Privacy statement

Last updated 18 October 2026

This statement explains how Kestrel Alert ("we", "us") handles personal data as a controller under UK data protection law (UK GDPR and the Data Protection Act 2018). Kestrel Alert is a trading name of M Fordy, sole trader, of Suite RA01, 195-197 Wood Street, London, E17 3NU. Contact for anything in this statement: info@kestrelalert.com.

What personal data we process, and why

Account data (you, our user)

• What: your email address, password (stored as a hash by our authentication provider, never readable by us), your watch list, and delivery records of the alerts we've sent you. We receive a notification of each new sign-up and can view account records in our internal tools, to run and support the service. Server logs are kept for 14 days.
• Billing: if you subscribe, your email and subscription details are held by Stripe, our payment provider; card details go directly to Stripe and never reach us.
• Why: to provide the service you signed up for. Lawful basis: performance of a contract.

Public-register data (company officers)

• What: information from public registers (Companies House filings and Gazette notices) can include the names (and occasionally other registered details) of company directors and officers.
• Why: to detect and describe significant company events for our users. Lawful basis: legitimate interests (helping businesses assess counterparty risk using information the law already makes public). We only process what the public registers publish, and any person can object (see "Your rights"). Separately, and only in the narrow case described under "Prospective customers" below, we use a director's name and business contact details to introduce our service to the company they run after one of its customers has become insolvent.

Prospective customers (business outreach)

• What: business names and business addresses taken from public insolvency records, such as Gazette notices and statements of affairs filed at Companies House (a statement of affairs lists an insolvent company's creditors). Where a listed creditor trades as a sole trader or partnership, that information can identify an individual. Where the creditor is an incorporated company, we also process the name and role of a current director, taken from the Companies House register, and a business email address for that person obtained from Hunter, a business email directory. We do not process home addresses, personal (non-work) email addresses, dates of birth, or any special category data for outreach.
• Why: to introduce our service to businesses recently affected by a customer insolvency, who are most likely to benefit from early-warning alerts. Lawful basis: legitimate interests (proportionate business-to-business outreach using information the law already makes public). Because we obtain these details from public registers and a directory rather than from you, we tell you so in the message itself, naming both sources, which is the notice required by Article 14 UK GDPR. Every such message includes a one-step way to opt out; if you opt out we add you to a suppression list and will not contact you again. We contact one named person per creditor company, once, about the specific insolvency that prompted it. We do not send unsolicited electronic marketing to sole traders or other individuals without consent, and we do not sell prospect data. To keep to that, before we contact a creditor company we check whether the creditor's name, as the statement of affairs lists it, is written as a private person's name. That check is made by TypeSafe, an AI service, and if the answer is yes we contact no one about that entry.
• How long: if you do not respond we keep the record only as long as needed to honour a later opt-out and to avoid contacting you again about the same filing. You can ask us to erase it at any time (see "Your rights"); an opt-out suppression entry is kept because deleting it would let us contact you again by mistake.
• If you open the link we sent you: our outreach messages contain a personalised link to a page about the insolvency that prompted the message. When that link is opened we record the time, the IP address the request came from, and the browser identification string the request carried, alongside the outreach record. We do this for one reason: most business mail systems automatically fetch every link in an incoming message to check it is safe, which looks identical to a person opening it, so without this we cannot tell whether anyone was actually interested. We do not use it to build a profile of you, we do not share it, and that page sets no cookies. Lawful basis: legitimate interests (understanding whether our own messages are of any use). It is erased with the rest of the outreach record on request.

Public insolvency pages

We publish a page for recent UK insolvencies, built from public filings: the insolvent company, the companies listed as its creditors with the amounts the filing gives, and the insolvency practitioner named in the notice. Individuals and sole traders listed as creditors are never named. Lawful basis: legitimate interests (helping suppliers find out whether they are owed money by an insolvent company, using information already public). Anyone named on a page can have their name removed by emailing info@kestrelalert.com; we do it without asking for reasons.

What we don't do

• We don't sell or share personal data for advertising.
• We don't use advertising or cross-site tracking cookies (see "Cookies").
• We don't make automated decisions with legal or similar effects about anyone.

