N NestlistBack to Nestlist
Legal & privacyPrivacy noticeCookies & device storageTerms of useAccessibilityModern slaveryAdmin launch checklist

Nestlist legal centre

Clear information,
in one place.

These notices explain how Nestlist works, how personal information is handled, and what to expect when using the service.

Early-access draft These documents reflect Nestlist as it works today. The operator details and terms should be reviewed by a UK solicitor before a commercial or app-store launch.

Required information

Privacy notice

Last updated 17 August 2026

Who is responsible for your information

Nestlist is currently operated by James Macgregor, who is the data controller for the personal information described in this notice. Questions and privacy requests can be sent to jamesmac88@me.com.

Before a commercial launch, this section will be updated with the full legal entity name, registered address and any applicable company and ICO registration details.

Information we collect

  • Your name, email address and sign-in information supplied through your OpenAI account.
  • Your household membership, invitations and account permissions.
  • Property links and listing details you save, including photos, prices, locations and postcodes.
  • Ratings, notes, statuses and the identity of the household member who added or edited them.
  • Limited technical, security and diagnostic information needed to operate and protect the service.

How and why we use it

  • Provide Nestlist: to sign you in, maintain your household and keep its shared house hunt in sync. We rely on performance of our service agreement, or steps taken at your request.
  • Keep the service reliable and secure: to diagnose faults, prevent misuse and protect accounts. We rely on our legitimate interests in running a safe, dependable service.
  • Meet legal duties: where processing is necessary to comply with law.
  • Optional features: if we later introduce non-essential analytics or marketing, we will ask for consent where the law requires it.

Who can see or receive it

People in the same household can see that household’s saved homes, ratings, shared notes and contributor names. They cannot see another household’s house hunt. The Nestlist administrator can manage household names, membership and access, and can see high-level usage counts; the current admin interface does not expose the contents of other households’ listings.

We use service providers, including OpenAI and the infrastructure used to host Nestlist, to authenticate users and operate the app. They process information under their own terms and appropriate data-processing arrangements. We may also disclose information when the law requires it, to protect legal rights, or as part of a future sale or reorganisation of the service.

International transfers

Some technology providers may process information outside the UK. Where UK data-protection law applies, we will use an approved transfer mechanism or another lawful safeguard. Contact us if you would like more information about the safeguards relevant to your data.

How long we keep it

We keep account and household information while the account or household remains active, then only for as long as reasonably needed for deletion, backup restoration, security, dispute handling or legal obligations. A documented retention schedule will be adopted before commercial launch.

Your rights

Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, objection or a portable copy. Where processing relies on consent, you may withdraw it at any time. Email us to make a request. You can also complain to the Information Commissioner’s Office.

Automated decisions and children

Nestlist does not make automated decisions that have legal or similarly significant effects. The service is intended for adults aged 18 and over.

Changes to this notice

We will update this page when the service or its use of information changes materially. Important changes will be brought to users’ attention in the app where practical.

Required information

Cookies & device storage

Last updated 17 August 2026

Nestlist uses only the browser storage that is necessary to provide and secure the service at present. It does not currently use advertising cookies or optional analytics cookies.

What is used

  • Authentication and security: essential session technology associated with signing in through ChatGPT/OpenAI and keeping access secure.
  • Install preference: your device stores nestlist-install-dismissed after you dismiss the install suggestion, so it is not repeatedly shown.
  • Offline app files: a service worker may cache Nestlist’s interface files so the installed web app loads reliably. It is not used to track you across websites.

These functions are necessary for the service or requested preference and are not used for behavioural advertising. If Nestlist later adds non-essential analytics, advertising or similar technologies, they will remain off until valid consent is obtained, and this notice will be updated.

Your controls

You can remove stored website data using your browser settings. Clearing essential session information may sign you out, and clearing the install preference may cause the install suggestion to appear again.

Service terms

Terms of use

Last updated 17 August 2026

Using Nestlist

Nestlist is an early-access service for adults to save, compare and discuss property listings within a private household. You are responsible for keeping your sign-in secure and for activity performed through your account. Only invite people you trust to a household.

Property information

Listing details may be imported from third-party property websites or entered by users. They may be incomplete, delayed or inaccurate. Nestlist is not an estate agent, surveyor, conveyancer, mortgage adviser or financial adviser. Always verify prices, tenure, availability, measurements, postcodes and other important details with the original listing and appropriate professionals before making a decision.

Your content and household sharing

You keep ownership of the links, notes and other content you add. You give Nestlist permission to store, process and display that content only as needed to operate and improve the service. Content added to a household is visible to its members, so do not add confidential information that should not be shared with them.

