Privacy Policy
This policy explains how Matheson Holdings LLC ("Nestor", "we", "us") handles personal information in connection with the Nestor platform.
Two different roles
Nestor is sold to advisory firms. That means we handle two kinds of personal information, and our responsibilities differ for each.
Firm account information — the people at a subscribing firm who hold accounts with us, and the billing contact. We decide how this is used, so we are the controller for it.
Client information — information about a firm's own clients, which the firm puts into the platform or asks its clients to provide. The firm decides what goes in and why. We only handle it to run the service and on the firm's instructions, so the firm is the controller and we are the processor. If you are a client of a firm that uses Nestor, direct any request about your information to that firm.
What we collect
| Category | Examples |
|---|---|
| Firm account | Name, work email, role, firm name, authentication records |
| Billing | Billing contact, plan, invoices. Card details go directly to our payment processor and we never see or store them |
| Client records entered by the firm | Names, contact details, household relationships, service history, notes |
| Documents uploaded | Files a firm or its clients upload, which may include tax forms and financial statements |
| Usage and technical | Log records, IP address, device and browser information, actions taken in the product for audit purposes |
How we use it
- To provide, maintain and secure the platform
- To authenticate users and keep an audit record of actions taken
- To send transactional messages — invitations, reminders, notifications and service notices
- To bill the firm and collect payment
- To respond to support requests
- To comply with law and to establish or defend legal claims
We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use client information to train machine learning models. There is no advertising or third-party tracking on the client-facing portal.
Subprocessors
We use a small number of service providers to run the platform. Each is bound by contract to protect the information it handles.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, email delivery | United States |
| Stripe | Subscription billing and payment processing | United States |
We will give subscribing firms advance notice before adding a subprocessor that handles client information.
Security
Information is encrypted in transit and at rest. Each firm's data is isolated at the database level. Access by our staff is limited to what is needed to operate the service and to support requests, and actions in the product are recorded in an audit log. Uploaded files are scanned before they are made available.
We are candid about what we do not yet have: Matheson Holdings LLC has not completed a SOC 2 examination or an independent penetration test. We will update this section when that changes.
Breach notification
If we become aware of a breach affecting a firm's data, we will notify that firm without undue delay and in any event within 72 hours of becoming aware, with the information we have at the time and updates as we learn more.
Retention
We keep firm account information for as long as the account is active and for a reasonable period afterwards for legal and accounting purposes. Client information is kept for as long as the firm's account is active. After termination we retain it for 30 days so the firm can export it, then delete it. A firm may ask us to delete specific records sooner.
Your choices
Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal information, and to object to or restrict certain processing. If you hold a Nestor account with us, contact us using the details below. If you are a client of a firm that uses Nestor, contact that firm — they control the information and we will support them in responding.
We will not discriminate against anyone for exercising these rights.
International transfers
We operate in the United States and our providers store data there. If you access Nestor from outside the United States, your information will be transferred to and processed in the United States.
Children
Nestor is a business tool and is not directed at children. We do not knowingly collect information directly from anyone under 16. A firm may hold records about a client's dependants; that information is under the firm's control.
Changes
We may update this policy. If a change is material we will notify subscribing firms by email or in the product before it takes effect.
Contact
Matheson Holdings LLC
5015 NE 15th Ave, Apt 3, Portland, OR 97211
privacy@nestorhq.app