Privacy Policy

Effective Date: October 30, 2026  ·  Previous versions: October 27, 2026 · October 18, 2026 · October 17, 2026 · October 15, 2026 · August 15, 2026 · July 22, 2026 · July 21, 2026 · March 7, 2026

Kite Lane Group LLC ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and disclose information when you use the NestMint web application (the "Service"). It also describes your rights and choices regarding your information.

By creating an account, accessing, or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this Privacy Policy, you should not use the Service.

This Privacy Policy should be read together with our Terms of Service, which govern your use of the Service.

1. Information We Collect

We collect only the information necessary to provide the Service. The categories of information we collect are described below.

1.1. Account Information

When you create an Account, we collect:

Data Purpose Storage Method
Username Account identification and authentication Stored in plaintext
Password Account authentication Stored as a bcrypt hash with a unique per-password salt; we never store your plaintext password. Accounts created before our June 2026 security update retain a salted SHA-256 hash until the password is next changed.
Email address (required) Account verification, password reset, and service messages about your Account Stored on secure servers with a flag indicating whether it has been verified
First name / display name (optional) Greeting you and personalizing how the Service addresses you Stored on secure servers
Date of birth (optional) Age-dependent planning calculations, such as Required Minimum Distribution timing Stored on secure servers
State of residence (optional) Applying the correct state tax treatment to your projections Stored on secure servers. We do not collect your street address.
Files you upload (optional) Keeping your own spreadsheets and documents alongside your plan, for your reference Stored on secure servers as part of your Account, exactly as you uploaded them. We do not read, parse, or analyze their contents, and they are never shared with other users. Like other stored data they are not separately encrypted at rest (see 3.1.1). They are removed when you delete the file or your Account. Please do not upload documents containing Social Security numbers, bank or brokerage account numbers, or other sensitive identifiers — the Service never needs them.
Feedback you submit (optional) Improving the Service Stored on secure servers with your Account
Google account identifier and email (only if you sign in with Google) Authenticating you through Google Sign-In Stored on secure servers. We receive only your basic profile and email from Google; we never receive your Google password.
Beta access code (where required for registration) Permitting Account creation during the beta and, for NestMint Workplace, recording which tester group the Account came from (see 3.1.7) Checked when your Account is created. A Workplace Account stores the code used. A personal Account does not store a beta code; if the code you used was a promotional code that activates a plan, the Account records that redemption and the plan it activated.
Employer join code (NestMint Workplace only) Confirming you're entitled to join your employer's program Checked when your Account is created and not stored. The Account stores the employer program it belongs to (see 3.1.2), never the join code itself.
Sign-up agreement record Recording the agreements you accepted and when. New employer-SSO accounts also record whether agreement is still required; planning access is blocked until agreement. SSO acceptance uses a server timestamp; other sign-up records currently use the submitted client timestamp. Missing historical acceptance records are not reconstructed. Stored on your Account
Sign-up security check Blocking automated sign-ups When the Create Account form loads, Cloudflare's Turnstile service evaluates technical signals from your browser and issues a one-time token. We send that token to Cloudflare once to verify it; we do not send your IP address with it, and we do not store the token. See Section 4.

Note regarding email: An email address is required to create an Account. We use it to verify your Account, to let you reset your password, and to send you messages about your Account. We do not send marketing email, and we do not sell, rent, or share your email address. To deliver these messages we use a third-party email service provider, which processes your email address solely to send mail on our behalf.

Current beta and payments: Paid checkout is not enabled for current beta access. If paid plans are introduced, we will identify the payment processor and disclose the information it receives before collecting payment information. Beta participation does not authorize a charge.

1.2. Financial Planning Data (User Data)

The Service allows you to enter financial planning data to generate retirement projections and estimates. This may include, but is not limited to:

You enter or upload personal planning data; NestMint does not automatically connect to your bank or brokerage accounts. Sample scenarios, software defaults, tax assumptions and information identified as employer-supplied may also appear. Review these before using them.

User Data is stored as JSON in our database on secure servers.