Where your data lives

Your account and alert data are stored on Amazon Web Services in the London (UK) region, encrypted in transit and at rest. The text we send to the AI service that drafts alert summaries, and its replies, are logged for audit and quality in the same storage. Some of the providers below process data outside the UK; where they do, it is under UK-approved safeguards.

Analytics and performance monitoring

• Google Analytics 4: on our production website we use Google Analytics to understand how the site is used (pages visited, approximate location derived from your IP address, device and browser type). It only runs if you accept analytics cookies. Google acts as our processor; Google Analytics 4 does not log or store full IP addresses, and we don't use it for advertising. Google may process this data outside the UK under UK-approved safeguards. Lawful basis: your consent.
• Microsoft Clarity: if you accept analytics cookies, Clarity records how pages are used (clicks, scrolling and movement) so we can see where the site is unclear. Your watch list, company pages and account details are masked from those recordings, and it does not run on pages opened from a link in one of our emails. Microsoft acts as our processor. Lawful basis: your consent.
• Ahrefs Web Analytics: on our production website we use Ahrefs Web Analytics to count page views and see which sites and searches send visitors to us. It sets no cookies and stores nothing on your device, and we don't use it to identify you or for advertising. Ahrefs acts as our processor and may process this data outside the UK. Lawful basis: legitimate interests (understanding and improving the service).
• Amazon CloudWatch RUM: we collect page-load timings, web vitals and JavaScript errors from real visits so we can find and fix problems. On our production website it only runs if you accept analytics cookies; if you decline, we receive no RUM data from your visit. It runs inside the same AWS London hosting described above, uses a session identifier cookie, and is not shared with anyone else.
• Sentry: if the website hits an error, the error details and the page address are sent to Sentry so we can fix it. No IP address, cookies or account details are attached, and nothing is stored on your device, so it does not need your consent. Lawful basis: legitimate interests (keeping the service working).
• Google Search Console: we receive aggregated statistics from Google about the search queries that led people to this site. This involves no data collection on the site itself and nothing that identifies you to us.

How long we keep it

• Account data and watch lists: until you close your account or ask us to delete it.
• Alert and register history: kept as the record of what you were told and when; personal data in it is removed on a valid erasure request (below).
• Outreach records and opt-outs: kept so we never contact you twice; erased on request, except the opt-out entry itself, which is what stops us contacting you again.
• Messages you send us: in our email inbox until no longer needed, or deleted on request.
• Server logs: 14 days.
• Analytics, recordings and error reports: held by the providers above under their own retention settings.

Your rights

Under UK GDPR you can ask us for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests, including if you are a company officer whose name appears in the register data we process. Email info@kestrelalert.com; we respond within one month. We maintain a documented erasure procedure covering every store the data reaches, including archived copies, and a suppression step so erased data is not re-created by future register updates.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies and local storage

We ask for your consent before setting any analytics cookies. If you accept, Google Analytics sets cookies (names beginning _ga) to distinguish visits, CloudWatch RUM sets cookies (names beginning cwr) to group page views into a session and keeps an anonymous identifier and short-lived access credentials in local storage, and Microsoft Clarity sets cookies (names beginning _clck and _clsk). None of these starts until you accept. If you decline, none of them is stored and we receive no RUM or Clarity data from your visit. Ahrefs Web Analytics sets no cookies either way. None of them is used for advertising. When you sign in, authentication tokens are kept in local storage so you stay signed in; that is strictly necessary for the service. No ad trackers, ever.

Your choice is remembered in your browser. You can change it at any time with the button below; if you switch to declining, we delete the analytics cookies and stored data from your browser.

Alert emails

We send alert emails to the address on your account from info@kestrelalert.com. Deep links in those emails contain a signed token so you can open the relevant company page without logging in; treat alert emails like any other credential-bearing email and don't forward them.

Changes

We list every provider on this page and update the date at the top when anything changes. If we change how we use your data, for example for a new purpose, we will email account holders before it takes effect. See also our terms of service.