Privacy notice
Last updated 9 October 2026
This notice explains what personal data NestInsights holds about you, why, who helps us handle it, how long we keep it and the rights you have. We've tried to keep it short and plain. If anything is unclear, email support@nestinsights.com.
Who we are
NestInsights is run by Nooroots Nutrition Ltd, a company registered in England and Wales (company number 14009059), whose registered office is Suite 5, 5th Floor, City Reach, 5 Greenwich View Place, London E14 9NN. We decide how your data is used, which makes us the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).
For anything about your data, email support@nestinsights.com or write to us at the registered office above.
What we hold and why
You can use the deal calculator without an account. We only hold the figures you type in while the page is open, and don't keep them unless you save the deal.
| What | Why | Lawful basis |
|---|---|---|
| Your email address and password (stored only as a scrambled "hash" we can't read) | To give you an account, let you log in and send you account emails such as confirmations and password resets | Contract: we need it to provide the service you signed up for |
| The deals and scenarios you save: addresses or postcodes, prices, rents, mortgage terms, costs, and the other income you enter for the tax figures | To save, show, compare and share your deals | Contract |
| With Pro, your portfolio records: the properties you own, money in and out, repairs, important dates, and your address book of agents, tenants and contractors (see below) | To give you the portfolio tools: statements, repairs log, reminders and contacts | Contract |
| Your plan, and for Pro a Stripe customer reference, the price, renewal date and payment status | To provide Pro and keep the records the law requires of a business | Contract, and legal obligation for accounting records |
| Whether you want the newsletter, and when you last changed that choice | To send the newsletter only to people who asked for it, and to show that they did | Consent, which you can withdraw at any time |
| The last day you used the site while logged in, and where you came from when you signed up (a campaign tag on the link, the name of the website that sent you, or the page here you signed up from) | To count active users and see which channels bring people in | Legitimate interests: running and growing the service. We keep the date only, not a record of each visit |
| Failed log-in attempts: the email address tried, the IP address and the browser | To stop people guessing passwords. Deleted 30 minutes after the last attempt | Legitimate interests: keeping accounts safe |
| Messages you send us, and our replies | To answer you | Legitimate interests, or contract when it's about your account |
| Technical data in our hosting provider's logs: IP address, browser, pages requested and the time | To keep the site running and secure, and to investigate faults | Legitimate interests |
| Error reports when something breaks, without your email or IP address | To fix bugs | Legitimate interests |
| Visit statistics from Google Analytics, only if you accept analytics cookies | To understand how people find and use the site | Consent, which you can withdraw in cookie settings |
We don't ask for your name, phone number, home address or date of birth, and we don't buy data about you from anyone else. Card details go straight to Stripe and never reach our servers.
People in your address book
With Pro you can keep details of the people involved in your lets, such as your tenants, letting agent and contractors. For that information you decide what to keep and why, so you are its controller and we look after it for you as your "processor". We only use it to show it to you, remind you of dates and include it in your export, and we never contact the people in it.
- Only what a let needs. The address book has room for a name, company, phone, email, notes and the dates someone was linked to a property, such as a tenancy. There's nowhere to store dates of birth, ID documents, bank details or references, and the notes box turns away things that look like them.
- Former tenants. Once a tenancy has ended, we point it out so you can delete their details when you no longer need them, for example once the deposit's been returned and any claims are settled. Deleting someone removes them at once.
- If you're in someone's address book and want to see, correct or remove your details, please ask that landlord first. If you can't reach them, email us and we'll help.
When you use the address book you agree to these terms as the controller: we process the data only on your instructions (using the service is your instruction), keep it confidential and secure, use the companies listed below to help (and tell you before adding others), tell you without delay about any breach affecting it, help you answer requests from the people in it, delete it when you delete it or your account, and give you the information you need to show you're complying.
When our staff look at your account
Only the owner of NestInsights can see account details. Your saved deals and portfolio stay private unless you share a link to a deal, or ask us for help and we need to look. When we do, we record who looked, when and why, and access ends after 30 minutes. If we open your portfolio, your account page shows when and why, and we see your tenants only as initials, without their phone or email.
Who helps us run the service
We don't sell your data or share it for other companies' marketing. These companies process it on our behalf, under contracts that only let them use it to provide their service to us:
| Company | What they do | Where |
|---|---|---|
| Render | Hosts the website and database | Frankfurt, Germany (EU) |
| Resend | Sends account emails and the newsletter | Ireland (EU), with a US parent company |
| Stripe | Takes Pro payments and runs the billing page where you manage your plan | EU and US |
| Sentry | Collects error reports so we can fix bugs | US |
| Analytics, only with your consent | EU and US | |
| Microsoft | Hosts our support mailbox | UK, EU and US |
Stripe also decides some things for itself, such as fraud checks and keeping payment records the law requires of it, so for that part it is a separate controller under Stripe's own privacy policy.
We may also share data if the law requires it, to protect people from fraud or harm, or with a buyer if the business is sold, who would have to keep to this notice.
Data sent outside the UK
Our database is in the EU, which the UK treats as giving adequate protection. Where a company above handles data in the US, the transfer is covered by the UK–US "data bridge" for companies certified under it, or otherwise by the UK's International Data Transfer Addendum to the EU standard contractual clauses. Email us for a copy of the safeguards that apply.
How long we keep it
- Your account, deals and portfolio: until you delete them or your account. You can do that at any time on your account page, and it happens straight away. Copies in our database backups are overwritten within 7 days.
- Accounts nobody uses: if an account hasn't been used for 3 years, we'll email you and delete it if you don't want to keep it.
- Payment records: Stripe keeps these for as long as the law requires. If you delete your account, we keep only an anonymous count of when Pro started and ended, with no link to you.
- Failed log-in attempts: 30 minutes after the last one.
- Emails with our support team, and feedback sent with the Feedback button: up to 2 years after the conversation ends.
- Hosting logs and error reports: no more than 90 days.
- Analytics: Google Analytics keeps visit data for 14 months.
Your rights
You have the right to:
- See your data. "Export my data" on your account page downloads everything we hold about you, or email us for a copy.
- Correct it. You can change your email address and deals yourself.
- Delete it. "Delete account" removes your account, deals and portfolio at once.
- Take it elsewhere. The export is a standard JSON file.
- Object to anything we do on the basis of legitimate interests, or ask us to restrict what we do while a concern is looked at.
- Withdraw consent at any time: untick the newsletter on your account page or use the link in any newsletter, and change analytics in cookie settings.
Email support@nestinsights.com to use any of these. We'll reply within one month and won't charge. We may need to confirm it's really you first.
If you're unhappy with how we've handled your data, please tell us so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Other things you should know
- No automated decisions about you. The calculator works out figures from what you type. It doesn't make decisions with legal or similar effects on you.
- Security. The site only works over an encrypted connection, passwords are stored as hashes, logins are protected against guessing, and staff accounts need a second step to log in. No system is perfectly secure, so please use a password you don't use anywhere else.
- Over-18s only. The service is for adults and isn't aimed at children.
- Cookies. See our cookies page.
- Changes. If we change this notice in a way that matters, we'll email account holders before it takes effect. The date at the top shows when it last changed.