What Nesso holds about you

1. Who is responsible for your data

The data controller is the operator of Nesso, identified at the end of this page. Write to the address given there about anything in this notice, including any of the requests described in section 11.

No Data Protection Officer has been appointed. GDPR art. 37(1) asks for one where the core activity is large-scale regular and systematic monitoring of people, or large-scale processing of the special categories in art. 9. Nesso does neither (see section 6), so an appointment is not required. If that changes, this section changes with it.

2. What this notice covers

The Nesso web application and the native shells built from it. Nesso is a beta service offered to people considering renting or buying a home for themselves. It covers a limited number of Italian cities, and the map of Italy in the app shows which.

Nesso holds no property listings, and does not sell or pass what you record to any estate agent, agency or portal. There is one limited exception, on the Nesso Concierge plan only: to arrange a viewing you asked for, we give the agent or landlord of that property the details needed to book it (see section 9).

3. What we hold

If you apply as an estate agent

Your name, your agency, your e-mail address and phone number, the language you wrote in, and any properties or links you chose to send (address, city, asking price, bedrooms, a link to the advert). None of it is linked to a Nesso account, shown to other users or published. A CSV you pick is read on your device; only the rows you send reach us.

If you write to us through Work with us

Your name, your e-mail address, the LinkedIn profile if you chose to give it, your message, and any file you attach (a CV or a portfolio). It arrives as one e-mail in Nesso’s inbox. It is not saved in our database, not linked to a Nesso account and not shown to anybody outside the team.

Your account

Your e-mail address, a password hash if you chose a password (scrypt: the password itself is never stored and cannot be recovered from the hash), when the account was created, when you last signed in, and whether the address has been confirmed.

If you sign in with Google or Apple

The permanent identifier Google or Apple gives your account there, which of the two it is, and when it was first and last used to sign in. Your password there never reaches us. The e-mail address it shares becomes the address on your Nesso account, confirmed. We do not ask for or keep your name, your photo or your contacts, and we keep no token that would let us act at Google or Apple for you.

Your signed-in browsers

One row per browser you sign in from: a truncated user-agent string, when it was created, when it was last seen, and whether it has been revoked. This is what lets you end a session on a phone you no longer have.

What you record about a property

The address you enter, anything you paste or type from an advertisement, the verdicts you tap against each check, the notes and readings from a property check, the priorities you set, and the decision you record at the end.

A second walk of the same flat

If you invite somebody to walk the same items of a property check you saved, or save a walk from somebody else’s invitation: the name each of you typed for yourself, which two saved walks belong together, when the invitation was made and when its link runs out, the link itself only as a SHA-256 digest, and when the second walk was saved. No score and no count of differences is stored: both are worked out from the two walks each time the page is shown.

If you use Nesso Concierge

The brief you give us (your budget, the areas you prefer, how many bedrooms, what matters to you and what you do not want), the properties we find, check and compare for you and what we record about them, the viewings you ask us to arrange, and what we exchange with you about the search. To book a viewing we also hold your name and a way to contact you.

Your plan and payments

Which plan the account is on and, once you pay for one, the identifiers Stripe gives your customer record and your subscription. Your card or bank details, and anything else Stripe’s checkout asks for, are entered on Stripe’s own page and are not held by Nesso.

Districts you follow

If you follow a district on Investment: which district in which city, the OMI edition you last saw it at, the language to write to you in, and whether you switched on the email about them. No figure is stored: whether a district moved is worked out from the published data each time. If you call the next OMI edition on them (up, flat or down for its rent and sale price), the calls you make on them, the edition each call was made at and when you last changed it; no result is stored either, since whether a call matched is worked out the same way. For each city and edition we also keep a record of the email run: how many people it wrote to and how many messages were delivered, and nothing about who.

Your Prepare answers

If you use Prepare: which of its cards you answered and how (good, so-so, bad or can’t tell), and when you last changed each. They describe the flat you are getting ready to sell or let, as you see it. The result (how many cards are ready, which to do first) is worked out from them each time and is not stored.

Readings your phone takes

Numbers only: a noise level in decibels, a tilt angle in degrees, a compass bearing, a distance. See section 5 for what happens to the microphone and camera themselves.

Photographs you choose to send

A photograph is kept only if you press send on it. What is then held is the image itself, its size, four measurements of the picture as a file (how bright and how sharp it is), which check it belongs to, and the date it stops being kept. The file is named so that it identifies nobody. A photograph you do not send is never stored, because no copy of it is ever made.

Your answers to Find your place

The five answers you choose, the city you answered for, and when. One answer says whether your household expects a school run in the next few years. The result itself is not stored: the district, its scores, its archetype and the personality it gives you (for example "Spritz Loyalist") are worked out again from your answers each time you open it. If you share a result, what is kept is a digest of the link and when you shared it; the link itself is shown to you once and not kept.

