Privacy Policy

This Privacy Policy explains how Nestmarket Inc. ("Nestmarket," "we," "us," or "our") may collect, use, disclose, and safeguard your personal information when you access and use our provided applications, features, services, technologies, and software ("Website"), a platform that facilitates, among other things, community participation in asset acquisition as well as provides information. We are committed to protecting your privacy and complying with applicable data protection laws, including the California Consumer Privacy Act (CCPA/CPRA) and the European Union's General Data Protection Regulation (GDPR).

We use your personal information to:

• authenticate your account and operate session-policy controls;
• process Unit purchases, marketplace trades, wallet funding and withdrawals, rent payments, and other on-platform financial activity;
• deliver the social features of the Website, including chat, comments, reactions, follows, blocks, and the public gallery;
• evaluate rental applications for pilot rental programs and communicate with applicants about their status (see “Pilot Rental Application Data” below);
• send transactional and administrative communications by email, such as receipts, security alerts, withdrawal status updates, lease offers, moderation notices, and updates to these policies;
• send in-product or email notifications related to features you have opted into, in accordance with your notification preferences in settings;
• moderate content uploaded to the Website, including automated screening for unsafe content and human review of flagged material;
• detect, investigate, and prevent fraud, security incidents, abusive activity, and other unlawful or policy-violating behavior;
• comply with our legal, regulatory, tax, anti-fraud, anti-money-laundering, and record-keeping obligations, including reporting of unlawful content as required by law;
• measure and improve platform performance, fix bugs, and conduct internal research on aggregated usage; and
• respond to your support requests, feedback, and bug reports.

We do not currently send marketing communications about third-party products and do not currently send notifications via SMS or text message.

We share your information:

• with the sub-processors and service providers listed below, who process information on our behalf to operate the Website;
• in response to subpoenas, court orders, or legal process, or to establish, exercise, or defend our legal rights;
• when we reasonably believe it is necessary to investigate, prevent, or take action regarding illegal activity, suspected fraud, threats to the physical safety of any person, violations of our Terms and Conditions, or to otherwise protect the rights, property, and safety of Nestmarket, our users, and the public;
• when required by law, regulation, or legal process, including reporting of unlawful content under 18 U.S.C. § 2258A and similar laws;
• with our lawyers and professional advisors as necessary to obtain advice or protect our legal interests;
• among Nestmarket and our current and future parents, affiliates, and subsidiaries under common control; and
• in connection with a merger, sale of company assets, financing, or acquisition.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

Sub-processors and service providers

We engage the following third-party service providers to operate the Website. Each receives only the categories of personal information necessary to perform its function and is contractually required to protect the information it processes on our behalf.

• Google (Google OAuth): identity provider used for sign-in. Receives your authentication request; we receive your Google account profile information in return.
• Stripe, Inc.: payment processor for wallet funding (card and ACH) and rent collection. Stripe receives full card and bank account details directly; we receive tokenized identifiers and transaction metadata.
• Cloudflare (Cloudflare R2): object storage for image uploads (profile and cover images, Unit edits, gallery posts, chat attachments) and for serving images to viewers.
• Microsoft Azure (Azure Communication Email): delivery of transactional and administrative emails from Nestmarket to your account email address.
• Microsoft Azure (Azure AI Vision): automated screening of uploaded images for unsafe content (NSFW and child-safety signals). Image bytes are sent for scoring; scores are stored against the upload record.

This list reflects sub-processors used as of the “Last Updated” date above and may change over time. Material changes will be reflected by updating this section.

Pilot Rental Application Data

If you apply to a pilot rental program, we collect additional information specific to your application:

• Contact and identity: phone number;
• Employment: profession and employment length;
• Current housing: current monthly housing cost and current zip code;
• Move-in details: move-in timeline, occupant count, smoker status, pet status and pet details;
• How you heard about us: referral source and (if applicable) referral platform and handle;
• Free-form notes: any additional information you choose to add;
• Marketing participation opt-in: whether you have agreed to participate in optional marketing or storytelling for the pilot program;
• Full-application data (for applicants invited past the pre-screening stage): employment verification, references, and background-check results returned by third-party screening vendors.

How we use this information

We use your application data solely to evaluate your application against the pilot's published screening criteria, to communicate with you about your application status, and to comply with applicable rental and fair-housing laws. Nestmarket does not select applicants on the basis of any classification protected under the U.S. federal Fair Housing Act, the Florida Fair Housing Act, or any other applicable anti-discrimination law.

Automated pre-screening

Rental applications may be reviewed by an automated pre-screening system that generates a candidate score, confidence value, and a human-readable summary against the pilot's stated criteria. This system runs entirely within Nestmarket's own infrastructure and your application data is not sent to any third party for the purpose of this automated review.

