The short version
- We collect what we need to open and run your account: your name, email, account activity and a few answers you give at sign-up.
- Your password is never stored. We keep a one-way hash of it.
- We do not sell your information, and we do not use advertising cookies.
- You can ask for a copy of your data, ask us to correct it, or ask us to delete it.
- If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office.
This summary is here to help. The full text below is what applies.
1. Information we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, business or trading name | You, at sign-up |
| Login | A one-way (bcrypt) hash of your password; your session | You, when you sign up and log in |
| Account and transactions | Account numbers, balances, payments, Spaces and Tax pot | Created as you use your account |
| Plan and preferences | Your plan, notification choice, your answers to the sign-up questions | You |
| Technical | IP address (used briefly to limit repeated login and sign-up attempts), device and browser type | Your device |
2. How we use it, and our legal reasons
| What we do | Lawful basis |
|---|---|
| Open and run your account, process payments, show your balance and history | Performing our contract with you |
| Keep accounts secure, limit repeated login attempts, detect and prevent fraud | Legitimate interests (protecting you and us) and legal obligation |
| Answer your questions and handle complaints | Performing our contract; legitimate interests |
| Improve the app using your sign-up answers in aggregate | Legitimate interests |
| Keep records required by law | Legal obligation |
| Set optional cookies, if we ever use any | Your consent |
4. Sending data outside the UK
If a provider processes your data outside the UK, we make sure it is protected to UK standards, for example by using a country with UK adequacy regulations or the UK International Data Transfer Agreement.
5. How long we keep it
- Account and transaction records: for as long as your account is open, and then for up to six years after it closes, so we can meet our legal obligations and deal with any claims.
- Login sessions: up to 24 hours, or until you log out.
- IP addresses used to limit login attempts: held in memory for about a minute, never written to our database.
- If you start sign-up but do not finish, we do not keep what you typed.
6. How we protect it
- Passwords are hashed with bcrypt, so even we cannot read them.
- Your session is held in a signed, HTTP-only cookie that scripts on the page cannot read.
- Access to production systems is limited to staff who need it.
7. Your rights
Under UK data protection law you have the right to:
- get a copy of your personal information;
- have inaccurate information corrected;
- have your information deleted, where we no longer need to keep it;
- restrict or object to how we use it, including for direct marketing;
- receive your information in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, message us in the app or email us. We will reply within one month.
You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), although we would appreciate the chance to put things right first.
8. Children
Kestrelo accounts are for people aged 18 and over. We do not knowingly collect information about children.
9. Changes to this notice
We will update this notice when how we use your information changes, and tell you in the app if the change is significant.
10. Contact us
The quickest way to reach us is through chat in the Kestrelo app, 24 hours a day. You can also email support@example.com. Our postal address is shown at the bottom of every page.
Still have a question?
Chat to us in the app any time, or email support@example.com.