Photographs from advertisements

A fingerprint of images that appear on adverts, so the app can tell you an image has been used on other adverts too. The count is all that is ever shown: which other properties, and whose, is never disclosed to anybody.

Product events

A small first-party log of which steps were reached (a property check started, a comparison opened), keyed to your session identifier. It records that a step happened, never what you found there. There is no third-party analytics service involved.

Page views

Only if you said yes to analytics in the cookie banner: each page you open, as its address with any identifier or link token removed, the day, the name of the website that sent you, and whether the screen was a phone, a tablet or a computer, keyed to your session identifier so two pages count as one visit. No IP address, no browser details, nothing you typed. Read only as totals, by the people who run Nesso.

Security records

Sign-in, sign-up and password-reset attempts, kept briefly so that repeated attempts can be slowed down. One-time links sent to you are stored only as a SHA-256 digest, so a copy of our database contains no usable link.

Server logs

Our hosting provider keeps ordinary request logs, which include IP addresses, for a short period. We do not use them to build a picture of anybody.

4. What runs today, and what does not yet

• Not live yet: advertising, an advertising network, a pixel for it, or a third-party cookie set on its behalf.
• No analytics vendor, no tag manager and no session recording. The product log and the page counts we keep are our own, in our own database, and reach nobody outside it.
• No sale of personal data. Nothing is shared with an estate agent, an agency or a landlord, except, on the Nesso Concierge plan only, the details needed to book a viewing you asked us to arrange (section 9).
• No profile is built about you across other websites, because nothing of ours runs on any.
• The web fonts are served from our own domain, so loading a page contacts no font provider.
• The map tiles are served from our own domain, so panning the map contacts no map vendor.

5. The microphone, the camera and the motion sensors

A property check asks your phone for the microphone, the camera and the motion sensors. Your browser asks your permission first, and you can refuse each one; the walk continues without the step that needed it.

The camera is different, and the difference is a second tap. Taking a photograph holds a still frame on your screen and nothing more: the shutter reaches no network. A separate control sends that frame to us, and until you press it the picture has not left the device. Sending is never automatic, never a side effect of taking the picture, and never remembered as a preference for the next one.

A photograph you send was created by the camera at the moment you took it, so it carries no location, no device model and no timestamp of its own, and there is no way to attach one from your gallery instead. It is stored under a name that identifies nobody: not you, not your session, not the address. You can remove it from the same screen you sent it from, and it is deleted on its own after the period in section 11.

A photograph you send is read by an automated model. Section 8 says what it may report and what it may never report; the short version is that it can tell you something is visible and can never tell you that nothing is wrong.

Nesso does not read your device location. An address is one you type; it is turned into coordinates on our server, so the lookup carries our address and not yours.

6. Why we hold it, and on what legal basis

Where we rely on a legitimate interest, we have weighed it against your interests and rights. The two that matter: the product log records that a step was reached and never what you found there, and the photograph count is a fact about an advertisement rather than about any person. You can object to either at any time under art. 21 (see section 11).

Providing an e-mail address is necessary to have an account, because it is what lets you sign in again and recover access. Everything else you enter is your choice, and a property check works with any part of it left blank. On the Concierge plan, a name and a way to contact you are needed before a viewing can be booked for you.

7. No special-category data, and nothing about health

Nesso is not a health product and holds none of the special categories in GDPR art. 9. It asks nothing about your health, your origin, your beliefs, your politics, your union membership, your sex life or your orientation, and it holds no biometric or genetic data.

A noise level in decibels is a measurement of a room. A tilt angle is a measurement of a floor. Neither is a measurement of a person, and neither is used as one.

Find your place asks whether your household expects a school run. That is not special-category data, and it is never used to infer anything about who lives with you. It stays with your account: it is not on a shared card, not in its image, and not in any product event, and it never decides the personality a shared card shows.

Nesso holds no criminal-offence data under art. 10. Where the app shows a crime index, it is a published statistic covering an entire province and is not about any individual.

8. Scores, bands, and automated decisions

Nesso computes a score and a band (good, conditional, avoid) for a property and for an area. The score is derived every time it is shown, is never stored, and shows where each part of it came from and what could not be checked (named and counted): the blocking checks still unresolved on a property, or, for an area, a line such as “Across 2 of 5 signals” or “Across 5 of 12 dimensions”.

The weights the score uses are the ones you set yourself on the priorities screen. Change them and the score changes, with nothing written to the database.

Separately, a photograph you choose to send is read by an automated model, which returns a short list of things that are visibly present in the frame (a patched area, a stain, a lifted edge, a line in a surface), each one beside a question to ask about that part of the room. It is given the image and its instruction, and nothing else: no address, no account, no session identifier, and nothing you have recorded elsewhere.

