Legal

Privacy.

How we handle personal data on this marketing site. A full data-processing addendum applies once you become a Kestrel customer; talk to us for the latest version.

Effective date

Last updated 11 April 2026.

This policy covers the marketing website at onkestrel.com. It does not cover the Kestrel platform itself, which is governed by a separate processing agreement entered into when a firm signs as a customer.

Kestrel is built by OnKestrel Limited, a company registered in England and Wales. We are the data controller for any personal data you submit through this site.

What we collect

Only what you give us.

  • Waitlist submissions. One email address. Stored until you ask us to remove it. Used to notify you about launch and early-access invitations, and for nothing else.
  • Contact form submissions. Your name, work email, company, role, your stated interest, and the message you wrote. We use it to reply to you. If you tick the consent box, we also use it to send infrequent updates.
  • Operational metadata. A SHA-256 hash of your IP address (we never store the raw address) for rate limiting. Standard request logs that roll off after 30 days. No session recording. No advertising or cross-site tracking.
  • Analytics, with your consent. If you accept analytics on the cookie banner, we load Vercel Analytics and Vercel Speed Insights. These report which pages are visited and how fast they load. They do not fingerprint you, follow you across other sites, or build an advertising profile. If you reject or close the banner, nothing analytics-related loads at all.

Cookies

What we store in your browser.

  • Strictly necessary. kestrel-consentrecords your choice on the cookie banner so we don't ask again. onkestrel-theme stores your light or dark preference. An optional kestrel-preview cookie gates maintenance-mode preview. None of these identify you.
  • Analytics (opt-in). Vercel Analytics and Vercel Speed Insights are cookie-less by default and only load when you accept the banner. You can withdraw consent any time by clearing the kestrel-consent cookie in your browser settings — the banner will reappear on your next visit.

How long we keep it

Until you ask us to delete it.

We keep waitlist and contact submissions until you ask us to erase them, or until they go stale. We review the contact inbox every week. We delete anything older than 24 months without activity.

Operational logs roll off after 30 days. Hashed IPs cannot be reversed and stop being personal data once they leave a submission.

Your rights

Access, correction, erasure.

Under UK GDPR, you can ask us to confirm what we hold about you, correct it, erase it, restrict its processing, or export it in a portable format. Email hello@onkestrel.com with “data request” in the subject line. We respond within 30 days, usually within 48 hours.

If we cannot resolve a complaint to your satisfaction, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

Sub-processors

The people who help us run this site.

  • Vercel Inc. Hosts the website. Functions run in London (eu-west-2). With your consent, also provides Vercel Analytics and Speed Insights.
  • Supabase Inc. Stores waitlist and contact form submissions. Database is in London (eu-west-2).
  • Resend Inc. Sends confirmation and notification emails on our behalf.

We hold a data processing agreement with each of them. The current sub-processor list and the underlying agreements are available on request.

Changes

We will tell you when this changes.

We update this policy when we change how we handle personal data. The “Last updated” date at the top reflects the most recent change. If a change affects you, we will email you before it takes effect, where we have your address.

For anything else, write to us at hello@onkestrel.com.