1.3. Information We Do NOT Collect

We want to be transparent about what we do not collect:

1.4. Automatically Collected Technical Information

When you access the Service, our servers may automatically record certain technical information in server logs, including:

This information is collected as a standard function of web server operations and is used solely for maintaining the security and operational integrity of the Service. It is not used for tracking, profiling, or advertising purposes.

1.5. Product Usage Events and Workplace Reporting

We record a small set of product usage events when you use the Service: signing in, saving a plan, running a what-if scenario, viewing a retirement projection, and completing the workplace privacy acknowledgment. Each event records which account performed it, when, and — for plan saves — an overall readiness score. Events never include your plan contents, balances, income, goals, or any free-form text, and the list of recorded events is fixed: the Service rejects anything outside it. We use these events to operate the Service and, for workplace accounts, to produce the aggregate reporting described next.

If you use NestMint through your employer: employer plan reporting contains aggregate, anonymized statistics computed across the whole workforce: total enrollment, average readiness scores, engagement trends and similar organization-level figures. Any statistic that would describe fewer than ten employees is withheld entirely. Employer plan reporting does not display or export your individual financial plan, saved scenarios, savings, goals or personal readiness score. Your employer may know your identity or eligibility through invitations, its own single sign-on or employment records. Workplace accounts also record the date you acknowledged the employee privacy notice and whether an account holds an employer-side reporting role; reporting-role accounts are technically prevented from accessing individual account data through the reporting tools.

2. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your information for advertising, marketing profiling, or selling to third parties.

3. How We Store and Protect Your Information

3.1. Data Storage. Your information is stored on secure servers operated on our behalf. User Data (financial planning inputs) is stored as JSON in our database. Your password is stored as a bcrypt hash with a unique per-password salt — we never store or have access to your plaintext password. Accounts created before our June 2026 security update retain a salted SHA-256 hash until the password is next changed, at which point it is upgraded. Backups. Our database — including Account records, password hashes, sessions and User Data — is snapshotted hourly on our server and, since October 19, 2026, an encrypted copy of each hourly snapshot is uploaded to a private object-storage bucket separate from the application server. The server and object storage currently use the same cloud provider; this is off-server storage, not separation across providers. Backups are encrypted before they leave our server with a key whose private half is not kept on that server; they are used only to recover from data loss or compromise, never to look up, restore or reuse an individual Account's data. See Section 6.2.1 for how long they are kept.

3.1.1. What encryption we do and do not use. We want to be precise rather than reassuring here. All traffic between your browser and the Service is encrypted in transit using industry-standard TLS (HTTPS). Your password is protected by one-way cryptographic hashing, as described above. However, User Data stored in our database is not separately encrypted at rest — it is protected by server access controls, not by application-level encryption. The same is true of any files you upload: they are stored as you provided them, protected by access controls rather than application-level encryption. We describe this plainly because a privacy policy should state what is actually true. Note also that the Service never asks for and never stores Social Security numbers, bank or brokerage account numbers, or credentials to any financial institution, and it does not connect to any external financial account.

3.1.2. NestMint Workplace (employer program). We store employer configuration, including branding, benefits contacts, plan details and sign-on settings. Your Workplace Account records its employer-program identifier. Employer reporting is currently aggregate-only under the safeguards described in Section 1.5, not a future feature. Employer reporting cannot display or export your individual financial plan, saved scenarios or personal readiness score.

3.1.3. Account type and planning view. Every Account records its account type — whether it is a personal Account you created yourself at nestmint.ai, or a NestMint Workplace Account created through an employer program. The two are separate Accounts with separate data, even when they use the same email address; neither can read the other's information. Workplace Accounts also record your planning view preference — whether you are currently using the Employee or Retiree view, and which view you last used — so that we can return you to the same view the next time you sign in. The planning view is a display preference that you control and can change at any time; it is not a statement about your employment status, it is never reported to your employer, and it does not change what data you can see or save.

3.1.4. Interface preferences. We store a small set of interface preferences on your Account — for example, a record that you have dismissed a one-time explanatory message. These preferences contain no financial or personal information and exist only so the Service does not repeat itself across your devices.

