Nest.

Privacy Policy

Effective date: October 14, 2026

Mule Digital LLC (“Mule Digital,” “we,” “us,” or “our”) operates the Nest platform, a product of Mule Digital LLC and not a separate legal entity. Nest is an all-in-one CRM, AI writing assistant, license tracker, document vault, and scheduling tool built for licensed, independent insurance agents. This policy explains what personal information we collect, how we use it, and your rights. The Service is intended for U.S.-licensed producers.

Two roles. For information about your own account and use of Nest (your name, email, agency, billing, and license records), we act as a controller. For the personal information you upload about your clients and contacts, you are the controller (or “business”) and we act as your processor (or “service provider”), handling that data only on your instructions to provide the Service. See our Data Processing Addendum. This policy primarily describes the information we handle as a controller.

1. Information we collect

Information you give us directly

  • Account information: name, email address, and password when you sign up. Authentication is handled by Clerk; we do not store passwords.
  • Inquiries: if you contact us through the form on nestannuity.com or by email, we receive the name, email address, phone number, National Producer Number, licensed states, and message you submit. We use it to reply to you and to set up your account, and we deliver it to our inbox through Resend.
  • Agency and license information: home state, agency name, NPN (National Producer Number), and the resident and non-resident license data you enter.
  • Client and contact data: names, phone numbers, email addresses, and notes you add to your contacts and leads inside Nest.
  • Documents and voice memos: files you upload to the document vault and voice recordings you create in the app. Files are stored on Vercel Blob, and vault documents are encrypted with AES-256-GCM before storage. Voice memo audio is sent to OpenAI Whisper for transcription and the transcript to an AI model for summarisation, both through the Vercel AI Gateway. Audio and transcripts are stored in your account until you delete them or close your account.
  • Payment information: billing is handled by Stripe. We receive a confirmation and customer ID from Stripe; we do not store your card number or bank details.
  • Acceptance records: when you accept our Terms we record the time, your IP address, your browser details, the version of the Terms, and the text you agreed to.

Information from services you connect

  • Salesforce: if you connect your own Salesforce org, we read the records you choose to import, limited to what the connecting Salesforce user can see: accounts and household relationships, contacts, leads, policy and opportunity records, campaigns and campaign members, activity history (tasks and notes), and files and attachments, which we download and store in your account. Nest reads from Salesforce and does not write to your org. After the first import we continue to synchronise your records about every 6 hours until you disconnect. We store the Salesforce authorisation tokens encrypted at the application layer. You can disconnect at any time in Settings → Integrations, which stops the sync and deletes your stored credentials. Records already imported stay in your account until you delete them.
  • Integrations that are not yet available: LinkedIn, NIPR license sync, carrier sync (including the browser extension), DocuSign, and similar connections are not active today and Nest collects nothing through them. Before any of them is enabled we will update this policy to describe what it collects and how it is stored.

Integrations that are not active. DocuSign, LinkedIn, NIPR, AHIP, carrier sync, the browser extension, and email, calendar, and telephony connections are coming soon or not offered, and they do not connect today. When any of them launches we will update this policy before enabling it. Data from previously connected accounts that is already stored in an account is kept under the same retention rules in Section 4 and is not used while those integrations are unavailable.

Information collected automatically

  • Usage and performance data: page views, feature interactions, and page speed measurements, collected through Vercel Web Analytics and Vercel Speed Insights. No third-party advertising cookies and no cross-site tracking.
  • Bot detection: signup and login use Vercel BotID, which reads device and browser signals to tell people from automated traffic.
  • Server and security logs: IP address, user agent, and request timestamps for security monitoring and abuse prevention. Hosting-provider logs are kept for the period our hosting plan provides; our own audit records are kept as described in Section 4.

2. How we use your information

  • To provide, maintain, secure, and troubleshoot the Nest platform. We improve the platform only by using your own account, billing, and usage information and de-identified data. We do not use your clients’ nonpublic personal information to improve the platform, for our own marketing, or to train AI models (see the Data Processing Addendum).
  • To import records from services you connect, such as Salesforce, when you explicitly request it.
  • To send transactional emails (email verification, billing receipts, renewal and cancel notices, certificate renewal reminders). We use Resend for delivery; we do not send marketing emails without your consent.
  • To enforce our Terms of Service and prevent fraud or abuse.
  • To comply with legal obligations (e.g., state insurance regulations, IRS).

