Nook
Get free alerts

Privacy Policy

Last updated: July 2, 2026

Summary

This Privacy Policy describes how Nook collects, uses, shares, and protects your personal information when you use our Service. We aim to be transparent about our practices and give you control over your data.

Quick links:

1. Who We Are

Nook is operated by NORELIX LIMITED, a company registered in Ireland under company number 817569, with a registered office at The Black Church, St. Mary's Place, Dublin 7, D07 P4AX, Ireland. We operate in the United States under the trade name "The Nook" via the website thenook.rent and related services (the "Service").

Contact for privacy matters:
Email: privacy@thenook.rent

2. Information We Collect

2.1 Information You Provide

Account information:

  • Name
  • Email address
  • Password (stored hashed, never in plain text)
  • Phone number (optional, for account security only)

Profile and preferences:

  • City, neighborhoods, and other search criteria
  • Budget, bedroom count, amenity preferences
  • Move-in date and lease length preferences
  • Notification preferences

Payment information:

  • Billing name and address
  • Last four digits of payment card
  • (Full card numbers are processed by Stripe; we do not store them)

Move-out listings (if you submit one):

  • Property address
  • Rent and lease details
  • Photos and descriptions you upload

Communications:

  • Messages you send to support
  • Conversations with Wren AI
  • Survey responses

2.2 Information We Collect Automatically

Device and usage data:

  • IP address
  • Browser type and version
  • Operating system
  • Device identifiers
  • Pages visited, features used, time spent
  • Referring URL
  • Clicks and interaction events

Cookies and similar technologies:

  • Session cookies (functional)
  • Analytics cookies (performance)
  • See our Cookie Policy

Approximate location:

  • Derived from IP address
  • Used to suggest your city; you can override

2.3 Information from Third Parties

Listing sources: We aggregate publicly available rental listing data from agency feeds, public databases, syndicated networks, and similar sources. This data describes properties, not you personally.

Payment processors: Stripe provides transaction confirmation, last four digits, and card brand.

Identity providers (if you sign in via Google, Apple, etc., when available):

  • Email
  • Name
  • Profile photo (where provided)

2.4 Sensitive Personal Information

We do not knowingly collect sensitive personal information as defined by California or other state laws (e.g., government IDs, financial account numbers other than card last four, precise geolocation, racial/ethnic origin, religious beliefs, sexual orientation, health information, biometric data, contents of private communications).

If you choose to include such information in a free-text field (e.g., a message to support or to Wren AI), we will handle it according to this Policy but recommend you avoid sharing it.

3. How We Use Information

We use your information for the following purposes:

3.1 To Provide the Service

  • Create and maintain your account
  • Match listings to your search criteria
  • Deliver alerts by email
  • Process payments and manage subscriptions
  • Provide Wren AI responses
  • Verify rent-regulation status against public databases

3.2 To Improve the Service

  • Analyze usage patterns
  • Test new features
  • Debug issues
  • Train and evaluate AI systems (Wren AI)

3.3 To Communicate with You

  • Send transactional emails (account, billing, alerts)
  • Respond to support inquiries
  • Send marketing emails (only with your consent; you can opt out anytime)

3.4 For Safety and Security

  • Detect and prevent fraud
  • Enforce our Terms of Service
  • Investigate violations and security incidents

3.5 For Legal and Business Purposes

  • Comply with law and respond to legal requests
  • Establish, exercise, or defend legal claims
  • Conduct business operations (auditing, financial reporting)

3.6 Automated Decision-Making

We use automated processes to:

  • Match listings to your search criteria (rules-based filtering)
  • Deduplicate listings (algorithmic similarity)
  • Detect fraud (rules-based and machine learning)
  • Generate Wren AI responses (large language model)

These processes do not produce legal or similarly significant effects on you. You may request human review of any decision by contacting privacy@thenook.rent.

4. How We Share Information

We do not sell personal information for monetary consideration. We share it only as described below.

4.1 Service Providers

We share information with vendors who help us operate the Service, including:

  • Stripe, Inc. — Payment processing
  • SendGrid (Twilio, Inc.) — Email delivery
  • Amazon Web Services / Vercel / Cloudflare — Hosting and infrastructure
  • Anthropic, PBC — Wren AI processing
  • Mixpanel / Amplitude — Product analytics
  • Sentry — Error monitoring
  • Google LLC (Analytics) — Site analytics

These providers are bound by contract to process information only on our behalf and to maintain appropriate security. A current list is maintained at /subprocessors.

4.2 Legal and Safety

We may disclose information if required to:

  • Comply with law, court order, or legal process
  • Enforce our Terms or other agreements
  • Protect the rights, property, or safety of Nook, users, or others
  • Detect, prevent, or investigate fraud or security issues

4.3 Business Transfers

If Nook is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred. We will notify you of any change in ownership or material change in how your information is handled.

4.4 With Your Consent

We share information with third parties only with your direction or consent (e.g., if you click a link to contact a landlord directly through a listing).

4.5 Aggregated and De-identified Data

We may create and share aggregated or de-identified data that cannot reasonably be used to identify you (e.g., "average rent in this neighborhood").

5. Cookies and Tracking

We use cookies and similar technologies for functionality, analytics, and (with your consent) advertising. You can manage cookie preferences:

  • Via our cookie banner when you first visit
  • In your browser settings
  • Via the "Cookie Preferences" link in our footer

We honor Global Privacy Control (GPC) signals as a valid opt-out of sale/sharing for state privacy law purposes.

See our Cookie Policy for details.