3.1.5. Workplace invitations. Your employer may invite you to NestMint Workplace directly. When your employer invites you, we store an invitation record containing the email address your employer supplied, optionally your first name for the greeting on the invitation page, the planning view you are assigned to start in, the employer program the invitation belongs to, a single-use invitation token, and its expiry and status. Invitations expire automatically, and accepting one creates your Workplace Account. Your employer supplies the email address and name in these records; we do not obtain them from any other source.

3.1.6. Employer single sign-on. If your employer's program uses single sign-on, you sign in through your employer's identity provider rather than with a NestMint password. When you do, the identity provider sends us your work email address (and, if your employer's system provides it, your name) so we can create or match your Workplace Account. We also keep a short-lived technical record of each sign-in — the identifier of the sign-in message and when it was used — solely to reject replayed or duplicated sign-in messages; this record contains no plan data and is not used for any other purpose. We never receive your employer password, and your employer's identity provider does not receive your plan data.

3.1.7. Beta access code. Consumer and Workplace self-service sign-up use product-specific beta access codes. Workplace Accounts store the code used to identify the issuing tester group. Personal Accounts do not store a beta code; a promotional-code redemption may instead record the offer and plan activated. Workplace onboarding also checks employer entitlement or an invitation; employer single-sign-on follows the program's configured access rules. A withdrawn sign-up code blocks new registrations using that code; it does not itself revoke existing Accounts. Promotional offers, if provided, are subject to the offer shown when used.

3.2. Security Measures. We implement reasonable technical and organizational measures designed to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to:

3.3. No Guarantee of Security. While we strive to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your information. You acknowledge and accept this inherent risk when using the Service.

4. Sharing and Disclosure of Information

We take your privacy seriously and do not sell, rent, or trade your personal information or User Data to third parties for their marketing or commercial purposes.

We may share your information only in the following limited circumstances:

5. Cookies, Tracking, and Similar Technologies

NestMint uses its own cookies and browser storage to run the Service, not for advertising. The following limits describe our application; third-party security resources and Cloudflare's possible security-challenge cookie are described separately below and in the Cookie Policy. NestMint does not use:

If we ever introduce a tracking or analytics technology, this Privacy Policy will be updated first, and you will be notified as described in Section 11 below. See also our Cookie Policy.

5.1. The cookies we set. The Service sets the following first-party cookies, all of them strictly necessary to sign you in and keep you signed in, none of them readable by scripts in the page, and none of them shared with anyone:

5.2. The browser storage we use. The Service also keeps a small number of values in your browser's own storage. They hold your preferences and your progress in the Service; none of them is used for tracking, and clearing your browser storage simply resets them:

Apart from the remembered-username token, nothing stored in your browser by the Service is ever sent to our servers. The remembered-username token is linked on our servers to your username so we can pre-fill the sign-in form. None of the other values identifies you or records what you do in the Service.

5.3. Third-party resources our pages load. Two outside services load directly in your browser: (a) the Cloudflare Turnstile security check, only on the Create Account form, which evaluates the browser signals described in Section 4; and (b) Google Fonts, on our pages, which receives your IP address and browser information when it delivers our typefaces. In addition, every request to nestmint.ai passes through Cloudflare's network (Section 4). None of the three is used by us for tracking, analytics, or advertising. See also our Cookie Policy.

6. Data Retention

6.1. We retain Account information and User Data while the Account remains in the Service, including free-trial, expired-trial, beta, Lifetime Access and Workplace Accounts. Ending a trial, subscription or employer entitlement does not itself delete the Account or its data. Account deletion follows the process below, subject to legal retention obligations.

6.2. If you request deletion of your Account, we will delete your Account information and User Data from production systems within thirty (30) days of receiving your verified request, subject to legal obligations requiring retention. A self-service request through your signed-in Account is verified through that Account; an emailed request may first require identity verification. Backup copies are described separately in Section 6.2.1. This wording does not extend applicable legal response periods.

