Privacy policy

What we collect

• Account: name, email, scrypt password hash, locale and sign-in times.
• Workspace: organization name, member roles, plan and usage.
• Project: site URLs, findings, crawled pages, keywords and generated content.
• Technical: IP address (rate limiting and security; hashed for public audit records), user agent, audit events.
• Communication: messages you write in the contact form or a ticket.

Why we collect it

To deliver the service, run audits, enforce plan limits, prevent abuse, answer support requests and meet legal obligations. We do not sell data and do not train models on your data without authorization.

Crawled site data

Only public pages are crawled. Crawled content is treated as untrusted data: it can never change system instructions, access tools or reveal secrets. Pages behind authentication are not crawled, and private networks, localhost and cloud metadata endpoints are blocked.

Retention and deletion

• Crawled page content is retained for up to 90 days unless the project remains active.
• Free public audits expire after 7 days.
• Deleting an account removes or anonymizes identifying data; tax and audit records are kept only as required.
• Export: request a JSON export of your projects by email.

Processors and transfers

Depending on your configuration, data may be processed by a payment provider (Stripe), an AI provider whose key you supply, and your chosen hosting provider. The current subprocessor list is in the data processing addendum. International transfers rely on appropriate safeguards.

Security

Passwords are hashed with scrypt, integration credentials are encrypted with AES-256-GCM, sessions are httpOnly and SameSite, access is role-based and sensitive actions are audited. No system is perfect; report vulnerabilities to hello@kestralia.com.

Your rights

Access, correction, deletion, restriction, objection and portability. Email hello@kestralia.com. If you are in the EEA/UK, you may also complain to your supervisory authority.

Cookies

Session cookie (essential), locale cookie and workspace cookie. The product uses no advertising cookies or third-party trackers.