Privacy policy

Before you publish this page: it describes what the software collects, which is accurate. It does not know your legal entity, your jurisdiction, or the arrangement you have with each society. Fill in company.js, read it through, and have it checked by someone qualified if you are operating this commercially. Google Play requires a working privacy policy URL for each app.

Who holds your data

Nestra is operated by [your company name] and runs on a server under our control. Each housing society's records are stored separately and are visible only to that society's members and committee.

Your society's committee decides who is admitted, what is published to members, and what is kept. Where you disagree with a decision your committee has made about your records, raise it with them first — they control the content, we operate the system.

What we collect, and why

What	Why
Your phone number	It is how you sign in. There are no passwords; we send a one-time code by SMS.
Your name, and email if you give one	So neighbours, guards and the committee know who you are. Email is optional.
Your society, building and flat, and whether you are an owner, tenant or family member	To show you your flat's bills and visitors, and to decide what you may see and vote on.
Visitors you pre-approve — their name, phone, vehicle and any note	So the guard can admit them, and so the society has a record of who entered.
Entry and exit records for your flat	The gate register. It is what a paper register was, and the committee can read it.
Bills, payments and receipts	Society accounts. Card and bank details are handled by the payment gateway and never reach our server.
Meter readings, amenity bookings, complaints, listings, forum and chat messages, poll votes	The features themselves. A poll marked anonymous does not record who voted which way.
Photos you choose to attach — of a complaint, a finished repair, a parcel, a service job	So whoever deals with it can see the problem. Served only through links that expire within the hour.
An identity document, if you submit one for verification — its type, the last four characters of its number, and the scan	Societies verify tenants, domestic staff and service providers. Only the committee member reviewing it can open the scan, and only the last four characters of the number are ever stored.
Your choices about optional features (for example, the AI assistant), with the date of each	So we can show what you agreed to and when, including anything you later withdrew.
A push notification token for your device	To send you alerts. Removed when you sign out.
If you run a service company (the Partner app): its name, contact details, address, service areas and trades, your technicians' names and phone numbers, the jobs you take, your quotes and ratings, and what you are paid	So societies can find you, send you jobs and pay you. Payouts are recorded by amount and reference; we never hold your bank details.
The IP address you request a login code from	To stop someone guessing their way into accounts. Kept briefly and used for nothing else.

What we do not collect

Your location. None of the apps ask for location permission or track where you are.
Your contacts. The apps never ask for them.
Your camera roll. The apps open the camera or your photos only when you choose to attach a picture, and send only the picture you pick.
Your voice. When you hold the mic button, your phone's own speech service turns what you say into text. Only that text reaches us; no recording is sent to or kept by us.
Your card or bank details. Payments go directly to the gateway; we store only that a payment succeeded, for how much, and its reference.
Advertising identifiers. There is no advertising and no third-party analytics or tracking in the apps.

Who else sees it

We do not sell your data and we do not share it for advertising. It is shared only where the feature requires it:

Your society. The committee, and the offices you would expect — the treasurer sees billing, guards see visitor entries for the flat concerned.
Other members of your society, for the things that are meant to be shared: the member directory, notices, forum posts and marketplace listings you publish.
An SMS provider, which receives your phone number and the login code in order to deliver it.
A payment gateway, when you pay online. It handles the payment; we receive confirmation.
Google Firebase Cloud Messaging, which delivers push notifications to your device.
Anthropic, which provides the Claude AI model — only if your society has switched the AI features on, and only once you have turned the assistant on yourself. Then only what that feature needs is sent: the question you type or dictate, with the society notices and documents you can already see that relate to it; for a guard, the photo of a number plate or parcel label, when the phone could not read it itself; for a technician, the job's "before" photos and notes when drafting a quote. You can turn it off at any time in the app. The committee's summary tool sends figures (totals and counts), never residents' names, phone numbers or flats. We keep a count of how often the AI was used, not what was asked.
Where the law requires it, or to investigate a genuine safety or security incident.

How long it is kept

Login codes and the IP address attached to them are deleted automatically shortly after they expire.
Society records — bills, entries, complaints, documents — are kept while the society uses the service, because they are the society's books.
When you leave a society, your membership ends and your access with it. Records of things that already happened (a bill you paid, a visitor you approved) stay in the society's history.

Your rights

You can:

See and correct your name and email in the app at any time
Sign out, which ends the session on every device and removes your push token
Download a copy of the personal data held about you, from the app (Profile → Privacy & data)
Turn optional features on or off, such as the AI assistant, from the same screen
Delete your account from the same screen. Your name, contact details, household entries, listings, devices and any identity documents are erased, and your phone number is freed. Records the society must keep — bills and payments, the visitor register, complaints and the log of actions taken — stay in its books, attached to an account that no longer says who you were. Without the app, or for a guard, staff or partner account, see Delete your account.

Write to info@nestra.com and we will respond.

Children

The apps are for adult residents and society staff. We do not knowingly create accounts for children. A family member added by an owner is expected to be an adult occupant.

Security

Sign-in is by one-time code, rate-limited per number and per network. Sessions can be ended from any device. Each society's data is separated on the server, and the separation is enforced there rather than in the app. Traffic is encrypted in transit.

No system is perfect. If you believe you have found a security problem, please tell us at info@nestra.com rather than posting it publicly, and we will look at it promptly.

Changes

If this policy changes materially we will say so in the app. The date at the top always reflects the current version.

Contact

[your company name]
info@nestra.com