Privacy and data handling

Your CRM remains the system of record. The agency is the data controller for every contact record; NestaAI is a processor acting on the agency’s instructions. If you disconnect NestaAI, your CRM is exactly as you left it.

We read contact records, enquiry history, property associations and engagement signals from your connected CRM. We write back the things an agent would otherwise type: match results, readiness scores, conversation threads and status changes.

We do not sell data, and we do not pool one agency’s contacts into a shared dataset that another agency can query.

Consent status travels with every contact from the first migration. Automated outreach only goes to contacts with a recorded lawful basis, every message carries sender identification and a functional unsubscribe, and unsubscribes are honoured immediately and written back to the CRM.

Obligations under the Spam Act 2003 sit with the agency. NestaAI is built so that meeting them is the default behaviour rather than a configuration you have to remember.

Contacts are checked against the Do Not Call Register before any outbound communication that falls within its scope, and the check result is recorded against the contact so it can be audited later.

Data is encrypted in transit and at rest, held in Australian regions, and access is scoped per agency. Credentials for CRM connections are stored encrypted and are revocable by the agency at any time.

Access to production data by our team is limited to what is required to operate the service and is logged.

We build to the Australian Privacy Principles under the Privacy Act 1988, including collection limitation, use and disclosure, data quality, security, and access and correction rights for individuals whose information an agency holds.

Privacy questions, access requests and complaints: hello@nestaai.com.