Privacy Policy

Who we are and what this covers

NestCash Intel is a housing intelligence product operated by NestCash LLC (“NestCash,” “we,” “us”).

This policy covers two things, which run as separate services:

• The website at www.nestcashintel.co, where you can learn about the product and how to connect it.
• The NestCash Intel service, a remote Model Context Protocol (MCP) server that an AI assistant connects to on your behalf. It offers read-only research tools that return U.S. housing, demographic, and economic data at the county level, drawn primarily from federal sources including the U.S. Census Bureau, FHFA, BEA, and BLS.

This policy does not cover the AI assistant you use with NestCash Intel, or other websites we link to. Those have their own privacy policies.

Information we collect

We aim to collect only what we need to run the service. The data NestCash Intel returns is aggregated, public, county-level information. It is not personal information about you or anyone else.

Account information

When you sign up, we create an account record the first time your AI assistant uses one of our tools. It holds:

• your email address
• an account ID issued by WorkOS, our sign-in provider
• your account status
• the date the account was created

If we invite you directly, we also keep the date of the invitation and may keep a short internal note about the account.

Sign-in information

You sign in with your email address through WorkOS AuthKit, using OAuth. WorkOS keeps a user record with your email address, and a record of your sign-in sessions that includes the IP address and browser details of each session, under its own privacy and retention practices. When your AI assistant makes a request, our service checks the access token and the email address it carries. Both are processed in memory to authorize the request and are not saved by our application. We do not receive the password for your AI assistant account.

Tool requests from your AI assistant

When your AI assistant decides to use NestCash Intel, it sends us an individual tool request. A request names the tool being used and the research parameters for it, such as county or state names, the measures requested, and time periods. We receive these individual requests, not your whole conversation.

We process the contents of each request, and the data we return, in order to answer it. We do not store request contents or results in our application database or our application logs. See AI assistant integrations for more.

Usage records

To apply usage limits and keep the service reliable, we keep a daily summary for each account. It records the day, your WorkOS account ID, the name of each tool used, the number of calls, the number of errors, the number of times a rate limit was reached, and the size of the responses in bytes. It does not record what you asked about. Usage records are deleted from our live database automatically after 90 days. Copies remain in backups for up to 30 days more, as described in Data retention.

We also keep daily totals of new sign-ups and refused sign-ups. These are counts only and do not identify anyone.

Application logs

Our application logs each request’s method, its path without query parameters, the HTTP status, how long it took, the ID of the OAuth client that made it, and a hashed reference to your account. The hashed reference is pseudonymous, not anonymous: it does not show your email address, but it still relates to your account. Our application is built not to log access tokens, email addresses, IP addresses, research parameters, or response contents.

Our application uses the IP address of a request in memory to limit traffic that is not signed in. It does not store it.

Hosting logs

The service is hosted on Railway, which receives the service’s traffic and keeps its own request logs. Those logs include source IP addresses, user agents, request paths, status codes, and response sizes. They are not linked to your account.

Website information

• Forms. Our website has no forms and does not ask visitors for personal information.
• Analytics. Our website uses PostHog, an analytics service, to count visits and to see which pages and buttons are used. When you view a page, your browser sends PostHog the page address, the page you came from, your browser and device type, your screen size, the links and buttons you click, and your IP address, which PostHog uses to estimate your country and city. We do not use this information for advertising, and it is not linked to a NestCash Intel account.
• Session replay. PostHog also records a replay of your visit, so we can see how the pages are used and find problems. A replay captures the pages as they appeared to you, including their text, along with your mouse movements, clicks, and scrolling, your browser’s console messages, and the addresses, sizes, and load times of the files each page loaded. Our website has no forms, and anything typed into a field would be masked. A replay covers only our website, is not linked to a NestCash Intel account, and is not used for advertising. If your browser sends a Do Not Track signal, we do not collect analytics or record a replay of your visit.
• Cookies and browser storage. PostHog keeps its analytics and replay IDs in memory and does not store those IDs in cookies, local storage, or session storage. A full page load starts a new replay. Our website does not use advertising trackers or embedded third-party media.
• Fonts. Our website loads its typeface from Google Fonts. When your browser requests the font files, Google receives your IP address and basic browser information, as described in Google’s font privacy FAQ. Apart from the fonts and the analytics script, every file on our website is served from our own domain.
• Website hosting logs. Our website is also hosted on Railway. Railway’s request logs for the website record each visit’s source IP address, user agent, the page requested, and the status code. The website itself keeps no visitor logs of its own.

Support and other communications

If you email us or otherwise contact us, we receive your email address and whatever you choose to include in your message.

Email updates

We do not currently send newsletters or marketing email, and our website has no sign-up for them. If we offer email updates in future, we will send them only to people who separately choose to receive them. Connecting NestCash Intel to your AI assistant does not subscribe you to marketing email.

Payments

NestCash Intel does not currently take payments, and we do not collect payment information. If that changes, we will update this policy first.

How we use information

We use the information described above to:

• Provide and maintain the service, including answering the tool requests your AI assistant sends.
• Authenticate you and manage your account, including your connection to your AI assistant.
• Keep the service secure, including preventing fraud and detecting abuse.
• Apply usage limits and keep the service reliable, including rate limiting and troubleshooting.
• Respond to you when you contact us.
• Send research updates, only if you have separately opted in to receive them.
• Meet legal obligations and enforce our terms.

We do not use tool requests to build advertising profiles.

AI assistant integrations

NestCash Intel works as a data connector for third-party AI assistants. Today that means Claude, made by Anthropic. You add NestCash Intel to your assistant, and the assistant calls our tools when it judges that our data would help answer your question.

