Privacy notice

1. Who is responsible for your data

The data controller is the operator of Nesso in Denmark, identified at the end of this page. Write to the address given there about anything in this notice, including the requests described in section 12.

No Data Protection Officer has been appointed. GDPR art. 37(1) asks for one where the core activity is large-scale regular and systematic monitoring of people, or large-scale processing of special categories of data. Nesso does neither (see section 6).

2. What this notice covers

The Nesso web application and the apps built from it, as offered in Denmark. Nesso is a beta service for people considering renting or buying a home for themselves.

Nesso holds no property listings and does not sell or pass what you record to any estate agent, agency or portal. The parts of Nesso that exist only for Italian cities are not available to you in Denmark and are not covered here.

3. What we hold

Your account

Your e-mail address, a password hash if you chose a password (scrypt: the password itself is never stored and cannot be recovered), when the account was created, when you last signed in, and whether the address has been confirmed.

If you sign in with Google or Apple

The permanent identifier Google or Apple gives your account there, which of the two it is, and when it was first and last used. Your password there never reaches us. The e-mail address it shares becomes the address on your Nesso account, confirmed. We do not ask for or keep your name, your photo or your contacts.

Your signed-in browsers

One row per browser you sign in from: a truncated user-agent string, when it was created and last seen, and whether it has been revoked. This is what lets you end a session on a phone you no longer have.

What you record about a property

The address you enter, anything you paste or type from an advertisement, the verdicts you tap against each check, notes and readings from a property check, the priorities you set, and the decision you record at the end.

An address lookup

When you look up an address, the text goes to the search service and the point’s coordinates go to the public registers in section 9. We do not store the address, the answer or the coordinates: the result is shown to you and is gone when you leave the screen.

A second walk of the same flat

If you invite somebody to walk the same items of a property check you saved, or save a walk from somebody else’s invitation: the name each of you typed for yourself, which two saved walks belong together, when the invitation was made and runs out, the link itself only as a SHA-256 digest, and when the second walk was saved. No score and no count of differences is stored.

Your plan and payments

Which plan the account is on and, once you pay for one, the identifiers Stripe gives your customer record and subscription. Card or bank details are entered on Stripe’s own page and are not held by Nesso.

Photographs you choose to send

A photograph is only with us if you press the separate control that sends it. See section 5.

A log of which steps are reached

Which steps of the product are reached, and when, without what you found there and without your address or name.

4. No tracking, no advertising

Nesso uses no analytics provider, no advertising network and no tracking pixel. We do not sell data and do not share it with anybody for their own purposes. The cookie notice explains why you are not asked to accept anything.

5. The microphone, the camera and the motion sensors

A property check asks your phone for the microphone, the camera and the motion sensors. Your browser asks your permission first, and you can refuse each one; the walk continues without the step that needed it.

The camera is different, and the difference is a second tap. Taking a photograph holds a still frame on your screen and nothing more. A separate control sends it to us, and until you press it the picture has not left the device. Sending is never automatic and never remembered for next time.

A photograph you send was created by the camera at the moment you took it, so it carries no location, no device model and no timestamp, and there is no way to attach one from your gallery. It is stored under a name that identifies nobody. You can remove it from the screen you sent it from, and it is deleted on its own after the period in section 11. An automated model reads it; it can tell you something is visible and can never tell you that nothing is wrong.

Nesso does not read your device location. An address is one you type.

6. Why we hold it, and on what legal basis

Where we rely on a legitimate interest, we have weighed it against your interests and rights. The product log records that a step was reached and never what you found there. You can object at any time under art. 21 (see section 12). An e-mail address is necessary to have an account, because it is what lets you sign in again.

7. No special categories

Nesso does not ask for or use health data, ethnic origin, religion or other special categories under art. 9. A property check is about a building, not about you. If you type something like that into a free-text box yourself, it is kept as text and not used.

8. Automated decisions and the reading of photographs

No decision about you is made solely by automated processing that has legal effect on you or similarly significantly affects you (art. 22). A score Nesso shows is worked out from what you recorded and shows its working.

A photograph you send is read by an automated model, which may point to something visible (a discolouration, for example) and ask a question you can ask. It can never say that nothing is wrong, and no conclusion is stored: your own answer is the record.

9. Who else touches it

A small number of suppliers process data on our instructions under a contract required by GDPR art. 28. They may not use it for anything of their own, except where an entry says otherwise.

Hosting and delivery

Our hosting provider runs the application and its request logs. Data is stored in the European Union.

Database

A managed PostgreSQL service holds the records in section 3, in the European Union.