Nothing the model returns is stored. It is shown once, beside the frame, and the record of the check remains the verdict you tap yourself. Like the score, this is processing about a property and not about you: it produces no legal effect on you, GDPR art. 22 does not apply, and nobody is profiled by it.

9. Who else touches it

A small number of suppliers process data on our instructions, under a contract required by GDPR art. 28. They are not permitted to use it for anything of their own, except where an entry below says otherwise.

Hosting and delivery

Our hosting provider runs the application and its request logs, and serves the static files. Data is stored in the European Union.

Database

A managed PostgreSQL service holds the records described in section 3, in the European Union.

E-mail delivery

Resend delivers the confirmation and password-reset messages, and the district-update emails if you switched them on. It receives your e-mail address and the text of the message. A confirmation or reset message contains a one-time link and nothing else about your account; a district-update email names the city, the districts you follow that moved or had a call checked, their published figures and how your own calls on them came out, and carries a link that stops these emails. On the Nesso Concierge plan it also carries each brief you save, with your account’s e-mail address, to Nesso’s own inbox, so the people doing your search see it. A message sent through the Work with us form reaches Nesso’s inbox the same way, with any file you attached.

Payments

Stripe takes payment for the paid plans. It receives your e-mail address and an account identifier from us, and the payment details you enter on its own page; invoices and receipts are issued and kept by Stripe. For some purposes of its own, such as preventing fraud and meeting its legal obligations, Stripe acts as a controller in its own right, under its own privacy notice.

OpenStreetMap

The Nominatim service is used as a fallback when our own address gazetteer cannot resolve an address. The request is made by our server, so it carries our address and not yours, and it contains the property address only.

Photograph storage

Cloudflare holds the photographs you choose to send, in a bucket pinned to the European Union jurisdiction, under file names that identify nobody.

The model that reads a photograph

Google receives a photograph you send, and its model returns the list described in section 8. It is sent the image and our instruction and nothing else about you or the property. Under Google’s terms for this service it does not use the photograph to improve its products. It keeps a record of the request for up to 55 days, only to detect and prevent misuse of its service and for disclosures the law requires.

Signing in with Google or Apple

If you choose Continue with Google or Continue with Apple, you sign in on their own page, under their own terms and privacy notice, and they learn that you are signing in to Nesso. They send us the identifier and e-mail address described in section 3. They do not process anything on our instructions: each is a controller in its own right for what happens on its side, and we send them nothing about you.

One disclosure is made by you and not by us. On a property check you saved, you can create an invite link and send it on yourself: Nesso sends no invitation and is given nobody’s address. Whoever opens that link and signs in is shown the name you typed, the name you gave the flat and which items to walk, and none of your answers. Once they save their own walk, each of you is shown the other’s answers on those items, the score of each walk, and the name the other typed. Those are the walks as they currently stand, so a reading either of you changes afterwards is shown to the other as well. No photograph either of you sent is ever shown to the other.

The other is a Find your place result card you share. It is shown to anybody who has its link: that is what sharing does. The card shows the personality your answers gave you, with its picture and one line about it, and the district, its scores and what they were counted from. The personality is worked out from your answers, so it says which way they leaned; it never shows the answers themselves and never your school-run answer. We send the link to nobody: you choose who gets it. Stop sharing ends it at once, and so does deleting your account.

We will also disclose data where a law or a lawful order of an Italian or EU authority requires it. There is no other disclosure: no portal, no data broker, no advertiser, and no agent, agency or landlord beyond the booking details described above.

10. Transfers outside the European Economic Area

The records themselves are held in the European Union, photographs included. Two suppliers are established in the United States. Resend, which delivers e-mail, means that sending a confirmation or a password-reset message transfers your e-mail address outside the EEA. Google, whose model reads a photograph you choose to send, means that the photograph may be processed outside the EEA, in any country where Google keeps facilities. It is not stored there by us. Google keeps a record of the request for up to 55 days, for the purpose section 9 describes, and nothing identifying you or the property goes with it. Signing in with Google or Apple is not a transfer by us: you go to their page yourself, and what comes back is stored in the European Union with the rest of the account.

That transfer is made under the European Commission Standard Contractual Clauses adopted by Decision (EU) 2021/914 (GDPR art. 46(2)(c)), together with the supplier certification under the EU–US Data Privacy Framework where it applies. You can ask us for a copy of the clauses using the address at the end of this page.

11. How long we keep it

An estate agent’s application

Until the agent profile is set up and for as long as it exists, or 24 months from the application if no profile is made. Ask us and we delete it sooner.

A Work with us message

In Nesso’s inbox for as long as we are considering you, and no longer than 24 months from when you sent it. Ask us and we delete it sooner.

The session cookie

180 days from when it is set, and it is renewed while you keep using Nesso.

