Legal
Privacy Policy
Last updated: July 3, 2026
This Privacy Policy explains how KestrelFi, Inc. (“KestrelFi”, “we”, “us”) collects, uses, and shares information when you use our websites, applications, and services (the “Service”). We treat portfolio and financial information as sensitive and handle it accordingly.
1. Information We Collect
We collect the following categories of information:
- Account information — name, email, and authentication details when you create an account or sign in.
- Application information — details you submit through early-access or contact forms, such as name, email, phone (optional), social handle (optional), portfolio size, and investment approach.
- Portfolio & holdings data — positions, transactions, balances, and related data you upload or that we retrieve when you connect an account.
- Connected-account data — when you link a brokerage account through our aggregation provider, we receive read-only account and holdings information; we do not receive your brokerage login credentials.
- Usage & device data — interactions with the Service, log data, IP address, browser and device information, collected to operate and secure the Service.
2. How We Use Information
We use information to:
- Provide, maintain, and improve the Service, including analytics, briefings, and AI features;
- Authenticate you and secure your account;
- Generate portfolio-aware analysis, risk metrics, and AI summaries you request;
- Communicate with you about early access, support, and product updates;
- Monitor, debug, and protect against fraud, abuse, and security incidents; and
- Comply with legal obligations.
3. How We Share Information
We do not sell your personal information, and we do not sell your financial or portfolio data. We share information only as needed to operate the Service, with the following categories of service providers (subprocessors), who are permitted to use it only to provide services to us:
- Clerk — User authentication and account management.
- SnapTrade — Secure, read-only connection to your brokerage accounts (when you choose to connect one).
- OpenAI — AI-generated analysis, summaries, and chat responses (queries may include portfolio context).
- Resend — Transactional email delivery (early-access application and onboarding emails).
- Railway — Cloud hosting and database infrastructure.
- Axiom — Application logging and operational monitoring.
We may also disclose information to comply with law, enforce our agreements, protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).
4. AI Processing
When you use AI features, your queries — which may include portfolio context — are processed by our AI provider to generate a response. We do not permit your inputs or outputs to be used to train the provider’s publicly available models. Do not submit information to AI features that you do not wish to be processed for this purpose.
5. Financial Data
Brokerage connections are established through a third-party aggregation provider and are intended to be read-only; we do not execute trades or move funds. We use your financial and portfolio data to provide the analytics and features you request and do not sell it. You may disconnect a linked account or request deletion of your data at any time.
6. Data Retention
We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. When information is no longer needed, we delete or de-identify it.
7. Data Security
We use administrative, technical, and organizational measures designed to protect information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your Rights & Choices
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. Residents of California (under the CCPA/CPRA) and other jurisdictions may have additional rights, including the right to know what we collect and the right to opt out of “sale” or “sharing” — which we do not do. To exercise any right, contact us using the details below. We will not discriminate against you for exercising your rights.
9. Cookies & Tracking
We use cookies and similar technologies for authentication, to remember preferences, and to understand how the Service is used. You can control cookies through your browser settings; disabling some cookies may affect functionality.
10. Children's Privacy
The Service is not directed to individuals under 18, and we do not knowingly collect personal information from them. If you believe a minor has provided us information, contact us and we will delete it.
11. International Users
We are based in the United States and process information there. If you access the Service from outside the United States, you understand your information may be transferred to and processed in the United States, which may have different data-protection laws than your jurisdiction.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice.
13. Contact
Questions or requests regarding your privacy? Contact us at [email protected].