6.2.1. Active storage and backups. Self-service deletion immediately removes plan data and uploaded files from active application storage and prevents further sign-in. The Account record is marked with a deletion date; its identifying information (username, email, name and date of birth) is subject to the thirty-day production-deletion commitment above. This is not a promise to recover a deleted plan or file. Suspension, sign-out and cancellation of a subscription are not Account deletion.

Backup copies are not erased by deletion from active storage. A backup taken before deletion can contain Account identifiers and plan data. A backup taken after plan deletion but before identifying fields are removed can still contain those identifiers. We do not currently delete individual backups on a fixed schedule, so copies may persist as long as those backups are retained. A retention schedule, including noncurrent object versions and recovery copies, will be disclosed when it takes effect. No thirty-five-day or sixty-day maximum is promised here.

Backups are encrypted and used for service recovery, not routine recovery of an individual's deleted plan. If a backup must be restored, Accounts deleted after it was taken must be deleted again as part of recovery. Restoring a backup does not cancel a deletion request.

6.3. Server logs containing automatically collected technical information are retained for up to ninety (90) days for security and operational purposes and are then deleted or anonymized.

6.4. Following Account deletion, certain information may be retained in anonymized or aggregated form that cannot be used to identify you individually.

7. Your Rights and Choices

You have the following rights regarding your information:

7.1. Access and Data Export

You may request a copy of the personal information and User Data we hold about you. To make a data export request, please contact us at [email protected]. We will respond to your request within thirty (30) days.

7.2. Correction

You may update or correct your User Data at any time through the Service. If you need to update your Account information (e.g., username), please contact us at [email protected].

7.3. Deletion

You can delete your Account through Account Settings, or request deletion at [email protected]. Self-service deletion removes plan data and files immediately and prevents sign-in; the remaining identity-record process is described in Section 6.2.1. Verified email requests are handled within the period described in Section 6.2.

7.4. Subscription Cancellation

Paid checkout is not enabled for current beta access. If you have a separately purchased Subscription, its cancellation terms apply. Cancellation does not automatically delete your Account or data; Account deletion is a separate request described above.

8. Children's Privacy (COPPA Compliance)

8.1. The Service is not directed at, marketed to, or intended for use by children under the age of thirteen (13). We do not knowingly collect personal information from children under 13.

8.2. If we become aware that we have collected personal information from a child under 13, we will take immediate steps to delete such information from our servers.

8.3. If you are a parent or guardian and believe that your child under 13 has provided personal information to us, please contact us at [email protected] so that we can take appropriate action.

8.4. Users must be at least eighteen (18) years of age to create an Account, as stated in our Terms of Service.

9. California Privacy Rights (CCPA/CPRA)

If you are a resident of California, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"), provides you with certain additional rights regarding your personal information.

9.1. Right to Know

You have the right to request that we disclose to you (a) the categories of personal information we have collected about you; (b) the categories of sources from which the personal information is collected; (c) the business or commercial purpose for collecting the personal information; (d) the categories of third parties with whom we share personal information; and (e) the specific pieces of personal information we have collected about you.

9.2. Right to Delete

You have the right to request that we delete any personal information about you that we have collected, subject to certain exceptions provided by law.

9.3. Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

9.4. Right to Opt-Out of Sale or Sharing

Where applicable law provides the right, you may opt out of sale or sharing of personal information. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are used in applicable privacy law. See Section 14 for browser privacy signals and Section 15 to contact us about your rights.

9.5. Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, provide you with a different level of quality, or suggest any of the foregoing as a result of your exercising your rights under the CCPA.