We do not sell your personal information. For the personal information of your clients and prospects, we act only as your service provider and do not use it for our own marketing, as described in the Data Processing Addendum. We do not use your Customer Data to train our own AI models. AI requests are processed by third-party providers under their commercial API terms, which they may change, and we do not control their retention or training practices.

3. How we share your information

We share your information only with the sub-processors necessary to operate Nest:

  • Clerk: identity and authentication.
  • Nile: PostgreSQL database hosting (United States).
  • Vercel: application hosting, Blob storage (including uploaded documents, which are encrypted before storage), Web Analytics, Speed Insights, BotID bot detection, and the AI Gateway that routes requests to the AI providers below.
  • Stripe: payment processing.
  • Resend: delivery of transactional email and of the email you send to your own contacts through Nest.
  • Anthropic: AI text generation and analysis, accessed via the Vercel AI Gateway. Call and voice transcripts, E&O documents, and client data you include in a request are sent in prompts to generate output for you.
  • Google: AI text generation for drafting and assistant features (Gemini models), accessed via the Vercel AI Gateway.
  • OpenAI: voice transcription (Whisper), accessed via the Vercel AI Gateway.
  • Upstash: rate limiting (request counts keyed to IP address or user id).
  • U.S. Census Bureau: address geocoding. Street addresses (without names) of contacts and leads you import, and your office addresses, are sent to look up map coordinates.
  • Salesforce: record import (accounts, contacts, leads, policies, campaign history, activity history, and files and attachments), only if you connect your own Salesforce org.

Your own accounts. Salesforce is your own account that you choose to connect; it is not our sub-processor. DocuSign, LinkedIn, and the other integrations listed above as not active are likewise not in use.

We use these sub-processors under their standard data-processing terms, which contain confidentiality and security obligations. AI providers and models can change; this list is kept current on this page. We do not sell your data and do not share it with lead vendors or advertising networks. We disclose information to insurance carriers only when you direct that through features you use.

4. Data retention

  • Account data: kept while your account is active.
  • Recycle bin: records you delete in the app sit in a recycle bin for 30 days and are then permanently purged.
  • Closed accounts: if you close your account, identifying data is removed or anonymised within about 30 days. Records required for legal, financial, and audit purposes (for example commission records and the audit trail) are retained.
  • Voice memos: audio and transcripts are kept until you delete them or your account is scrubbed.
  • Audit and acceptance records: records of security-relevant actions and of your acceptance of our Terms are kept for at least three years.
  • Backups: database backups are stored privately and kept for 14 days. Data deleted or scrubbed from your account can therefore remain in backups for up to 14 days after that.
  • Payments: Stripe keeps billing records under its own policies.

5. Your rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate information.
  • Request deletion of your account and associated data.
  • Receive a portable copy of your data (export is available in-product as CSV).
  • Disconnect Salesforce at any time.

To exercise any of these rights, email hello@nestannuity.com with the subject line “Privacy Request.” We verify your identity and respond within 45 days. If your clients’ personal information is involved, we will refer the request to the relevant agency customer (the controller of that data).

6. Your U.S. state privacy rights

If the law of your state gives you privacy rights over your personal information (for example the right to know, access, correct, delete, or obtain a portable copy, or to opt out of sale, sharing, targeted advertising, or profiling), we will honor them as follows.

  • We do not sell your personal information and do not “share” it for cross-context behavioral advertising, as those terms are defined under California and other state laws.
  • No discrimination. We will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right.
  • Authorized agents. You may use an authorized agent to submit a request; we may require verification.
  • Appeals. Where state law provides an appeal right, you may appeal a denied request by replying to our decision.
  • Michigan. Michigan has no comprehensive consumer privacy statute. The Michigan Identity Theft Protection Act governs breach notification (Section 10).

