any support emails.
We do not knowingly collect special-category personal data (for example health, religion, or political views), and we ask that you do not submit such data through the Service.
3. How we use your data and our lawful bases
- To deliver the Service (run the matching engine, show results, save your preferences) — lawful basis: performance of a contract; or, where you are not signed in, our legitimate interest in providing the Service you have requested.
- To generate AI-powered area matches using Google Gemini and similar models — lawful basis: your consent, given at the point you ask us to generate matches.
- To keep the Service secure and reliable (abuse prevention, debugging, capacity planning) — lawful basis: legitimate interests.
- To improve the Service (aggregate analytics, model quality reviews) — lawful basis: legitimate interests; we use aggregated or de-identified data wherever possible.
- To connect you with partner services you ask us to (for example, when you submit a moving or services enquiry) — lawful basis: your consent, given when you submit the enquiry. The partner service is a separate controller of the data you provide to it.
- To meet legal and regulatory obligations — lawful basis: legal obligation.
4. Who we share data with
We share personal data only with trusted processors who help us run the Service:
- Google LLC — authentication (Google Sign-In), AI matching (Gemini), Places and Routes APIs (place suggestions and commute times), and YouTube (embedded neighbourhood videos).
- Supabase Inc. — managed PostgreSQL database hosting and object storage.
- Vercel Inc. — web hosting and edge delivery, and website analytics (only after you accept the optional analytics cookie).
- Mapbox Inc. — mapping and geocoding services shown on results pages.
- Resend — sending transactional emails (sign-in codes, account confirmations, enquiry confirmations).
- PostHog Inc. — product analytics, only after you accept the optional analytics cookie (see the Cookie Policy).
- Sentry (Functional Software Inc.) — error and performance monitoring. We do not use session replay and do not capture screen content.
- Image and content providers (e.g. Unsplash, Flickr, Wikimedia, YouTube) — only when needed to display media.
When you ask us to connect you with a partner service (for example, a removals company or mortgage adviser), we pass your enquiry details to that service with your consent. That service is a separate data controller and will have its own privacy policy. NestMatch may receive a fee from some partner services; this does not affect the price you pay.
We may also share data with professional advisers, regulators, or law enforcement where legally required, and with a successor entity in the event of a corporate restructuring, sale, or merger.
5. International transfers
Some of our processors are located outside the UK and the EEA, including in the United States. Where this is the case, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with supplementary measures where required.
If you use the Service from outside the UK, the EEA, or the United States, your personal data may be processed in those regions and in the country where you are located. By using the Service you understand that your data may be transferred internationally, and we apply the safeguards described above wherever the UK GDPR or the EU GDPR applies.
6. How long we keep your data
- Account & onboarding data: while your account is active, plus up to 24 months of inactivity, after which it is deleted or anonymised.
- Anonymous-user onboarding & search data: up to 12 months from last activity.
- Consent records: retained for at least the duration of our regulatory record-keeping obligations (typically 6 years).
- Server logs: typically 90 days.
7. Your rights
Depending on where you live, you have rights including: access to your data; correction; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interests; withdrawal of consent at any time; and the right to lodge a complaint with a supervisory authority.
California residents have additional rights under the CCPA / CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of “sale” or “sharing” of personal information. NestMatch does not sell personal information and does not share it for cross-context behavioural advertising.
You can delete your account and your data yourself at any time from your results page (“Delete my data”). To exercise any other right — access, portability, rectification, restriction, or objection — email hello@nestmatch.co.uk from the address associated with your account, or include your anonymous device ID if you used the Service without signing in. We will respond within the timeframe required by the applicable law (typically one month under UK / EU GDPR).
8. Withdrawing consent
Where we rely on your consent (for example, to run AI matching), you can withdraw it at any time by contacting us. Withdrawal does not affect processing carried out before the withdrawal.
9. Cookies
We use only strictly-necessary cookies and similar technologies to keep you signed in and the Service working. See our Cookie Policy for details. We will not place non-essential cookies on your device without your consent.
10. Security
We use industry-standard technical and organisational measures to protect your personal data, including encryption in transit, access controls, and least-privilege practices. No system is 100% secure; if we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.
11. Children
The Service is not directed to children under 16 (or the age of digital consent in your country, if higher). We do not knowingly collect personal data from children, and the Service is not directed to children under 13 in the United States (consistent with the Children’s Online Privacy Protection Act, COPPA). If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If a change is material we will give reasonable notice (for example, in-app or by email) and, where required, ask you to re-confirm your consent.
13. Complaints
If you have a complaint about how we handle your personal data, please contact us first at hello@nestmatch.co.uk. UK users may also complain to the Information Commissioner’s Office (ico.org.uk). EEA users may complain to their local data protection authority.
14. Contact
NestMatch Ltd · hello@nestmatch.co.uk