Privacy Policy

NestHK is an AI-assisted decision-support tool that helps users identify suitable residential districts across Hong Kong’s neighbourhoods. This website is operated by us, and we are the "data user" as defined under the Ordinance, responsible for the proper handling of the personal data we collect.

If you have any questions about this Policy or the way we handle your personal data, or wish to exercise the rights described below, please contact our Privacy Officer at hkzhuna@gmail.com.

The personal data we collect depends on how you use our services and may include the following categories:

• Account Information: When you register an account, we collect your email address; if you choose to sign in with a Google account, we obtain the display name and email address provided by Google. Your login password is stored encrypted as a hash, and we cannot read your plaintext password.
• Questionnaire and Matching Preferences: Your housing needs actively entered when using the neighbourhood matching feature, such as budget, preferred property type, commuting tolerance, lifestyle habits, areas of interest, and family status. These are your residential preference data and are not a special category of data under the Ordinance.
• Reports and Orders: The residential district matching reports generated for you, the credits or plans you purchase, and the relevant transaction reference numbers.
• Payment Information: Payments are processed by the third-party payment service provider Stripe. We do not store your credit card number; we retain only the billing email, the plan purchased, and the transaction records for verification and after-sales support.
• Communications: When you proactively contact us via WhatsApp, WeChat or email (including enquiries, complaints or feedback), we collect the content of your communication and your contact details.
• Technical and Usage Data: Including your IP address, browser and device type, access time, and page-view history. Analytics data is collected via Google Analytics 4; advertising-related data (where ads are enabled on content pages) is collected via Google AdSense and its advertising partners. See "Cookies and Similar Technologies" below.
• Referral Data: If you use a referral link, we record the identifiers of the referrer and the referred user in order to grant referral rewards.

We collect your personal data in the following circumstances: when you register or log in to your account; when you complete and submit a neighbourhood match; when you purchase credits or a plan; when you proactively contact us; and when you browse this website (through cookies and similar technologies).

If you do not provide the necessary data (for example, your account email), we may be unable to provide you with the relevant service.

We collect personal data for the following purposes directly related to our services (consistent with Data Protection Principle 1 of the Ordinance):

• Providing the Service: Delivering the residential district matching reports you request and maintaining the normal operation of the service.
• Identity Verification and Security: Verifying your identity, safeguarding account security, and preventing fraud or abuse.
• Processing Payments: Processing your payment, issuing receipts, and handling billing enquiries.
• Customer Support: Responding to your enquiries, complaints and feedback, and following up on related matters.
• Service Notifications: Sending you necessary notices relating to your account or orders, such as email verification and report-completion reminders.
• Promotion and Improvement: Sending you product or market information after you have given consent; and analysing usage in an anonymous or aggregated manner to improve the website and services.
• Legal Obligations: Complying with applicable legal requirements, or disclosing to competent authorities where we have a legal basis to do so.

Unless we have obtained your voluntary and explicit consent, we will only use your personal data for the purposes stated at the time of collection or for directly related purposes (consistent with Data Protection Principle 3).

Direct marketing: We will only send you promotional or marketing information after you have given explicit consent (for example, by subscribing to promotional information). You may withdraw consent at any time by clicking the "Unsubscribe" link in our emails or by contacting us, and doing so will not affect your use of the basic service.

We do not sell your personal data. We may disclose your personal data to the following specified categories of persons in the circumstances described (as required to be disclosed under Data Protection Principle 5):

• Payment Processors: Stripe handles your credit card payment and receives the data related to the payment.
• Google: Provides Google account login authentication, the Google Analytics 4 website analytics service, and (where ads are enabled on content pages) the Google AdSense advertising service.
• Advertising service providers and ad partners: Where we display third-party advertising on content pages, Google and its advertising partners may set or read cookies in order to serve, measure and personalise ads. We do not provide advertisers with your name, email address or questionnaire answers for advertising purposes; advertisers cannot access your report content and cannot influence the matching order.
• Microsoft Clarity: Provides anonymous user-behaviour analytics (heatmaps and session replays); the data it collects is not used to identify individuals.
• Cloud Hosting Service Providers: Tencent Cloud (Singapore data centre) provides hosting for this website and its database.
• Email Delivery Service Providers: Assist us in sending verification, report and notification emails.
• Backup Storage Providers: Backblaze B2 provides encrypted storage for our database backups.
• Professional Advisers and Authorities: Disclosure to our legal advisers, audit institutions, or law enforcement or regulatory authorities to whom we are legally required to disclose.
• Confidentiality-Bound Contractors or Agents: Service providers who need access to data in order to provide us with technical support, and who owe us a duty of confidentiality.