9.6. Categories of Personal Information Collected

Under the CCPA framework, we collect the following categories of personal information:

Category Examples Collected?
Identifiers Username, email address, optional name, IP address, Google identifier if used, and employer-program identifier for Workplace Yes
Account credentials and authentication information Username with a salted password hash, hashed session and recovery tokens, and sign-in-provider linkage; not plaintext passwords Yes
Financial information Self-reported account balances, income, spending (not linked to external accounts) Yes
Internet or network activity Server logs (browser type, pages accessed) Yes
Protected classifications Age or date of birth, if you enter it (optional, used for age-based calculations) Yes (directly, if you enter it)
Geolocation data Precise location No
Biometric information Fingerprint, face recognition No
Sensory data Audio, visual No
Professional or employment information Employer-program affiliation and self-reported employment income for planning; no employer personnel file Yes, where provided or using Workplace
Education information School, degree No

9.7. How to Exercise Your California Privacy Rights

To exercise any of your CCPA rights, please contact us at [email protected] with the subject line "CCPA Request." We will verify your identity before fulfilling your request. We will respond to verifiable requests within forty-five (45) days.

10. Other State and International Privacy Rights

10.1. Nevada Residents

Under Nevada law, certain consumers may opt out of the sale of "covered information." We do not sell your covered information as defined by Nevada law. If you have questions, please contact us at [email protected].

10.2. Virginia, Colorado, Connecticut, and Other U.S. States

Residents of states with comprehensive privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Iowa) may have additional rights, such as the right to access, correct, delete, and obtain a copy of personal data, and the right to opt out of targeted advertising and the sale of personal data. Because we do not sell personal data or engage in targeted advertising, many of these rights are already addressed by our practices. For any privacy-related request, please contact us at [email protected].

10.3. International Users

The Service is currently intended for use by residents of the United States only. We do not actively market the Service to residents of the European Union, United Kingdom, or other jurisdictions with comprehensive data protection laws beyond those described in this Privacy Policy.

The Service is operated from and is intended for users in the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Service, you consent to the transfer and processing of your information in the United States.

11. Changes to This Privacy Policy

11.1. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by posting a prominent notice within the Service and updating the "Effective Date" at the top of this page.

11.2. We will provide notice and obtain consent where required by applicable law. Publishing an updated Policy does not rewrite a previously recorded acknowledgment or substitute for consent when consent is required. Contact us about your rights or Account deletion if you do not agree with a change.

11.3. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11.4. Revision history. For transparency, material changes to this Privacy Policy are recorded here rather than made silently.

