Privacy policy

Effective [date]

Kestrel shows website owners which companies receive their visitors' data. This page explains what Kestrel itself collects, why, who helps us run the service, and the choices you have. "Kestrel", "we" and "us" mean [legal entity name and state].

It covers kestrelprivacy.com, the Kestrel app at app.kestrelprivacy.com and the Kestrel consent service at consent.kestrelprivacy.com. If you're a visitor to a website that uses Kestrel's consent banner or data request form, see Kestrel's consent tools on other websites.

What we collect

When you run a free scan

The website address and your email address. We use your email to send you the results, to limit free scans to one per person, and to follow up with you about Kestrel's full report.
Your network address (IP address), in scrambled form. We keep a one-way scrambled version in a daily counter so one network can't run unlimited free scans. The counter deletes itself after about two days.

The scan itself

A scan visits the public pages of the website you name, using Kestrel's own browser, and records which companies that site sends data to and what it sends. It doesn't collect anything from that website's real visitors. Scan results are kept so you and Kestrel can view them later.

When you have a Kestrel account

Your email address and name, so you can sign in and so we know which customer's sites you can see.
If you sign in with Google, Google shares your name, email address and profile picture with us. See Google sign-in.
What you set up in the app: the sites you add, scans you run, and consent banner settings and images you upload.

When you ask about your scan

The app can explain a scan in plain English and answer questions about it. To do that, we send the scan's results and the question you type to our AI provider, which writes the answer. We keep a count of how many questions were asked, not the questions themselves.

Technical information

Like any website, our hosting provider receives basic technical information with each request, such as your IP address, browser type and the page requested, and uses it to deliver the site and protect it from attacks.

How we use it

To run scans, show results and send them to you.
To run your account and keep each customer's information separate.
To prevent abuse of the free scan.
To contact you about Kestrel, for example about the full report. You can ask us to stop at any time.
To fix problems and improve Kestrel.

We don't sell your personal information, and we don't share it for advertising. Our own pages carry no advertising or analytics trackers.

Who helps us run Kestrel

We use a few service providers. Each one receives only what it needs to do its job for us:

Cloudflare: hosting, storage and running scans.
Clerk: accounts and sign-in.
Resend: sending emails, such as your scan results.
Anthropic: the AI that explains scans and answers questions about them.
Google: only if you choose to sign in with Google.

We may also share information if the law requires it, to protect Kestrel or others from harm, or as part of a sale or merger of the business, in which case this policy would continue to apply to it.

Google sign-in

If you sign in with Google, we receive your name, email address and profile picture from Google. We use them only to sign you in and to show who is signed in. We store them with our sign-in provider, Clerk. We don't use them for advertising, we don't sell them, and we don't share them with anyone else except as described above. We don't ask for access to your Gmail, Drive, contacts or any other Google data. You can remove Kestrel's access at any time from your Google Account's security settings.

Cookies

kestrelprivacy.com itself sets no cookies. The Kestrel app uses cookies to keep you signed in. Our hosting provider may set a cookie to protect the site from bots. We don't use advertising or analytics cookies.

Website owners can add Kestrel's consent banner and data request form to their own sites. When you use those on someone else's website, Kestrel handles the information on behalf of that website's owner, to carry out their instructions:

Your privacy choices: what you allowed or refused, whether your browser sent a privacy signal (Global Privacy Control), the page, a random ID stored in your browser for that site, your general region, a shortened IP address and your browser type. This is kept as a record of your choice.
Data requests: if you ask a website for a copy of your data, or to delete or correct it, we record your email address, the type of request and anything you write, and email you a link to confirm it's you.

Questions about how that website uses your information should go to the website's owner. Their own privacy policy applies.

How long we keep information

Free scan records (website and email): until you ask us to delete them.
Scrambled network-address counters: about two days.
Account information: while your account is open. We delete it when you ask us to close it.
Consent tool records: as long as the website owner needs them, following their instructions.

Your choices

You can ask us for a copy of your personal information, or to correct or delete it. You can also ask us to stop contacting you. Email [contact email]; we'll reply within [time period]. We won't treat you differently for asking. Depending on where you live, you may have further rights under your state's privacy law. [Jeff / counsel: state-law wording, if any]

Security

We use access controls and encrypted connections, and each customer can see only their own sites. No system is perfectly secure, but we work to protect your information.

Children

Kestrel is for businesses and isn't directed to children under 13. We don't knowingly collect their personal information.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell account holders by email before it takes effect.

Contact

[legal entity name]
[mailing address]
[contact email]