Submit requests to hello@nestannuity.com with the subject “Privacy Request.” The categories of personal information we collect, the purposes, and the parties we disclose to are described in Sections 1 through 4.

7. Financial and insurance information

Because Nest serves insurance professionals, some information may relate to insurance and financial matters and may be subject to laws such as the Gramm-Leach-Bliley Act (GLBA) and state insurance data-security and privacy rules (including frameworks based on the NAIC Insurance Data Security Model Law). We maintain administrative, technical, and physical safeguards designed to protect this information, and we limit its use to operating the Service and as permitted by law. Your clients’ nonpublic personal information that you upload is handled as a service provider under our Data Processing Addendum; you remain responsible for your own GLBA and state-law privacy obligations to your clients. Do not upload nonpublic personal health information unless you hold any authorization required by law; Mule Digital does not sign business associate agreements.

8. Cookies and tracking

We use strictly necessary first-party cookies set by us and by our authentication and payment providers (Clerk and Stripe) to keep you signed in and to process payments. We use Vercel Web Analytics and Vercel Speed Insights for aggregate usage and performance measurement, and Vercel BotID for bot detection. We do not use third-party advertising cookies and do not engage in cross-site tracking. We do not currently respond to browser Do Not Track signals.

9. Security

Traffic to and from Nest is encrypted in transit (TLS 1.2+). Documents in the vault, OAuth tokens, carrier portal credentials, and connected-integration credentials are encrypted at the application layer (AES-256-GCM) before storage. Not everything is encrypted at the application layer: webhook and ingest signing secrets that you create in Settings > API (they must be readable to sign and verify requests), message attachments, voice memo audio, and the contents of quote and illustration share links are not, and neither are other records such as contacts and notes, which are stored in our database provider. Share links carry the client details they display inside the link itself and expire after 7 days. Access is role-scoped and account-scoped, and security-relevant actions (such as document downloads, record changes, integration events, and messaging events) are recorded in an audit log. Not every read is logged. No system is perfectly secure, and we cannot guarantee absolute security.

10. Data breach notification

If we become aware of a breach of security affecting your personal information, we will notify affected users and, where required, regulators and your agency customer, without undue delay and within the timeframes required by applicable state breach-notification laws, including the Michigan Identity Theft Protection Act. Where we act as a service provider for your clients’ data, we will notify the relevant agency customer within the period stated in the Data Processing Addendum so it can meet its own notification obligations.

11. Automated processing and AI

Nest’s AI features generate drafts and suggestions to assist you; they do not make legally or similarly significant decisions about consumers on their own. Unless you turn on automation (Settings > Autopilot), AI drafts are sent only after your action. Before data is sent to an AI model, Social Security number and date-of-birth patterns are masked on some surfaces. That masking does not cover names, contact details, policy or financial data, which are sent in prompts when you use those features. Please do not paste SSNs or dates of birth into AI prompts.

12. Visitors to agent websites

Nest hosts websites, booking pages, forms, and client portals that agents publish. On those sites the agent is the controller of the information a visitor submits, and Mule Digital LLC acts as the agent’s hosting service provider. A visitor’s contact, booking, or other form sends the name, email, phone number if requested, and message entered to that agent. We also record the page path, the referring host, and, for rate limiting, the IP address. To reach the agent, use the contact details on that site; to reach us, use the address below. We do not sell visitor information.

13. Children

Nest is intended for licensed insurance professionals. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it promptly.

14. Where data is processed

Nest is intended for U.S.-licensed producers. Data is processed in the United States and by the AI providers listed above under their terms. If you use Nest from outside the United States, you do so at your own risk.

15. Changes to this policy

We will post any changes to this page and update the effective date above. For material changes, we will notify you by email at least 30 days before they take effect.

16. Disputes

Any dispute about this policy is resolved under the arbitration, class-action and jury waiver, governing-law, and venue provisions of our Terms of Service. If this policy and the Terms conflict on those matters, the Terms control.

17. Contact

Questions or privacy requests:
Mule Digital LLC
Nest
2120 University Park Dr, Okemos, MI 48864
hello@nestannuity.com