Kestrel
Legal

Privacy Notice

Effective Date: 1 July 2026Last Updated: 1 July 2026
Last Updated: 1 July 2026
Download DOCX

Kestrel Insights Limited, a company registered in England and Wales under company number 17310900 ("Kestrel Insights", "we", "our", "us") respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, store, and protect personal information when you use Kestrel, Strix, our website, applications, APIs, dashboards, reports, and related services (collectively, the "Service").

This Privacy Notice is intended to comply with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation ("EU GDPR").

Data Controller:

Kestrel Insights Limited (Company Number 17310900)

Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.

Email: support@kestrel-insights.com

Website: www.kestrel-insights.com

For any privacy-related enquiries, requests, or complaints, please contact us using the details above.

We may collect the following categories of personal data.

Information You Provide

When using the Service, you may provide:

  • name
  • email address
  • company name
  • job title
  • organisation
  • contact information
  • account details
  • messages submitted through contact forms
  • correction requests
  • feedback submissions
  • support requests
  • survey responses

Technical Information

We may automatically collect:

  • IP address
  • hashed IP address
  • browser type
  • browser version
  • operating system
  • device identifiers
  • referral URLs
  • pages visited
  • date and time of access
  • user agent information
  • session information
  • cookie identifiers

Account Information

Where accounts are available, we may collect:

  • username
  • encrypted authentication credentials
  • subscription status
  • usage history
  • acceptance of Terms of Use

Kestrel and Strix primarily process publicly available corporate information.

This information typically relates to companies, assets, projects, disclosures, reports, and publicly available business activities.

The Service is not designed to process special category personal data.

Users should not submit sensitive personal information through the platform.

We use personal data to:

  • provide and operate the Service
  • create and manage user accounts
  • respond to enquiries
  • provide customer support
  • process subscriptions and payments
  • improve platform functionality
  • improve Kestrel methodologies
  • improve Strix extraction accuracy
  • review correction requests
  • maintain security
  • prevent abuse and fraud
  • comply with legal obligations
  • maintain audit records
  • communicate product updates

We process personal data under one or more of the following lawful bases:

Contract

Where processing is necessary to provide the Service.

Legitimate Interests

Including:

  • operating and improving the Service
  • maintaining security
  • preventing fraud
  • improving analytical methodologies
  • understanding product usage

Legal Obligations

Where required by law, regulation, court order, or governmental authority.

Consent

Where consent is specifically requested, such as for marketing communications.

You may withdraw consent at any time.

We use only strictly necessary and authentication cookies, which are essential to operate and secure the Service and to keep you signed in.

We do not currently use analytics, advertising, or other non-essential cookies. If we introduce non-essential cookies in future, we will, where legally required, request your consent before placing them.

You may manage cookies through your browser settings, although disabling essential or authentication cookies may prevent parts of the Service from working. Please see our Cookie Notice for further detail.

We do not sell personal data.

We may share information with trusted third-party sub-processors that help us operate the Service, including:

  • Clerk — authentication and user management.
  • Vercel — application hosting, deployment, and related infrastructure.
  • Neon — database hosting and related infrastructure.
  • Stripe — payment processing and billing.
  • Analytics provider — website and product analytics (provider to be confirmed; not currently in use).

These providers process personal data only for the purposes of providing services to us.

We may update this list of sub-processors from time to time as our providers change. Any replacement or additional sub-processors will be engaged only where appropriate contractual, security, and data-protection safeguards are in place.

We may also disclose information where required by law.

Some service providers may process data outside the United Kingdom or European Economic Area.

Where international transfers occur, we take reasonable steps to ensure appropriate safeguards are in place, including:

  • adequacy decisions
  • standard contractual clauses
  • equivalent legal safeguards

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, while preserving flexibility where a longer period is required for legal, accounting, tax, security, dispute-resolution, or regulatory reasons.

Our indicative retention periods are:

  • Account data — retained for the life of the account, then up to 12 months after closure or last activity, unless a longer period is required for legal, tax, accounting, security, or dispute-resolution purposes.
  • Customer, billing, invoice, and transaction records — retained for up to 6 years after the relevant financial year or transaction, for accounting, tax, audit, and company record-keeping purposes.
  • Subscription and licence records — retained for the life of the customer relationship, then up to 6 years where needed to evidence contractual rights, payment history, licence scope, usage rights, or disputes.
  • Support, feedback, and enquiry records — retained for up to 24 months after the last interaction, unless needed for an ongoing relationship, dispute, product-improvement record, or legal reason.
  • Marketing contact data — retained until you unsubscribe or opt out, or until the data is no longer reasonably required for B2B marketing purposes, subject to periodic review.
  • Product usage, access, audit, and security logs — retained for up to 12 months, unless a longer period is needed to investigate misuse, security incidents, unauthorised access, scraping, redistribution, or breach of these Terms.
  • Analytics and cookie data — retained in accordance with the relevant cookie, analytics, or consent settings, and anonymised or deleted when no longer required.
  • Free-tier and sample-access data — retained while the account or access remains active, then up to 12 months after last activity or closure.
  • Bespoke project files and deliverables — retained for up to 6 years after project completion where needed to evidence contractual performance, licence terms, billing, client instructions, or disputes.
  • Legal claims, complaints, and dispute records — retained for as long as reasonably necessary to establish, exercise, or defend legal claims.

Where possible, personal data is deleted, anonymised, or aggregated when it is no longer needed for the purpose for which it was collected.

We implement reasonable technical and organisational measures designed to protect personal data.

These measures may include:

  • encryption
  • access controls
  • authentication controls
  • security monitoring
  • audit logging
  • secure hosting environments

No method of transmission or storage can be guaranteed to be completely secure.

Subject to applicable law, you may have the right to:

  • access your personal data
  • correct inaccurate data
  • request deletion of data
  • restrict processing
  • object to processing
  • request data portability
  • withdraw consent
  • lodge a complaint with a supervisory authority (in the UK, the Information Commissioner’s Office — ico.org.uk)

Requests may be submitted to:

support@kestrel-insights.com

We may require verification of identity before responding.

Where permitted by law, we may send:

  • product updates
  • service announcements
  • research updates
  • marketing communications

You may unsubscribe at any time using the unsubscribe link included in communications or by contacting us directly.

The Service is not intended for individuals under the age of 18.

We do not knowingly collect personal information from children.

The Service may contain links to third-party websites.

We are not responsible for the privacy practices, content, or security of third-party websites.

Users should review the privacy notices of those third parties separately.

We may update this Privacy Notice from time to time.

The latest version will always be published on the website.

Continued use of the Service following updates constitutes acknowledgement of the revised Privacy Notice.

Privacy enquiries:

support@kestrel-insights.com

General enquiries:

hello@kestrel-insights.com

Website:

www.kestrel-insights.com

By using Kestrel, Strix, or any related service, you acknowledge that you have read and understood this Privacy Notice.

Questions? Contact us