6. Data Retention

We retain personal information for as long as needed to provide the Service and for the purposes described in this Policy. General retention periods:

  • Active account data — Life of account
  • Closed account data — 30 days after deletion request, then anonymized
  • Billing records — 7 years (US tax/accounting requirements)
  • Server logs — 90 days
  • Support tickets — 24 months
  • Wren AI conversation history — 12 months from last activity
  • Marketing email engagement data — 24 months from last engagement
  • Consent records — 7 years (legal compliance)

We may retain information longer where required by law or for legitimate business purposes (e.g., dispute resolution).

7. Your Rights

Depending on where you live, you may have the following rights:

  • Access — Know what personal information we have about you
  • Portability — Get a copy in machine-readable format
  • Correction — Update inaccurate information
  • Deletion — Request deletion of your information
  • Opt-out — Decline sale/sharing for cross-context behavioral advertising
  • Limit sensitive PI use — Restrict use of sensitive personal information
  • Withdraw consent — Where processing is based on consent
  • Non-discrimination — Exercise rights without penalty

How to Exercise Your Rights

Self-service:

  • Account settings: Update profile, change preferences, download data, delete account
  • Email preferences: Unsubscribe link in any marketing email
  • Cookie preferences: "Manage Cookie Preferences" in footer

Formal requests:

We will verify your identity (typically by email confirmation) before processing requests. We respond within the timeframe required by your state's law (generally 45 days, extendable to 90 with notice).

Authorized agents may submit requests on your behalf with proof of authorization.

8. California Residents

This section describes rights and disclosures under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

8.1 Categories of Information We Collect

  • Identifiers — Name, email, IP address, account ID (from you, your device)
  • Customer records — Billing address, payment last four (from you, Stripe)
  • Commercial info — Subscription history, transaction records (from your activity)
  • Internet activity — Pages visited, clicks, search queries (from your device)
  • Geolocation (approximate) — City-level from IP (from your device)
  • Inferences — Search preferences, likely interests (from your activity)

We do not collect categories of sensitive personal information for purposes that require disclosure under CPRA § 1798.121.

8.2 Business Purposes for Collection

See Section 3. We do not use personal information for purposes incompatible with those disclosed without giving you notice.

8.3 Categories Shared

We share identifiers, internet activity, and inferences with service providers as described in Section 4. We do not "sell" personal information for monetary consideration.

We may "share" (as defined by CPRA) certain identifiers and internet activity with analytics and advertising partners for cross-context behavioral advertising only if you have not opted out. See Section 10.

8.4 Categories Disclosed for Business Purposes

In the past 12 months, we have disclosed the following categories for business purposes to the service provider categories listed in Section 4:

  • Identifiers
  • Customer records
  • Commercial info
  • Internet activity
  • Approximate geolocation

8.5 Sources

See Section 2.

8.6 Your CCPA/CPRA Rights

California residents may exercise:

  • Right to know
  • Right to delete
  • Right to correct
  • Right to opt-out of sale/sharing
  • Right to limit use of sensitive PI (we do not currently use sensitive PI for purposes requiring this right)
  • Right to non-discrimination

To exercise rights, see Section 7 or visit /do-not-sell.

8.7 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We require written authorization (e.g., a power of attorney) and verification of your identity before processing agent requests.

8.8 Metrics Disclosure

We will publish metrics on requests received and processed in each calendar year as required by CCPA § 999.317(g).

9. Other US State Residents

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Iowa, Indiana, Delaware, Maryland, Minnesota, New Hampshire, New Jersey, or any other state with a comprehensive privacy law, you have rights similar to those described in Section 7.

Submit requests via privacy@thenook.rent or /do-not-sell. We will identify your state of residence and apply the appropriate timeline and procedures.

For appeals of denied requests, contact privacy@thenook.rent with subject "Privacy Appeal."

10. Do Not Sell or Share My Personal Information

You can opt out of sale or sharing of your personal information for cross-context behavioral advertising by:

  • Submitting a request at /do-not-sell
  • Sending a Global Privacy Control (GPC) signal from your browser (we honor these automatically)
  • Adjusting your cookie preferences to disable Targeting & Advertising cookies

We will honor opt-out requests for at least 12 months and will not re-enable sharing without your renewed consent.

11. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from individuals under 18. If you believe we have collected personal information from a person under 18, please contact privacy@thenook.rent and we will take appropriate steps to delete such information.

In addition, the Service is intended only for users who are at least 18 years old, as described in our Terms of Service. We do not knowingly permit individuals under 18 to create accounts or use the Service.

12. Security

We implement reasonable technical and organizational measures to protect personal information, including:

  • Encryption in transit (HTTPS/TLS) and at rest
  • Access controls and authentication
  • Regular security audits
  • Employee training and access limitations
  • Incident response procedures

No system is perfectly secure. We cannot guarantee absolute security and are not liable for unauthorized access despite our reasonable efforts.

If we become aware of a security incident affecting your information, we will notify you and applicable regulators as required by law.

13. International Transfers

We are based in Ireland but operate primarily in the United States. Your information may be transferred to, stored in, and processed in the United States, Ireland, and other countries where our service providers operate.

For users in the European Economic Area (where applicable), we rely on Standard Contractual Clauses approved by the European Commission to safeguard international transfers.

14. Third-Party Links

The Service may contain links to third-party websites or services (e.g., listing landlord contact pages). We are not responsible for their privacy practices. Review their policies before providing information.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

  • Update the "Last Updated" date
  • Post the new version on this page
  • For material changes, notify you by email or in-product notification at least 14 days before the change takes effect

Continued use of the Service after a change takes effect constitutes acceptance.

16. Contact

Questions, requests, or complaints:

Email: privacy@thenook.rent
Mail:
Privacy Officer
NORELIX LIMITED
The Black Church, St. Mary's Place, Dublin 7, D07 P4AX, Ireland

You also have the right to contact your state attorney general or other regulator if you believe we have violated applicable law.