Privacy Policy

Last updated: 27 avril 2026

Pre-launch draft. The final version will ship for the Q3 2026 launch after GDPR / Quebec Law 25 review.

1. Introduction

This policy explains what personal data Kestrelia collects, why we collect it, how we protect it, and what your rights are. We follow GDPR (EU), PIPEDA (Canada), and Quebec Law 25. Data Protection Officer: privacy@kestrelia.com.

2. Data we collect

Account: email address, hashed password, optional name, preferred language. Alerts: search criteria you configure (routes, dates, budget, etc.). Usage: access logs, device type, truncated IP, notification events. Payment: handled by Stripe; we do not store card numbers. No sensitive data (health, biometrics, political opinions) is collected.

3. How we use data

We use your data only to: (a) operate the service (search flights matching your criteria, notify you), (b) secure your account, (c) bill you if you have a paid plan, (d) meet our legal obligations. We never sell your data. We do not show targeted advertising. We do not share your search criteria with third parties.

4. How we protect data

Data encrypted in transit (TLS 1.3) and at rest (AES-256). Hosted in North America (AWS Canada Central for the database). Passwords hashed with bcrypt. Semi-annual security audits scheduled from launch onward. Incident notification within 72 hours per GDPR Article 33.

Audience measurement

We measure traffic to our website and application using a tool we built ourselves, hosted on our own servers. No data is shared with any third party. This measurement sets no cookie and stores no marker on your device, which is why no consent banner is shown for it. We never retain your IP address: it is used only, for the duration of a single request, to compute an encrypted identifier that is regenerated every day and that we cannot subsequently link to anyone. We record the pages viewed, the site that referred you, the device type and the country. This detailed information is deleted after 90 days; only aggregate statistics, which concern no one in particular, are kept beyond that.

5. Your rights

You can at any time: (a) access your data from your dashboard or by emailing privacy@kestrelia.com, (b) correct inaccurate information, (c) request deletion of your account ("right to be forgotten"), (d) export your data in a structured format (JSON), (e) object to a processing operation, (f) withdraw consent to marketing notifications at any time. Maximum response time: 30 days.