Privacy policy
Last updated 2026-05-29, version 0.4.
1. What this policy covers
This policy describes how 123 Innovations Studio Private Limited (operating Kestrel) collects, uses, stores, and shares data about (a) visitors to kestrel.in, (b) registered users of the Kestrel application and API, and (c) data principals whose business information appears in the Kestrel company graph.
2. Data we collect about visitors
We use Plausible for privacy-respecting analytics. Plausible does not use cookies, does not collect personal data, and does not track across sites. Aggregate page-view counts are stored.
3. Data we collect about registered users
On signup we collect your email, name, and the organization you join. If you sign in with Google we receive your email, name, and profile photo. We store cryptographically hashed session tokens, never raw passwords. Billing and tax data are stored by Razorpay and we hold the customer reference only.
4. Data in the company graph
The graph holds public company and director data from statutory registries and self- published business websites. Personal data (director name, DIN, designation) appears only where it is part of a registry filing made public by legal mandate (DPDP Section 3(c)(ii)). The full source-by-source map is on the data sourcing policy.
5. How we use data
Visitor analytics, to improve the site. User account data, to run your account. Graph data, to provide the search, signal, and API features of the product. We do not sell personal data to third parties. We do not show ads.
6. Sharing
We share data with sub-processors (Hostinger for hosting, Razorpay for billing, Resend for email, Anthropic for AI features, Backblaze B2 for backups). Each is named, with location and purpose, in the sub-processor table on /security. We share data with law enforcement only when compelled by court order.
7. Retention
Account data is retained while your account is active and for 24 months after closure for tax and audit purposes. Graph data is retained continuously, with erasure available to any data principal via DPDP request. Audit logs are retained for 60 months.
8. Your rights
Under the DPDP Act, 2023, you have the right to access, correction, erasure, and grievance. File a request via /optout. The grievance officer is named on /grievance.
9. Children
Kestrel is not directed at individuals under 18. We do not knowingly collect data about children.
10. Changes
We post material changes here with a dated entry. Continued use after a posted change constitutes acceptance.
11. Contact
Privacy: dpo@kestrel.in. Grievance: grievance@kestrel.in. Postal: 123 Innovations Studio Private Limited, Bhubaneswar 751024, Odisha, India.