Acceptable use

Do not use Nestlist unlawfully, attempt to access another household, interfere with the service, introduce malicious code, overload or scrape the service, impersonate another person, or add content that infringes another person’s rights. Access may be restricted where reasonably necessary to protect users or the service.

Third-party services

Nestlist links to property portals and uses third-party sign-in and hosting services. Those services are independent and have their own terms and privacy practices. Nestlist is not responsible for third-party content, availability or decisions.

Availability and changes

As an early-access product, Nestlist may change, experience interruptions or be withdrawn. We will take reasonable care in operating it and, where practical, give notice of a permanent closure and an opportunity to retrieve important information.

Liability and consumer rights

Nothing in these terms excludes liability for death or personal injury caused by negligence, fraud, fraudulent misrepresentation, or any liability or consumer right that cannot legally be excluded. Subject to that, Nestlist is not responsible for property decisions, losses caused by inaccurate third-party listing information, or losses that were not reasonably foreseeable. Any further limitation will apply only to the extent permitted by law.

Law and contact

These terms are governed by the laws of England and Wales. If you are a consumer elsewhere in the UK, you retain any mandatory protections and rights to bring proceedings available where you live. Questions can be sent to jamesmac88@me.com.

Good-practice statement

Accessibility

Last updated 17 August 2026

Nestlist wants the service to be usable by as many people as possible. We aim to follow the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA as the product develops.

Current position

Nestlist has not yet completed an independent accessibility audit, so we do not claim full WCAG 2.2 AA conformance. Known areas for ongoing testing include keyboard operation, screen-reader announcements, colour contrast, zoom and reflow, and the accessibility of the install and property-import journeys. Property pages reached through external links are outside Nestlist’s control.

Tell us about a problem

If you cannot access part of Nestlist or need information in another format, email jamesmac88@me.com. Please describe the page, device and difficulty. We will review the issue and aim to provide a reasonable alternative.

Voluntary commitment

Modern slavery

Last updated 17 August 2026

Nestlist is not currently required to publish an annual modern slavery statement under section 54 of the Modern Slavery Act 2015 because it does not meet the £36 million annual-turnover threshold. This page records a voluntary commitment and is not presented as a statutory statement.

Our approach

Forced labour, servitude, human trafficking and child labour have no place in Nestlist’s operations or supply chain. As the service grows, we will assess material suppliers proportionately, prefer reputable providers with appropriate labour and human-rights standards, and investigate credible concerns.

Concerns relating to Nestlist or a supplier can be reported to jamesmac88@me.com. Reports will be treated seriously and handled as confidentially as reasonably possible.

If the legal threshold applies later

Nestlist will prepare an annual statement covering the steps taken during the relevant financial year, obtain the required senior approval and signature, publish it prominently, and review it each year.

Administrator working document

Commercial launch checklist

Operational checklist — not legal advice

This is the remaining compliance work for the Nestlist administrator before opening the service to the general public, charging users or publishing through an app store.

  1. Confirm the operator. Add the legal entity name, geographic/registered address, company number, place of registration and VAT number where applicable.
  2. Complete the data map. Record every category, purpose, lawful basis, recipient, international transfer, security measure and retention period; update the privacy notice to match.
  3. Complete the ICO fee self-assessment. Pay the data-protection fee if the operator is not exempt, and display the registration details once issued.
  4. Put supplier paperwork in place. Review data-processing terms for authentication, hosting, email, analytics and support providers, including UK international-transfer safeguards.
  5. Audit cookies and software kits. Keep non-essential analytics, marketing tools and app SDK tracking disabled until a compliant consent choice is available.
  6. Design privacy operations. Add verified account deletion and data export, access/correction request handling, breach response, backup deletion and household ownership/reassignment procedures.
  7. Review consumer terms before charging. Cover pricing, renewals, cancellation, digital-service remedies, trials, refunds and required pre-contract information. Obtain UK legal review.
  8. Prepare app-store disclosures. Make Apple and Google privacy/data-safety answers consistent with the actual app and this notice.
  9. Test accessibility. Audit the production web and mobile experience against WCAG 2.2 AA, fix material issues and update the accessibility statement honestly.
  10. Review product risk. Complete a data-protection impact assessment if new profiling, precise location, large-scale or other high-risk processing is introduced. Review age and online-safety obligations before adding public user-to-user content.
  11. Recheck threshold-based duties. Publish a statutory modern slavery statement only if section 54 applies; revisit additional reporting duties as the organisation grows.

Primary official guidance used

  • ICO: what privacy information must be provided
  • ICO: cookies and similar technologies
  • ICO: data-protection fee
  • GOV.UK: publish an annual modern slavery statement
  • Companies House: company-name and website disclosures