Privacy Policy

We collect only what the Service needs to do what you ask of it. The table lists each category, where it comes from, and what it is for.

We do not collect government identity numbers, bank login credentials, full card numbers, precise geolocation, biometric data, or any special category of personal data (health, ethnicity, religion, politics, sexual orientation, criminal history), and we ask you not to enter them. Citizenship and tax residency are collected because tax rules depend on them; they are not used for any other purpose.

We do not use advertising pixels, third-party analytics scripts, session recording, fingerprinting, or any script that follows you to other sites.

We do not make decisions about you by automated means that have legal or similarly significant effects. The Service computes and ranks figures for you to consider; it does not decide anything about you.

Two optional features send data to Anthropic, PBC (United States) to generate text with a Claude model over its commercial API. The provider does not use data sent through that API to train its models.

• Narration ("Explain my position") sends a small structured summary of your own figures: the month, home currency, number of properties, portfolio totals, and the alerts the Service has computed. It sends no name, email, address, account identifier or free text. The reply is shown to you and is not stored.
• The assistant ("Ask Freeholt") sends the recent turns of your conversation and a fixed description of how the Service works. It does not send your portfolio. Each question and answer is stored in your account, with the model name, and can be read by an administrator to check answer quality. Deleting your account deletes them.

If the deployment has no model key configured, these features say so and send nothing.

We share personal data only with the service providers below, each under a contract that limits them to processing it for us, and otherwise only where the law requires or you ask us to. We do not sell personal data and we do not share it with advertisers, data brokers, lenders, agents or advisers.

We may also disclose personal data where required by law, court order or a regulator with jurisdiction over us; to protect the rights, safety or property of any person; to a successor if our business is sold or reorganised (you will be told and this policy will continue to apply); and to professional advisers under confidentiality.

We may derive statistics from the figures users enter and from how the Service is used, and we may use, publish and license those statistics, including commercially, during and after your use of the Service. Examples: the distribution of loan-to-value ratios among households in a country, how assumed growth rates compare to recorded benchmarks, which features are most used, or the range of rental yields entered for a city.

We apply these safeguards to every such statistic:

• identifiers are removed before aggregation: no email, name, account identifier, address, or free text is ever part of a statistic;
• a statistic is released only where it describes a group of at least 20 households, and we do not release a statistic where the combination of attributes would single out a household;
• figures are rounded, banded or otherwise coarsened where a precise value could be matched back to a person;
• we do not attempt to re-identify anyone from aggregated data, and we contractually prohibit anyone we license it to from doing so;
• we never publish or license a figure that describes one identifiable household, property, beneficiary or client.

Data that has been anonymised in this way is no longer personal data and this policy no longer applies to it. Deleting your account stops your figures from contributing to any statistic produced after deletion; statistics already produced cannot be reversed and contain nothing about you.

Your account data is stored in Seoul, South Korea (AWS ap-northeast-2) by our database provider, and processed by application servers in the same region. Our other providers are in the United States. Whichever country you live in, your data is therefore transferred outside it.

• EU and UK residents: the European Commission has recognised South Korea as providing adequate protection (Decision (EU) 2022/254), and transfers to our US providers are made under the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) contained in each provider's data processing terms, or under the EU-US Data Privacy Framework where the provider is certified. Copies of the relevant clauses are available from the providers or from us on request.
• Singapore residents: under the PDPA transfer limitation obligation, we transfer data only to providers bound by contractual obligations to protect it to a standard comparable to the PDPA.
• Australian residents: under APP 8 we take reasonable steps to ensure overseas recipients handle your data in accordance with the APPs, by contract with each provider. Because the Service is hosted overseas, you should assume any data you enter is held outside Australia.

Wherever you live, you can:

• See and correct your data at any time: everything you entered is visible and editable in the app.
• Export it: Settings has a "Download my data" button on every plan that gives you a complete, machine-readable JSON copy of everything you entered, suitable for portability and for restoring into another account. The paid plan's Export page adds spreadsheet and report formats.
• Delete it: Settings contains a self-service account deletion. It erases every record listed in section 1 from the live database at once, cancels any subscription, signs you out, and leaves only the deletion record described in section 7. It cannot be undone.
• Withdraw consent: turn the monthly digest, Legacy Access, or the assistant off in the app at any time; unsubscribe links are in every digest email.
• Object to, or ask us to restrict, a use of your data based on legitimate interests, including the production of statistics under section 5, by emailing us.
• Complain: we would rather hear it first, but you may also complain to your data protection authority: the Personal Data Protection Commission (Singapore), the Information Commissioner's Office (UK), the Office of the Australian Information Commissioner, or the supervisory authority of the EU country where you live.

To exercise a right you cannot exercise yourself in the app, or if you are a beneficiary or other person who does not hold an account, email support@nestworth.com (mark the subject "Privacy" or "Data Protection Officer"). We will confirm receipt promptly, may ask you to verify your identity in a way proportionate to the request (usually by replying from the account email address), and will respond within 30 days, or tell you within that time if a complex request needs longer (up to a further 60 days under the GDPR). We do not charge for a request unless it is manifestly unfounded or excessive, and we never treat you differently for making one.

Where we hold data about you as a processor for a business customer (for example an adviser who entered your details), we will pass your request to that customer and help them answer it.

If you are a California resident: we do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit. The rights above are available to you regardless of whether the CCPA applies to us.

We designed the Service so that the most sensitive things are never collected at all: no bank logins, no full card numbers, no uploaded files kept. For what is collected:

• every request to the database is limited by row-level security to the signed-in account; an administrative key is used only on the server for tasks such as billing and deletion, and every such use is scoped to a verified account identifier;
• all traffic is encrypted in transit; the database and its backups are encrypted at rest by the provider;
• passwords must be at least 12 characters with mixed character classes, are checked against known breaches at sign-up, and are held only as hashes by our authentication provider; sign-in and reset attempts are rate limited;
• administrator access requires a second factor; sensitive actions on an account are recorded in an audit log that records what changed, never the amounts;
• Legacy Access links and pass phrases are stored only as one-way hashes; every link is single-use and time-limited;
• a content security policy, strict transport security and related browser protections are set on every page.

No system is perfectly secure. If we become aware of a breach that affects your personal data we will assess it without delay and, where the law requires, notify the relevant authority (within 72 hours under the GDPR; within 3 calendar days of assessment under the PDPA; as soon as practicable under the Australian Notifiable Data Breaches scheme) and notify you directly where the breach is likely to result in significant harm or high risk to you.

The Service is for adults and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will delete it.

We do not make marketing calls or send marketing text messages, and we are not on, and do not need to check, the Singapore Do Not Call Registry. Email from us is limited to the service messages in section 2, the monthly digest you opted into, and occasional product announcements to account holders, each of which has an unsubscribe link; you can stop announcements without affecting service messages.

We will update this policy when the Service changes what it collects or who it shares it with. Material changes are notified by email or in the app at least 14 days before they apply. The date at the top is the date of the current version.

[Freeholt Pte. Ltd.], [Registered office address], Singapore. Our Data Protection Officer, designated under section 11(3) of the PDPA, can be reached at support@nestworth.com (mark the subject "Privacy" or "Data Protection Officer").

If we appoint a representative in the European Union or the United Kingdom under Article 27 of the GDPR, their details will be added here.