Cross-border transfer: Your personal data is hosted outside Hong Kong (in Singapore). We provide protection equivalent to that under Hong Kong’s Ordinance through contractual terms and technical measures (including transmission encryption and access controls), ensuring that the data remains adequately protected after transfer.

We take practicable steps to ensure that the personal data retained is accurate and up to date; you may log in to your account at any time to review and correct your data (consistent with Data Protection Principle 2).

• Account and Preference Data: Retained for the duration of your account; after you request deletion of your account, we will delete or anonymise the relevant data after a reasonable grace period (not less than 30 days).
• Transaction and Payment Records: Retained for a longer period as required by law (for example, for tax or accounting purposes), and deleted upon expiry.
• Analytics Data: Stored by Google according to the default Google Analytics 4 retention period (approximately 14 months), and automatically deleted upon expiry.
• Database Backups: Backup files are overwritten on a 7-day rotation cycle, and old backups are automatically replaced.

We will not retain personal data for longer than is necessary to fulfil the purpose for which it was collected.

We adopt administrative, technical and physical measures to safeguard personal data against unauthorised or accidental access, processing, deletion or loss (consistent with Data Protection Principle 4), including:

• Transmission Encryption: The website uses TLS/HTTPS encryption for all transmissions.
• Password Protection: Login passwords are stored as hashes; we do not store plaintext passwords.
• Access Control: The database has access-rights management; only authorised personnel may access the data they need on a least-privilege basis.
• Backup Encryption: Regular backups are encrypted and stored with Backblaze B2.
• Staff Confidentiality: Our employees and contractors are bound by confidentiality obligations in respect of the personal data they handle.

Despite the measures above, please note that no data transmission over the internet can be guaranteed absolutely secure. Please keep your account credentials safe and never disclose your password or verification code to anyone.

We use cookies and similar technologies in three categories: essential cookies maintain your login state and language preference and cannot be disabled; analytics cookies (Google Analytics 4) help us understand how the site is used so we can improve it; and advertising cookies (set by Google AdSense and its advertising partners, on content pages only) are used to serve and measure ads.

In Hong Kong and the other regions we serve, analytics and advertising cookies are enabled by default. If you are located in the European Economic Area, the United Kingdom or Switzerland, we set analytics and advertising cookies to off by default, as required by law, until you give consent. You may also disable or clear cookies in your browser settings at any time (some functions may be affected if essential cookies are disabled), and you can manage personalised advertising through Google’s Ads Settings.

We also use Microsoft Clarity (a free user-behaviour analytics tool provided by Microsoft) to collect, in an anonymous manner, behavioural data about your interaction with this website — including through heatmaps (recording click and scroll positions) and session replays (anonymously recording the operation process) — to improve the website experience. Clarity automatically masks password fields and text input boxes by default and does not record the plaintext content you enter; the data it collects is anonymous and aggregated and is not used to identify individuals. You may learn more about these practices via Microsoft’s privacy page.

Under the Ordinance, you enjoy the following rights in respect of your personal data (Data Protection Principle 6):

• Access and Correction: You have the right to ascertain whether we hold your personal data and to request correction of inaccurate data; most account data can be reviewed and updated by yourself after logging in.
• Erasure: You may request deletion of your account and the related personal data (except records that we are required by law to retain).
• Withdrawal of Consent: For promotional communications, analytics or advertising cookies, you may withdraw consent at any time without affecting processing already carried out before the withdrawal.
• Opt Out of Direct Marketing: You may ask us at any time to stop using your data for direct marketing.

Exercising your rights: Please email hkzhuna@gmail.com with your request. We will process it as soon as practicable; for a data access request, we may charge an administrative fee not exceeding the statutory cap under the Ordinance and will respond within the prescribed time limit.

This service is primarily intended for adult users. If you are under 18, you should not provide us with any personal data unless you have obtained the consent of a parent or guardian. If we discover that we have inadvertently collected data from a minor, we will delete it upon request.

This website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties and recommend that you review their privacy policies.

We may revise this Privacy Policy from time to time to reflect changes to our services or to legal requirements. Material changes will be announced on this website and, where appropriate, notified to you by email. The revised Policy will be marked with a "Last Updated" date, and your continued use of the service constitutes acceptance of the revised content.

If you have any questions, complaints, or wish to exercise your rights regarding this Privacy Policy or the way we handle personal data, please contact: hkzhuna@gmail.com. Our Privacy Officer will respond as soon as practicable.