Privacy Policy

NextNest is the controller responsible for the personal data described in this policy. Privacy questions and requests can be sent to support@nexthuis.com.

This policy applies to the NextNest website, account, dashboard, property-search profiles, listing alerts, subscriptions and support interactions.

• Account and identity data: email address, authentication identifier, verification status and account timestamps.
• Search data: saved locations, price ranges, property type, size, bedrooms, profile status and alert start dates.
• Activity data: favourites, listings associated with or previously sent to your account, and delivery/duplicate-prevention records.
• Billing data: Stripe customer and subscription identifiers, plan, status, renewal and cancellation dates, payment-state summaries and consent records. Complete payment-card or bank-account details stay with Stripe.
• Security and technical data: session records, hashed session and CSRF values, timestamps, and—where enabled—a hash of the browser user-agent. Hosting and security logs may include IP address, request metadata and error details.
• Location-tool data: an address or map selection you submit, coordinates, radius or travel-time settings, and related map requests.
• Support data: messages and any information you choose to include when contacting us.
• Search-buddy data: the invited person’s email address, invitation and acceptance status, and delivery records needed to send shared alerts and prevent duplicate messages.

We do not intentionally request special-category personal data such as health, religion, ethnicity or political opinions. Please do not place such information in search names or support messages.

Most data comes directly from you when you register, configure a search, save a favourite, subscribe or contact support. We also receive authentication and verification details from our identity provider and subscription and payment-status information from our payment provider.

Property information comes from publicly available estate-agent and property websites. We associate listing identifiers with an account when needed to provide favourites, matches, alert history and duplicate prevention.

If a subscriber invites you as a search buddy, we receive your email address from that subscriber. We use it to send the invitation and, only after you accept, shared listing alerts. The invitation does not give you access to the subscriber’s account, searches, favourites or billing. You can stop shared alerts through the link in each message.

• Contract: to create and secure your account, store search profiles, find matching listings, send requested alerts, manage favourites, provide support, process subscriptions and give access to paid features.
• Legal obligation: to keep required financial, tax and transaction records, handle lawful requests and comply with consumer law.
• Legitimate interests: to secure and troubleshoot the Service, prevent fraud and duplicate alerts, measure reliability, maintain records of consent, and improve matching and product performance. We balance these interests against your rights.
• Consent: where the law requires consent for a non-essential technology or optional communication. You may withdraw consent without affecting earlier lawful processing.

Search matching is automated, but it only decides which property information to show or send. It does not make a decision with legal or similarly significant effects about you.

We share personal data only where necessary to operate the Service, meet legal obligations or protect our rights. The principal recipient categories are:

• identity, authentication and email-delivery providers;
• payment and subscription-management providers, including Stripe;
• cloud hosting, database, security and technical-support providers;
• mapping, address-lookup and geocoding providers; and
• professional advisers, authorities or a successor organization where required by law or reasonably necessary for legal claims, security or a business transfer.

We do not sell personal data. We do not provide your saved-search profile to estate agents so they can market to you. When you follow a listing link or contact an advertiser, that third party processes your interaction under its own privacy policy.

Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision, approved contractual safeguards such as the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. You can ask us for more information about the safeguards relevant to your data.

• Account, profile, favourite and alert-service data is kept while your account is active and afterwards only as needed to close the account, resolve disputes, protect the Service or meet legal obligations.
• Operational session credentials are short-lived; current application sessions are configured to expire after approximately one hour. Security records may be retained longer where needed to investigate abuse.
• Listing-association and delivery records are retained for as long as they are needed to prevent duplicate alerts and maintain the requested service, then deleted or anonymized when no longer necessary.
• Billing and transaction records required for Dutch tax administration are generally retained for seven years. Stripe may retain its own records under its legal obligations.
• Consent and policy-version records are kept as long as reasonably necessary to demonstrate what was accepted.
• Backups and logs are removed on their normal rotation unless preservation is required for security, a dispute or law.

Deleting your account does not require us to erase information that the law requires us to retain, but we will restrict retained information to that purpose.

NextNest uses essential authentication and security cookies to keep you signed in and protect requests. The browser also stores a CSRF security value and may temporarily hold the legal-policy versions accepted during registration so the acceptance survives the email-verification step.

These technologies are required to provide the account and are not used for behavioural advertising. NextNest does not currently operate advertising or marketing cookies. Map and payment pages supplied by third parties may use their own necessary technologies under their policies.

We use proportionate technical and organizational measures such as access controls, encrypted transport, short-lived sessions, hashed security tokens, restricted production access and provider security controls. No online service can guarantee absolute security. Please use a strong unique password and contact us if you suspect misuse.

Subject to the GDPR and applicable exceptions, you may ask us to access, correct, delete or restrict your personal data, object to processing based on legitimate interests, and receive portable data you provided where the legal requirements apply. You may also withdraw consent at any time.

Send a request to support@nexthuis.com. We may ask for information needed to verify that the request concerns your account. We normally respond within one month, or explain if the law permits more time. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live or work.

We may update this policy when the Service, providers or law changes. The effective date identifies the current version. We will communicate material changes clearly and request renewed acknowledgement where required. Questions and requests can be sent to support@nexthuis.com.

See the Terms and Conditions for the rules governing use of the Service.