Page views

Thirteen months, then deleted, so one year can be compared with the one before.

Your account and your records

For as long as the account exists. You can delete it at any time from the account screen.

A Google or Apple sign-in

For as long as the account exists. Deleting the account deletes it too, so that Google or Apple account opens a new, empty Nesso account next time, never the deleted one.

A signed-in browser

Until you sign it out, or until you use log out everywhere, or until you reset your password, which ends every session including the one that asked. The record of it is deleted thirty days after it ends.

One-time links

One hour for a password reset, one day for an address confirmation, and in both cases only as a digest. A link stops working the moment it is used, and its digest is deleted a week after it was used or ran out.

An invitation to a second walk

Its link can be answered by one person, within seven days of when you made it, and is held only as a digest; making a new link stops the old one working at once. The invitation itself (the name you typed and that digest) stays on your saved list until you cancel it, delete the walk or delete your account, even after the link has run out. Once the other person has saved, the comparison and both names stay until either of you leaves it or deletes their walk or their account. Cancelling or leaving never deletes a walk: each is kept for as long as the rest of its own person’s records.

A photograph you sent

Thirty days, unless the screen says otherwise at the moment you send it. The period is fixed then and there, so a later change to it can never extend the life of a photograph you were told would be gone in a month. You can remove one yourself before then. Deleting your account does not delete them either, for the reason in the note below, but unlike the rest of your records, they do go on their own when the thirty days are up.

Your Find your place answers

For as long as the account exists, like your other records. A shared link works until you press Stop sharing, or share again, which makes a new link and ends the old one. Deleting your account ends every shared link at once.

A district you follow

Until you stop following it. It is kept for as long as the rest of your records, so deleting your account does not delete it (see the note below), but the district-update emails stop with the account, and you can stop them sooner from a link in every message, without signing in, or from your privacy settings.

A call you made on a district

Until you stop following that district: a call is deleted when you stop following the district, for every edition it was made at. Otherwise it is kept like the rest of your records, so deleting your account does not delete it (see the note below).

Your Prepare answers

Until you press Start over, which deletes them all, or change an answer. Otherwise they are kept like the rest of your records, so deleting your account does not delete them (see the note below).

A record of each email run

For each city and OMI edition: when the run happened, how many people it wrote to and how many messages were delivered (counts, with no address and no district). Kept while the service runs, because it is what stops one edition being emailed twice.

Sign-in attempt records

Up to a day. Each is kept as a keyed digest, never as the address or the network address it counts, and is deleted once the window it counts over has passed.

Product events

Up to 24 months, then removed.

12. Your rights

Under GDPR arts. 15 to 22 you may ask us for any of the following, free of charge. We answer within one month, and tell you if we need longer and why.

• A copy of what we hold about you, and confirmation of whether we hold anything (art. 15).
• Correction of anything inaccurate, and completion of anything incomplete (art. 16).
• Erasure of what we hold, including the records described in the notice above (art. 17).
• Restriction of processing while a dispute about accuracy is resolved (art. 18).
• A machine-readable copy of what you gave us, or its transfer to somebody else (art. 20). Download my data, on your account’s privacy screen, gives you that copy at once.
• Objection to any processing we base on a legitimate interest, including the product log (art. 21).
• Withdrawal of any consent you have given, at any time, without affecting what was done before (art. 7(3)).

You can also complain to the Italian supervisory authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garante@gpdp.it, protocollo@pec.gpdp.it, www.garanteprivacy.it. You may complain to the authority in the EU country where you live or work instead, and you may go to court in either case.

13. How it is protected

• Passwords are stored as scrypt hashes with a per-password salt, never as text.
• Both cookies are HttpOnly, so no script on the page can read them, and SameSite=Lax, so a cross-site request cannot act as you.
• Every connection uses TLS, and the cookies are marked Secure in production.
• A signed-in browser can be revoked one at a time or all at once, and a password reset revokes all of them.
• One-time links are stored only as a digest, so a stolen copy of the database contains none of them.
• An invite link for a second walk is stored only as a digest too. Because anyone who holds it and signs in can answer it, it runs out after seven days, admits one person only, and can be replaced or cancelled from your saved list at any time.
• Access to the database is limited to the application and to the people who operate it.

These are the measures GDPR art. 32 asks for, given what Nesso holds. No measure makes a breach impossible; if one happens and it is likely to be a risk to you, we will notify the Garante within 72 hours and tell you where art. 34 requires it.

14. Age

Nesso is for adults deciding where to live. It is not directed at children and we do not knowingly create accounts for anyone under 18. If you believe a child has made an account, write to us and we will remove it.

15. Changes to this notice

The date at the top is when this version was written. If we change how we process anything in a way that affects you, we will say so on this page before the change takes effect, and by e-mail if you have an account and the change is significant.