E-mail delivery

Resend delivers the confirmation and password-reset messages. It receives your e-mail address and the text of the message, which contains a one-time link and nothing else about your account.

Payments

Stripe takes payment. It receives your e-mail address and an account identifier from us and the payment details you enter on its own page. For some purposes of its own, such as preventing fraud and meeting legal obligations, Stripe acts as a controller in its own right, under its own notice.

OpenStreetMap (Nominatim)

When you look up an address, our server sends the address text you typed to Nominatim, run by the OpenStreetMap Foundation. The request comes from our server, so it carries our IP address and not yours, and it contains the address only.

Public registers

For the address you look up, our server asks Plandata.dk (the Danish Agency for Planning and Rural Development), Miljøportalen (DKJord) and MiljøGIS (the Ministry of Environment) what they hold at that point. The request contains the point’s coordinates and nothing about you.

Photograph storage

Cloudflare holds the photographs you choose to send, in a bucket pinned to the European Union jurisdiction, under file names that identify nobody.

The model that reads a photograph

Google receives a photograph you send, and its model returns the list described in section 8. It is sent the image and our instruction and nothing else about you or the property. Under Google’s terms for this service it does not use the photograph to improve its products. It keeps a record of the request for up to 55 days, only to detect and prevent misuse and for disclosures the law requires.

Signing in with Google or Apple

You go to their page yourself. What comes back is the permanent identifier and the confirmed e-mail address, stored with us in the European Union.

10. Transfers outside the EEA

The records themselves are held in the European Union, photographs included. Two suppliers are established in the United States. Resend means that sending a confirmation or reset message transfers your e-mail address outside the EEA. Google means that a photograph you choose to send may be processed outside the EEA. It is not stored there by us. The transfer is made under the European Commission Standard Contractual Clauses (Decision (EU) 2021/914, GDPR art. 46(2)(c)), together with the supplier’s certification under the EU–US Data Privacy Framework where it applies. You can ask for a copy of the clauses at the address at the end of this page.

11. How long we keep it

The session cookie

180 days from when it is set, renewed while you keep using Nesso.

Your account and your records

For as long as the account exists. You can delete it at any time from the account screen.

A signed-in browser

Until you sign it out, use log out everywhere or reset your password, which ends every session. The record of it is deleted thirty days after it ends.

One-time links

One hour for a password reset, one day for an address confirmation, both only as a digest. A link stops working once it is used, and its digest is deleted a week after it was used or ran out.

Sign-in attempt records

Up to a day. Each is kept as a keyed digest, never as the address or network address it counts, and deleted once the window it counts over has passed.

An invitation to a second walk

Its link can be answered by one person within seven days and is held only as a digest. The invitation itself stays on your saved list until you cancel it or delete the walk or the account. Cancelling never deletes a walk.

A photograph you sent

Thirty days, unless the screen says otherwise when you send it. The period is fixed then, so a later change can never extend a photograph you were told would be gone. You can remove one yourself before. Photographs go on their own when the thirty days are up.

The log of steps

Without name or address, for up to 24 months, then deleted.

Payment records at Stripe

For as long as Stripe and accounting rules require, which Stripe controls.

12. Your rights

Under GDPR arts. 15 to 22 you may ask us for any of the following, free of charge. We answer within one month, and tell you if we need longer and why.

• A copy of what we hold about you, and confirmation of whether we hold anything (art. 15).
• Correction of anything inaccurate, and completion of anything incomplete (art. 16).
• Erasure of what we hold, including the records described above (art. 17).
• Restriction of processing while a dispute about accuracy is resolved (art. 18).
• A machine-readable copy of what you gave us, or its transfer to somebody else (art. 20). Download my data, on your account’s privacy screen, gives you that copy at once.
• Objection to any processing we base on a legitimate interest (art. 21).
• Withdrawal of any consent you have given, at any time, without affecting what was done before (art. 7(3)).

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, www.datatilsynet.dk. You may complain to the authority in the EU country where you live or work instead, and you may go to court in either case.

13. Security

All traffic goes over an encrypted connection. Passwords are stored only as a hash. Reset, confirmation and invitation links are stored only as a digest, so a stolen database holds no usable link. Cookies are marked so no script on the page can read them and another website cannot use them to act as you. If a breach affects your data in a way that may put you at risk, we tell you and Datatilsynet under arts. 33 and 34.

14. Children

Nesso is for adults considering a home. The digital age of consent in Denmark is 13 (the Danish Data Protection Act, section 6), but a paid plan requires you to be of full age. If we learn that an account belongs to a child under 13, we delete it.

15. Changes

The date at the top is when this version was written. When we change what we do with data, we change this notice before the change happens, and we tell you about a change that affects you.