Privacy Policy

This Privacy Policy explains how ANCL Labs LLC, a Florida limited liability company ("ANCL Labs," "we," "us"), collects, uses, and shares information when you use the Kestrel AIO desktop application (the "App"), the kestrel-aio.com website (the "Site"), and related services (together, the "Services").

1. Information We Collect

1.1 Information you provide

• Account and license information: email address, license key, subscription tier.
• Payment information: processed entirely by Stripe, Inc. We receive limited billing metadata (e.g., subscription status, last four digits of your card, billing country). We never receive or store your full card number.
• Support communications: messages you send us by email or Discord.

1.2 Information collected automatically — Site

• Analytics: we use Google Analytics 4 to collect usage data on the Site (pages viewed, approximate location derived from IP, device/browser type, referral source, scroll and interaction events). GA4 uses cookies and similar technologies. See Section 6 (Cookies).

1.3 Information collected automatically — App

• Operational telemetry: the App sends limited event data to our infrastructure (hosted on Supabase), such as task outcome events (success/decline/error, site module, timing), feature usage, error and crash diagnostics, App version, and license validation events tied to your license key.
• What the App does NOT transmit to us: your retailer account passwords, your payment card numbers, your billing profile details, and your proxy credentials are stored locally on your device and are used only to perform the checkout functions you configure. They are not transmitted to ANCL Labs' servers.

1.4 Information from third parties

• Stripe provides us subscription and payment-status information necessary to operate licensing.

2. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Services, including license activation and enforcement;
• Process payments and manage subscriptions;
• Send transactional communications (receipts, license and account notices, security alerts) via our email provider, Resend;
• Monitor performance, diagnose errors, and improve reliability and features;
• Understand aggregate usage of the Site to improve marketing and content;
• Detect and prevent fraud, license abuse, and violations of our Terms of Service;
• Comply with legal obligations.

Legal bases (EEA/UK users): performance of a contract (licensing, billing), legitimate interests (product reliability, fraud prevention, analytics), consent (where required, e.g., non-essential cookies), and legal obligation.

3. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

Each processor is bound by its own contractual and legal obligations regarding your data.

4. Data Retention

• Account and license records: retained while your account is active and for up to 7 years afterward as needed for tax, accounting, and dispute purposes.
• Telemetry and error events: retained up to 24 months, then deleted or aggregated.
• Site analytics: retained per our GA4 configuration (14 months).
• Support communications: retained up to 3 years.

5. Your Rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, restrict or object to certain processing, and withdraw consent.

• Florida residents (FDPA): Florida's Digital Bill of Rights provides certain rights against covered controllers. Regardless of statutory thresholds, we honor access, correction, and deletion requests from Florida residents.
• California residents (CCPA/CPRA): you have the right to know, delete, correct, and opt out of "sale" or "sharing." We do not sell or share personal information as defined by the CCPA. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
• EEA/UK residents (GDPR): you have the rights listed above plus the right to lodge a complaint with your supervisory authority. International transfers to the U.S. are safeguarded by standard contractual clauses maintained by our processors.

To exercise any right, email support@kestrel-aio.com. We will verify your request using your account email and respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights.

6. Cookies and Analytics Choices

The Site uses cookies for Google Analytics 4. You can control cookies through your browser settings, and you can opt out of GA4 via Google's opt-out tools (https://tools.google.com/dlpage/gaoptout). Where required by law, non-essential cookies load only after consent.

The App itself does not use advertising cookies or trackers.

7. Security

We use commercially reasonable technical and organizational safeguards: encryption in transit (TLS), access-controlled databases with row-level security, secret-scoped API keys, and least-privilege access to production systems. Sensitive checkout data (retailer credentials, card details, proxies) stays on your device. No system is perfectly secure; we cannot guarantee absolute security.

8. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

9. International Users

We are based in the United States and process data there. By using the Services from outside the U.S., you understand your information will be transferred to and processed in the U.S., where laws may differ from those in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy. Material changes will be posted at kestrel-aio.com/privacy with an updated effective date. Continued use after changes constitutes acceptance.

11. Contact

ANCL Labs LLC

Email: support@kestrel-aio.com