Effective dateWhat changed
October 30, 2026Clarified beta versus future paid access, named DigitalOcean and Postmark, distinguished employer identity information from aggregate-only plan reporting, and clarified planning-data sources and operational usage events. Explained production deletion versus backup copies without introducing an unverified backup deadline. Distinguished DNT and GPC and preserved previous acceptance records.
October 27, 2026Disclosed two infrastructure changes made on October 19, 2026 that this Policy did not yet describe: Cloudflare's network now carries all traffic to nestmint.ai (Sections 1.3, 4, 5.3; Workplace excluded), and hourly encrypted off-server database backups (Sections 3.1, 4). Corrected Section 6.2.1: plan data deleted with an Account persists in backups taken before the deletion, pending a retention schedule. Added the Workplace experience choice to the browser-storage list (Section 5.2).
October 18, 2026Clarified new employer-SSO agreement gating and timestamp provenance; current aggregate Workplace reporting; both products' beta codes; retention across account types; self-service deletion; and collected account/employer information. No historical acceptance record was fabricated.
October 17, 2026 Disclosed the sign-up security check (Cloudflare Turnstile) added in October 2026: what Cloudflare receives and how it uses it (Sections 1.1, 1.3, 3.2, 4, 5.3). Named the kinds of service providers we use, including our email delivery provider, and disclosed Google Sign-In, Google Fonts, and employer identity providers (Section 4). Disclosed in the Section 1.1 table that a beta access code is required for personal Accounts too, that the employer join code is checked but not stored, and that the Account records which version of the Terms of Service, this Privacy Policy, and the educational-use disclosure you agreed to at sign-up (the sign-up agreement record). Corrected Section 3.2, which said no sign-in token is kept in the browser. Corrected Section 5.2 to say that the remembered-username token is linked to your username on our servers, matched its wording to the sign-in form's "Remember my username" label, and added Section 5.3 on the outside resources our pages load. Corrected the California table (Section 9.6), which described age as inferred; date of birth is entered by you, if at all. Added links to the Cookie Policy.
October 15, 2026 Corrected Section 1.3 and Section 5, which still said the Service set no browser cookies: it sets one sign-in session cookie (since the June 2026 session change) and, for ten minutes during a Google or employer single sign-on, one sign-in-transaction cookie. Section 5.1 now names each cookie, what it holds, and how long it lasts; Section 5.2 lists every value the Service keeps in browser storage, replacing the earlier "two flags" description that had fallen behind the product. Removed the stale statement that no email address is required to create an Account (one has been required since July 2026, as Section 1.1 states). No change to what the Service collects.
August 12, 2026 Added section 3.1.7 describing the NestMint Workplace beta access code: creating a Workplace Account during the beta requires a code issued to a group of testers, and the code used is stored on the Account so signups can be attributed to a group and a single group's access can be withdrawn without affecting other testers. Corrected section 3.1.5, which previously stated that Workplace Accounts could only be created by employer invitation; a Workplace Account can also be created directly with a beta access code. No new financial data is collected.
August 5, 2026 Added section 3.1.6 describing employer single sign-on: what we receive from your employer's identity provider (your work email, and your name if provided) and the short-lived technical sign-in record we keep solely to prevent replayed sign-ins. Also noted that plan inputs now include an optional Retirement Age alongside Current Age, mirroring the existing spouse fields; like every plan input, it is yours alone and never visible to your employer.
August 3, 2026 Disclosed the account model behind NestMint Workplace: the account type that separates a personal nestmint.ai Account from an employer-program Account (sections 3.1.3), the planning-view preference that remembers whether you are using the Employee or Retiree view (3.1.3), interface preferences such as dismissed one-time messages (3.1.4), and the invitation records your employer creates before your Workplace Account exists (3.1.5). No new financial data is collected; these entries describe information already required to operate the employer program.
July 29, 2026 Added section 3.1.2 for the NestMint Workplace employer program: we store employer configuration only (branding, benefits contact, plan rules, sign-on settings), which contains no personal data, and employers never see any individual employee's data.
July 22, 2026 Disclosed two categories that were in use but undocumented: files you upload in the Files area (stored as provided, never read or analyzed by us, removed with the file or the Account) and feedback you submit. Added a caution against uploading documents containing sensitive identifiers, and extended the encryption statement to cover uploaded files.
July 21, 2026 Updated to match current practice: an email address is now required to create an Account (previously it was not collected) and is used for verification, password reset, and Account messages; disclosed optional display name, date of birth, and state of residence, and the identifier and email received when signing in with Google; described password storage accurately as bcrypt, noting that accounts created before the June 2026 security update retain a salted SHA-256 hash until the password is next changed; stated plainly which data is and is not encrypted; removed the retired security question and answer, which is no longer collected or stored; added rate limiting and single-use time-limited reset links to the list of security measures.
March 7, 2026 Initial publication.

12. Data Security Incident Response

12.1. In the event of a data breach or security incident that compromises the confidentiality or integrity of your personal information, we will:

13. Third-Party Links

The Service may contain links to third-party websites or services that are not owned or controlled by the Company. This Privacy Policy applies only to the Service and does not govern the privacy practices of any third-party website or service. We encourage you to review the privacy policies of any third-party websites or services you visit.

14. Do Not Track and Global Privacy Control

Do Not Track (DNT) and Global Privacy Control (GPC) are different browser signals. GPC expresses an opt-out of sale or sharing of personal information; it is not a request to close your Account or disable necessary security and account functions. We do not sell personal information or share it for cross-context behavioral advertising, as described in Section 9.4. Contact us using Section 15 to exercise applicable privacy rights.

We do not change the Service's behavior in response to DNT. This does not mean that no operational information is collected: Section 1.5 describes product-usage events and Workplace aggregate reporting, and Section 4 describes Cloudflare security processing, Google Fonts and our other providers. This Policy does not represent that a separate technical GPC-detection feature has been implemented.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Kite Lane Group LLC
Email: [email protected]
Subject Line: "Privacy Inquiry"

We will respond to all privacy-related inquiries within thirty (30) days of receipt.