What we receive

We receive the individual tool requests your assistant sends to us. We do not receive your whole conversation, and we do not ask your assistant for your conversation history, memory, or uploaded files.

Each request contains research parameters such as county names, measures, and time periods. Your assistant writes each request based on your conversation, so a request can include other details you typed if the assistant passes them along. We have to process whatever a request contains in order to answer it. We do not store request contents or results in our application database or application logs. Please avoid putting sensitive personal information into research questions you expect to be sent to connected tools.

The NestCash Intel tools are read-only. They look up data and return it. They do not change anything in your AI assistant account.

What your AI provider handles

The results we return go back to your assistant through your connected session, so your AI provider receives them. Your conversations, including the answers your assistant writes using our data, are handled by your AI provider under its own terms and privacy policy. For Claude, that is Anthropic’s Privacy Policy. NestCash does not control how your AI provider stores your conversations, how long it keeps them, or whether and how it uses them to train models. Questions about those practices should go to your AI provider.

NestCash Intel is an independent product. It is not operated or endorsed by Anthropic.

Sharing and service providers

We share personal information only with companies that help us run NestCash Intel, and only as needed for the work they do for us. We do not sell personal information.

We use GitHub to store our source code and to run scheduled refreshes of government data. In the normal operation of the service, GitHub does not receive information about the people who use NestCash Intel.

We may also disclose information:

• When the law requires it, for example in response to a valid subpoena or court order, or to protect the rights, property, or safety of NestCash, our users, or others.
• As part of a business change, such as a merger, acquisition, or sale of assets. If that happens, this policy will continue to apply to your information unless you are told otherwise.
• With your consent or at your direction.

Data retention

How long we keep information depends on what it is. Some of it is held by our providers under their own retention practices.

Data security

We use reasonable technical and organizational measures to protect the information we handle. For the NestCash Intel service, these include:

• OAuth sign-in and token checks. Every request must carry a valid access token. The service validates the token and checks that it was issued by our sign-in provider and intended for our service.
• Authorization. The service checks that an account is authorized before it answers a request.
• Encrypted connections. The service is served over HTTPS and sends security response headers.
• Limits on requests. The service applies usage limits, restricts the size of requests, and accepts only inputs that match a strict format for each tool.
• Read-only tools. The service can look up and return data. It has no tools that write to or change your AI assistant account.

No online service can guarantee perfect security. If you believe your account has been compromised, please contact us.

Reporting a security issue

If you find a security vulnerability in NestCash Intel, please email team@nestcash.co with “Security report” in the subject line. We review every report.

Your rights and choices

• Access and correction. You can ask us for a copy of the personal information we hold about you, or ask us to correct it.
• Disconnecting. You can remove NestCash Intel from your AI assistant at any time in that assistant’s connector settings. This stops the assistant from making further requests on your behalf. It sends nothing to us, so it does not delete your account information or your past usage records. To have those deleted, send us a deletion request.
• Deletion. You can ask us to delete your account by emailing us from the address on the account. A person at NestCash carries out each request by hand, in this order:
  • We suspend the account so that nothing new is recorded.
  • We delete your user record at WorkOS, our sign-in provider, so the account cannot sign in again.
  • We delete your account record and all usage records for it from our live database.
  • We reply to confirm that it is done.
  Some copies are not removed by those steps:
  • Backups. Database backups taken before the deletion still contain your account and usage records until each backup is deleted, 30 days after it was taken. We only read a backup to restore the service. If we ever restore one, we repeat any deletions requested since it was taken.
  • Application logs. A hashed reference to your account, with no email address or request content, remains in logs for up to 30 days.
  • Railway request logs. IP addresses and user agents remain for up to 30 days. They are not linked to your account, and we cannot delete individual entries.
  • WorkOS. Anything WorkOS keeps after a user record is deleted is under its control.
  • Your AI provider. Your conversations in Claude are held by Anthropic under your own Claude account. We cannot delete them.
• Marketing email. We do not currently send marketing email. If we start, it will go only to people who opted in, every message will include a way to unsubscribe, and you can also ask us to remove you.
• Analytics and session replay. Our website uses PostHog analytics and session replay and does not use advertising trackers. If your browser sends a Do Not Track signal, we do not collect analytics or record a replay of your visit. A content blocker may also block collection. If our use of cookies or tracking changes, we will update this policy and give you a choice where the law requires it.

Depending on where you live, you may have additional rights under local privacy law. For example, residents of some U.S. states, the European Economic Area, and the United Kingdom may have rights to access, delete, correct, or receive a portable copy of their information, to object to or restrict certain uses, and to complain to a data protection authority. We do not discriminate against anyone for exercising these rights.

To make a request, email team@nestcash.co from the address associated with your account. We may need to verify your identity before acting on a request.

Children’s privacy

NestCash Intel is a research tool for real estate investors and other professionals. You must be at least 18 years old to use it. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

If you believe someone under 18 has given us personal information, please contact us and we will delete it.

International users

NestCash Intel covers U.S. housing data and is operated from the United States. The service and the website are hosted in the United States. If you use them from another country, your information is transferred to and processed in the United States, and in other countries where our service providers operate, where privacy laws may differ from those where you live.

Changes to this policy

We may update this policy as the product changes. When we do, we will post the new version on this page and change the effective date at the top. If a change materially affects how we handle your personal information, we will give you more prominent notice, such as an email to the address on your account or a notice on our website, before the change takes effect.

Contact us

Questions about this policy, privacy requests, and security reports can be sent to:

NestCash LLC
team@nestcash.co