Privacy policy
Last updated October 9, 2026
Kestrel CEO is an invitation-only dashboard for business owners and their teams. It brings a business's marketing, sales and financial data into one place. This policy explains what we collect, why, and what you can ask us to do with it.
What we collect
- Your account: when you sign in with Google, we receive your name, email address and profile picture. We use them only to identify you and decide what you can see.
- Your business's data: information from services your business connects, such as ad accounts, Instagram, booking tools, payment processors, attribution tools, accounting software, and bank or card accounts. This includes campaign results, bookings, customers, payments, refunds and transactions.
- Connection credentials: API keys and access tokens for the services above. They are encrypted before they are stored.
- Changes you make: edits such as relabelling a transaction, with who made them and when.
How we use it
Only to run the dashboard for the business that connected it: to show its numbers, calculate reports and payouts, send the alerts and summaries it has asked for, and keep the service secure. We do not sell personal data, and we do not use it for advertising.
Some summaries and analysis are produced with an AI model. The data sent to the model is limited to what that summary needs, and the model provider does not use it to train its models.
Who can see it
A business's data is visible only to the people that business has invited, and only to the extent their role allows. Our team accesses it only to provide and support the service.
We rely on these providers to run the service:
- Vercel, for hosting
- Neon, for the database
- Google, for sign-in
- Anthropic, for AI summaries
Google user data
Kestrel CEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
For as long as the business uses Kestrel CEO. When a business leaves, or asks us to, we delete its data, except where we must keep a record by law.
Your choices
You can ask to see, correct or delete your personal data, or to have your account removed. A business owner can disconnect any service at any time, which stops further data from being collected from it.
Contact
Questions or requests: thomas@cobley.co