Privacy Policy
Last Updated & Version: Version 2.0 (Effective Immediately).
This Privacy Policy explains how Kestrel Technologies Ltd. (“the Operator”, “we”, “us”, or “our”) collects, processes, stores, and protects personal data when you interact with the Kestrel platform, websites, and trading applications.
We take data protection and financial confidentiality seriously. We adhere to international privacy standards and zero-trust data minimization principles.
1. Personal Data We Collect and Why
| Category of Data | Specific Data Points | Lawful Basis & Purpose |
|---|---|---|
| Account Credentials | Email address, cryptographic password hash, OTP verification state | Contract performance; securing your account against unauthorized access. |
| Identity Verification | Full legal name, country of residence, age, proof-of-identity documents (if requested) | Legal and regulatory compliance; anti-money laundering (AML) and counter-terrorist financing obligations. |
| Brokerage Credentials (Managed) | MetaTrader 5 account login, server name, encrypted trading password | Contractual execution; placing automated algorithmic trades on your authorized brokerage account. |
| Blockchain Data | Cryptocurrency deposit and payout transaction hashes (TxIDs), public wallet addresses | Contract performance and audit trail; matching incoming capital and verifying payout requests. |
| Trading & Ledger Records | Deposit history, unit holdings, performance fee records, NAV valuations | Contract performance and financial reporting. |
| Legal Consent Records | Timestamps, IP verification, and versions of Terms and Risk Disclosures accepted | Legal compliance and evidentiary auditability. |
2. What We Do NOT Collect or Track
- No Third-Party Advertising Trackers: We do not deploy Google AdSense, Meta Pixel, cross-site trackers, or commercial advertising scripts.
- No Personal Data Sales: We never sell, rent, monetize, or trade client personal data to any third party under any circumstances.
- No Unnecessary Network Edge Logging: Network requests blocked by our firewall or bot protection systems are dropped without retaining personal IP logs.
3. Special Protections for Broker Credentials
Broker trading credentials represent sensitive data. We enforce rigorous institutional safeguards:
- Encryption at Rest: Trading passwords are encrypted using industry-standard symmetric encryption (AES-256-GCM) with master keys stored securely server-side.
- Zero Browser Exposure: Trading passwords are never transmitted back to any client browser or API endpoint once submitted.
- Trade-Only Technical Scope: The software API bridge is technically restricted to order creation, trade modification, and position closure. It possesses zero withdrawal or fund-transfer capability.
- Instant Revocation: You can disconnect and permanently purge your broker credentials from our database with a single click from your member dashboard.
4. Third-Party Service Providers and Processors
To deliver our high-reliability services, we partner with trusted institutional infrastructure providers who process data strictly on our instructions:
- Cloud Hosting & Database: Supabase / Amazon Web Services (AWS) for encrypted database storage and serverless computing.
- Blockchain RPC Providers: Public and private node infrastructure (such as Binance Smart Chain and Tron networks) to monitor deposit transaction confirmations.
- Brokerage Execution APIs: MetaTrader / Exness execution bridges for managed trading clients.
5. Data Retention Periods
- Financial & Transaction Records: Retained for a mandatory minimum of five (5) years following account closure to satisfy international statutory anti-money laundering and tax accounting regulations.
- Broker Credentials: Retained only for the active duration of your subscription, or until you click Disconnect, or upon prolonged inactivity.
- Account Profile & Consent Logs: Retained for the active lifetime of your account plus the statutory regulatory retention window.
6. Your Legal Data Rights
Subject to applicable data protection laws, you possess the right to:
- Access: Request confirmation and an export copy of personal data maintained about you.
- Rectification: Request correction of inaccurate or incomplete personal records.
- Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to our overriding legal and regulatory obligations to retain statutory financial transaction records.
- Restriction: Request restriction of processing under specific contestation circumstances.
- Withdraw Consent: Withdraw consent for optional processing features at any time.
To exercise any of these rights, submit a formal request to our compliance team at: support@kestrelgrow.site.
7. Information Security Measures
We implement defense-in-depth security standards:
- All web and API traffic is enforced over TLS 1.3 encryption with HTTP Strict Transport Security (HSTS).
- Database access is governed by strict Row-Level Security (RLS) policies ensuring users can only read their own records.
- Optional Two-Factor Authentication (OTP) to safeguard member logins.
8. Amendments to this Privacy Policy
We may amend this Privacy Policy periodically to reflect technological, operational, or legal developments. The updated version number and date will be stated at the top of this document. Continued use of our Platform signifies your acknowledgment of the updated policy.
9. Data Controller & Inquiries
The data controller responsible for your personal data under the laws of Saint Vincent and the Grenadines is:
Kestrel Technologies Ltd.
Jurisdiction: Saint Vincent and the Grenadines
Official Compliance Email: support@kestrelgrow.site