The system proposes; a Nestmarket administrator disposes. No application is approved or rejected solely on the basis of automated screening; the final selection decision is always made by a human reviewer. If you are in a jurisdiction that grants rights regarding automated decision-making (such as under the EU GDPR), you may contact us to request human review of any preliminary automated assessment.

Sharing with screening vendors

For applicants invited past the pre-screening stage, employment verification and background-check results are obtained from third-party screening vendors retained by Nestmarket. Application data necessary for those checks is shared with those vendors solely for that purpose. Nestmarket pays these vendors directly and does not pass their fees on to applicants.

Retention

If you are not selected, your application data is retained only for as long as necessary to demonstrate compliance with non-discrimination obligations and to respond to potential inquiries about the selection process, then deleted or anonymized. Selected renters' application data is retained for the duration of tenancy plus the applicable record-keeping period.

Messaging Data

When you use the Website's messaging features (direct messages, chat rooms, reactions, mentions, and chat image attachments), we collect and store:

• message content (text and image attachments);
• message metadata: sender, recipient(s) or room, timestamp, mentions, reactions, read state, and pinned status;
• moderation metadata: whether a message has been flagged, soft-deleted, quarantined, or hard-deleted; the moderator's identifier; and (where applicable) NSFW/child-safety review scores from automated screening;
• blocking and muting relationships you create.

You should not expect that messages on the Website are private from Nestmarket. Messages may be reviewed by Nestmarket personnel or automated tools for safety, abuse prevention, content-moderation, and policy enforcement.

Retention of messages

Nestmarket operates a three-tier retention model for chat content:

• Soft-deleted messages (hidden by the sender or by a moderator) are retained for a limited window — currently up to 90 days — before being purged from the database.
• Quarantined messages (removed by an administrator for policy violations) are retained indefinitely for compliance, audit, and investigative purposes.
• Hard-deleted messages are permanently removed by an administrator. Hard deletion of content depicting the sexual exploitation of minors requires reporting to the National Center for Missing & Exploited Children (NCMEC) under 18 U.S.C. § 2258A; the corresponding NCMEC report ticket and minimal moderation metadata are preserved.

Account closure and messages

When you close your account, your sent messages are anonymized so that they are no longer associated with your identifying account fields, but the messages themselves are retained for the benefit of recipients and for record-keeping. Quarantined messages remain retained.

International Data Transfers

If you are located in the EU/EEA, your data may be transferred to and processed in countries outside the EU. We ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions are in place.

Data Protection and Security

We maintain physical, electronic, and procedural safeguards to protect the confidentiality and security of your personal data and other information transmitted to us. However, no data transmission over the internet or other network can be guaranteed to be 100% secure.

You have rights regarding your collected information. Please note that we may take steps to verify your identity to enable us to respond to your request. Your rights include, but are not limited to:

How erasure is implemented — anonymization, not hard deletion

When you close your account or exercise an erasure right, your personal identifying fields are removed or replaced with placeholder values: your email is replaced with a non-routable placeholder; your name, profile image, phone number, and address fields are cleared; your bank account details are deleted; and your sessions are terminated.

The following categories of data are retained in anonymized form because they are necessary for financial integrity, audit, anti-fraud, anti-money-laundering, dispute-resolution, and legal-hold purposes:

• transaction history (wallet funding, withdrawals, Unit purchases, marketplace trades, rent payments);
• Unit ownership and trade history;
• edit history for Units you have edited;
• audit logs of administrative actions affecting your account;
• messages you have sent that recipients still hold, and messages that have been quarantined for moderation reasons;
• moderator and reviewer assignments tied to records you produced.

Where applicable law requires fully erasing one of these records on your request, we will do so to the extent legally required, and we will tell you what we are unable to erase and why.

We use cookies and similar technologies for the limited purposes described below. You can record your cookie preference via the Cookie Settings prompt shown on the Website, and you can also reset or adjust your browser to refuse or remove cookies (note that rejecting cookies may affect the availability of some features).

Third Parties

Nestmarket does not control the privacy policies of third parties, including those referenced in or linked to this Website, and you are subject to the privacy policies of those third parties where applicable. We encourage you to ask questions before you disclose your personal information to others. For more information about each such third party, please refer to the third party's privacy policy.

Changes to this Privacy Policy

We may amend this Privacy Policy at any time by posting the amended terms on or about this Website. We shall notify you of such changes by revising the date at the top of the Privacy Policy, and/or in some cases, we may either provide you with additional notice to the primary email address specified to Nestmarket or by placing a notice on our Website.

Children's Privacy

The Website is intended for individuals 18 years of age or older. We do not knowingly collect personal data from individuals under 18.

If you are a parent or guardian and believe that a person under 18 has provided personal information to us, please contact us at [email protected] and we will take prompt steps to investigate, remove the account, and delete or anonymize the associated personal information in accordance with applicable law.

If you have questions or concerns about this Privacy Policy or your personal data, please contact: