Google Nest Thermostat Driver for Crestron Home®
Last updated: Sep, 2026
1. Who we are and what this covers
KIT Integration for Control Systems LLC, Dubai, UAE (“we”, “us”) publishes this policy.
It covers two distinct things, and the difference matters:
(a) The Driver — software you install on your own Crestron Home processor. The Driver runs entirely on your hardware and communicates directly between your processor and Google’s servers. It does not send any data to us. We operate no servers, cloud service or telemetry endpoint for the Driver, and we have no technical means of accessing your thermostat data, your Google account or your control system.
(b) Our website and commercial operations — purchase and licensing, and support correspondence. Here we do process a limited amount of personal data, described in section 5.
2. Data the Driver handles on your equipment
The Driver stores and processes the following locally, on your Crestron Home processor:
Data Purpose Where it lives Google OAuth client ID and client secret Authenticating to Google Processor configuration store Google OAuth refresh and access tokens Maintaining the authorised session Processor file storage Google Device Access project ID Addressing the correct API project Processor configuration store Nest device identifiers and device names Identifying the thermostat to control Processor memory / configuration Thermostat state: current temperature, humidity, mode, setpoints, HVAC status, connectivity, structure and room name Displaying and controlling the thermostat Processor memory; not written to disk except in diagnostic logs Diagnostic log entries Troubleshooting Processor log files, subject to Crestron Home’s own log retention
These values move only between your processor and Google’s API endpoints over TLS. They are not transmitted to us or to any other third party by the Driver.
3. Google user data and Limited Use
The Driver accesses your Google account data using credentials you create in your own Google Cloud and Google Device Access projects. You are the account holder and, in data protection terms, you (or your client, where you install on their behalf) control that data.
Our use and transfer of any information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
Google user data is used only to provide and improve the thermostat control features the user has explicitly requested.
Google user data is not transferred to us, to advertising platforms, data brokers or information resellers.
Google user data is not used for advertising, profiling, credit assessment or lending purposes.
No human at our company reads Google user data, except where a user voluntarily includes it in a support request (see section 6).
Revoking access. You can withdraw the Driver’s access to your Google account at any time from your Google Account permissions page (myaccount.google.com/permissions), or by deleting your Device Access project. The Driver will stop functioning immediately. Removing the Driver from the processor deletes its stored tokens.
4. What the Driver does not do
The Driver does not:
collect analytics, usage statistics, crash reports or telemetry;
contact any server other than Google’s API endpoints [and, if applicable: our licence validation endpoint — see section 7];
access cameras, microphones, doorbells, locks, or any Nest device other than thermostats;
access other devices, rooms, scenes or user accounts on the Crestron Home system beyond what is required to present the thermostat;
store audio, video, images, location history or contact data.
5. Website and business data we do process
What Why Lawful basis (GDPR) Retention Name, email, company, country submitted via contact or enquiry forms Responding to you Legitimate interests / performance of a contract [24] months from last contact Purchase details: name, billing address, email, order and invoice records, VAT number Fulfilling the order, tax and accounting obligations Contract; legal obligation [7–10] years as required by [JURISDICTION] tax law Payment data Taking payment Contract Not stored by us. Handled by [PAYMENT PROCESSOR], who acts as an independent controller. We receive only a transaction reference and the last four digits of the card. Support correspondence and any logs or screenshots you send us Diagnosing your issue Legitimate interests [24] months Processor MAC address, serial number or licence key, if our licensing model requires activation Enforcing licence terms, issuing keys Contract Duration of licence + [12] months Website server logs: IP address, user agent, pages requested, timestamps Security, abuse prevention, availability Legitimate interests [30–90] days [Analytics identifiers, if used] Understanding site usage Consent [14] months Mailing list email address, if you subscribe Product and update announcements Consent Until you unsubscribe
6. A note on support requests
If you send us logs, configuration exports or screenshots to help diagnose a problem, they may contain your device names, room names, structure name, thermostat readings and — in some cases — OAuth tokens or client secrets.
Redact credentials before sending. If you do send us credentials, treat them as compromised and rotate them in your Google Cloud console afterwards. We will delete credential material from our correspondence on request and do not deliberately retain it.
7. Licence validation [delete this section if not applicable]
If our licensing model requires online activation, the Driver will transmit [the licence key, the processor MAC address or serial number, the Driver version, and a timestamp] to [ENDPOINT] at [installation only / each startup / every N days]. No thermostat data, Google credentials or personal data beyond the above is included. These records are retained for [PERIOD] and used solely to enforce licence terms and prevent duplicate activation.
8. Cookies
[If the site sets only strictly necessary cookies, say so plainly. If you use analytics, advertising or embedded video, list each cookie or category, its purpose and duration, name the provider, and obtain prior consent through a compliant banner with a genuine reject option. Link to a separate cookie policy if the list is long.]
9. Sharing and disclosure
We share the data in section 5 only with:
Processors acting on our instructions — [website host], [payment processor], [email/CRM provider], [invoicing/accounting], each bound by a data processing agreement;
Professional advisers — accountants, auditors, lawyers, under confidentiality;
Authorities, where required by law or to establish or defend legal claims;
An acquirer, in the event of a merger or sale of the business, subject to this policy.
We do not sell personal data and we do not share it for cross-context behavioural advertising.
10. International transfers
We are established in [JURISDICTION]. Some of our processors are located in [COUNTRIES]. Where personal data is transferred outside the [EEA/UK/your jurisdiction], we rely on [an adequacy decision / the EU Standard Contractual Clauses / the UK IDTA / equivalent safeguards]. A copy of the relevant safeguards is available on request.
Note separately that the Driver causes your thermostat data to be processed by Google under Google’s privacy policy and infrastructure, which may involve transfers outside your country. That processing is governed by your relationship with Google, not by us. See policies.google.com/privacy and the Google Nest privacy commitments.
11. Security
We apply [TLS on all web properties, encryption at rest for business records, access control and least privilege, multi-factor authentication on administrative accounts, and periodic review of processor arrangements].
On your side, the security of stored OAuth credentials depends on the physical and network security of your Crestron processor and on your Crestron Home administrative credentials. Secure the processor accordingly, restrict FTP/SFTP access, and rotate Google credentials if the equipment is decommissioned, sold or leaves your control.
12. Your rights
Subject to your jurisdiction, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal data; to object to or restrict processing based on legitimate interests; and to withdraw consent at any time.
To exercise a right, contact [PRIVACY EMAIL]. We will respond within [30 days / one month]. We may need to verify your identity. You may also lodge a complaint with your supervisory authority — in the [EU/UK] that is [AUTHORITY]; in [JURISDICTION] it is [AUTHORITY].
Because the Driver sends us nothing, we cannot access, export or delete data held on your processor or in your Google account. Those requests go to you as the system owner, and to Google respectively.
13. Roles where you install for a client
Where you are an integrator installing the Driver in a client’s home, you — not we — determine what data is accessed and configure the client’s Google credentials. You are the controller, or the client is, depending on your arrangement. You are responsible for informing the client of what is accessed and for obtaining any required consent. We act as neither controller nor processor of that data, since it never reaches us.
14. Children
The Driver and website are intended for professional installers and adult system owners. We do not knowingly collect personal data from children under [16].
15. Changes
We may update this policy. The current version, with its revision date, is at [URL]. Material changes will be [notified by email to registered licensees / announced on the product page [30] days in advance].
16. Contact
[COMPANY LEGAL NAME] [ADDRESS] Privacy enquiries: [PRIVACY EMAIL] [Data protection officer / EU or UK representative, if appointed: [DETAILS]]
