Privacy Policy
Last updated: 1 June 2026.
Alves Rowe Ltd ("Alves Rowe", "we", "us") respects your privacy. This Privacy Policy explains what personal data we collect when you use Kestrel™ and the Kestrel marketing site at takeoff.alvesrowe.com, why we collect it, who we share it with, how long we keep it, and your rights under UK data protection law (the UK GDPR and Data Protection Act 2018).
If you've enabled the optional AI integration in Kestrel, also see our separate AI integration (BYOK) privacy notice which describes what flows directly to Anthropic when you use AI features. It is delivered in-app the first time you enable AI and is also available on request from info@alvesrowe.com.
1. Who we are
Alves Rowe Ltd is the data controller for the personal data described in this Policy. We are a company registered in England and Wales (Companies House number 16682818), with registered office at 44 Belmore Road, Eastbourne, BN22 8BL. Our VAT registration number is GB 520 3368 24. Contact: info@alvesrowe.com.
2. What stays on your machine (not collected by us)
Kestrel is a local desktop application, not a cloud service. All your project data lives on your own Windows machine as .qtdb files. We do not see, store, transmit or process:
- the PDFs you load into Kestrel
- the measurements, finishes, zones, quantities or exports you create
- the file names, project names or any content of your projects
This is by design.
3. What we collect, why and on what lawful basis
| What | Why we collect it | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Email address you provide on subscription | To send your activation key and service emails (billing, expiry, important updates, notice when the beta ends) | Contract (necessary to provide Kestrel) |
| Email and name, if you tick "email me occasional Kestrel updates" when you sign up | To send occasional product updates and news. Every such email carries a one-click unsubscribe, and you can opt out at any time | Consent (which you can withdraw at any time) |
| Activation key and machine fingerprint | To bind one licence per machine, prevent key sharing, support transfer to a new machine | Contract |
| Payment information (collected by Stripe; we receive a billing reference, not your card number) | To process subscription payments | Contract |
| Anonymised crash reports (stack traces, app version, OS version) via Sentry | To detect and fix software bugs; reports never include your project data | Legitimate interest (improving product stability) |
| Feedback messages (opt-in, when you click Send Feedback) | To address support requests and improve Kestrel | Consent (you click Send) |
| Beta-access request form data (name, email, company, role, message) | To evaluate and respond to beta-access requests | Consent (you submitted the form) |
| Marketing site server logs (Cloudflare) | Site operation, security, abuse prevention | Legitimate interest |
Our site analytics (Cloudflare Web Analytics) are cookieless and do not profile you. We also set optional advertising cookies, which let us measure how well our ads work. They never load unless you accept them, rejecting them costs you nothing, and we honour Global Privacy Control signals automatically. Our cookie policy names every advertising partner we currently use and lets you change your choice at any time.
The Kestrel desktop app keeps only essential settings and your licence locally on your device; these never leave your machine and are not analytics or advertising cookies.
4. Sharing with third parties (our processors)
To run Kestrel and its supporting services, we share limited data with the following processors:
- Cloudflare (Workers, Pages, R2, D1) - hosts our licensing Worker, marketing site, installer downloads and licensing database. cloudflare.com/privacypolicy.
- Stripe - payment processing. Collects and processes card details; we receive only a billing reference. stripe.com/privacy.
- Postmark - transactional email (activation, billing, beta notifications). postmarkapp.com/eu-privacy.
- Sentry - anonymised crash reporting. sentry.io/privacy.
- Anthropic - only if you have enabled the optional BYOK AI features in Kestrel and supplied your own Anthropic API key. The relationship is between you and Anthropic; we sit outside the path. See the AI integration privacy notice referenced above. anthropic.com/legal/privacy.
- Advertising partners - only if you accept advertising cookies. They tell us how many people who saw one of our ads went on to download or subscribe. Each acts as an independent controller for that data, not as our processor. Our cookie policy names every partner currently in use and links its privacy policy.
We do not sell, rent or share your personal data with anyone else.
5. International transfers
Some of our processors are based outside the UK or process data outside the UK. Where this happens, we rely on:
- the UK's adequacy decisions where applicable
- Standard Contractual Clauses together with the UK International Data Transfer Addendum where adequacy doesn't apply (e.g. transfers to the United States via Stripe, Postmark, Sentry and Anthropic, and via our advertising partners where you have accepted advertising cookies)
6. How long we keep your data
- Subscription / customer data (email, activation key, billing reference): for the duration of your subscription plus 6 years afterwards, to meet UK tax and Companies Act record-keeping requirements
- Crash reports: 90 days, then deleted automatically
- Feedback messages: up to 2 years, unless we need them longer to resolve an ongoing support case
- Beta-access requests: 12 months from submission, unless you become a customer (in which case they're folded into your subscription record)
- Server logs: 30 days
You can request earlier deletion of your data at any time (see section 7).
7. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Access: ask for a copy of the personal data we hold about you (Article 15)
- Rectification: ask us to correct inaccurate or incomplete data (Article 16)
- Erasure: ask us to delete your data ("right to be forgotten"), subject to legal obligations to retain (Article 17)
- Restriction: ask us to limit how we use your data (Article 18)
- Portability: receive your data in a machine-readable format (Article 20)
- Objection: object to processing based on legitimate interests (Article 21)
- Withdraw consent: where we rely on consent, you can withdraw it at any time, without affecting processing already carried out (Article 7)
To exercise any of these rights, email info@alvesrowe.com. We aim to respond within one month; for complex requests we may extend this to three months and will tell you if we do.
You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
8. Children
Kestrel is a B2B tool for construction estimators and is not directed at children under 18. We do not knowingly collect personal data from children.
9. Changes to this Policy
We may update this Policy from time to time. The "Last updated" date at the top will show when. For material changes affecting existing subscribers, we'll notify you by email at least 30 days before the change takes effect.
10. Contact
Privacy questions, data subject rights requests, or anything else: info@alvesrowe.com.
Alves Rowe Ltd, registered in England and Wales (Companies House number 16682818). Registered office: 44 Belmore Road, Eastbourne, BN22 8BL. VAT No. GB 520 3368 24.