Privacy Policy

Kestrel (“we”, “us”) provides an AI-assisted job search service for startup roles. The data controller is Matteo Midena EI, a French sole proprietorship (SIRET 929 483 030 00011), 14 rue de Moscou, 75008 Paris, France. For any privacy question or request, contact hello@kestreljobs.com. This English version is provided for convenience; the French version prevails.

• Account data: your name, email address and profile picture from Google sign-in.
• Profile data you provide: headline, location, target roles and locations, GitHub username, LinkedIn URL, uploaded resumes and the content of your portfolio.
• Activity in the product: saved jobs, your application board, assistant conversations, outreach drafts and the credits you use.
• Gmail data, only if you connect Gmail. See the dedicated section below.
• Billing data: handled by Stripe. We store your Stripe customer and subscription identifiers and your plan status, never your card number.
• Messages you send us through the contact form.
• Technical data: standard server logs (IP address, browser, timestamps) kept for security and debugging.

Kestrel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Gmail is optional and separate from signing in. When you connect it, we request two permissions:

• Read-only access (gmail.readonly), used to find emails about job applications you have made, such as application confirmations, interview invitations, assessments, offers and rejections. We use the sender, subject, date and text of those messages to create and update cards on your application board. Messages that are not about a job application are skipped and their content is not stored.
• Send access (gmail.send), used only to send outreach emails that you have reviewed and explicitly approved, one by one, from your own address. We never send an email without your approval.

Specifically, for data obtained through Google APIs:

• We use it only to provide and improve the user-facing features described above.
• We do not use it for advertising, and we do not sell it or transfer it to data brokers.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.
• When we send application email text to an AI provider to classify it (for example, “is this an interview invitation?”), the provider processes it only to return the result to us, under terms that do not allow it to train on the data.
• No person at Kestrel reads your email, except with your explicit permission for a specific message (for example, when you ask us to investigate a problem), when required for security purposes, or to comply with the law.
• OAuth tokens are encrypted at rest (AES-256-GCM) and are never written to logs.

Disconnecting and deletion. You can disconnect Gmail at any time from Settings. Disconnecting revokes our access at Google and deletes the stored tokens immediately. Deleting your account also deletes all Gmail-derived data (application records and stored email excerpts). You can also remove Kestrel's access from your Google Account's security settings.

To help users reach the right person, Kestrel keeps the professional contact details of startup founders and recruiters (name, role, company, work email), taken from companies' public websites and from Hunter.io; some addresses are inferred from the company's email format and then verified. We never collect data from LinkedIn. We rely on legitimate interest. Messages are written and sent by candidates themselves, from their own address, in limited numbers, and every message has an unsubscribe link: one click stops all Kestrel users from emailing you through the service. You can also write to hello@kestreljobs.com to access, correct or delete your data or to object. Contact details are kept for at most three years after their last use; after an objection, we keep only your address on a suppression list so we can honour it.

• To match you with roles and explain the match.
• To keep your application board up to date.
• To generate resumes, portfolios, outreach drafts and assistant answers you ask for.
• To run billing and credits, prevent abuse and keep the service secure.
• To reply when you contact us.

Where the GDPR applies, we rely on the performance of our contract with you for the above, on your consent for connecting Gmail (which you can withdraw by disconnecting), and on our legitimate interest in securing the service.

We share data only with service providers that help us run Kestrel, under contracts that limit their use:

• Vercel (hosting, United States) and Supabase (database, servers in Ireland).
• Anthropic, to run AI features; prompts are processed to return a result and are not used to train models.
• Stripe, to process payments.
• Google, for sign-in and, if you enable it, Gmail.
• Resend, to forward contact-form messages to us.
• Hunter.io, to find and verify professional email addresses.
• GitHub, to read your public profile if you provide your username.

Your public portfolio, if you publish one, is visible to anyone with the link. Visitors can ask its assistant about the content you chose to include. We may disclose data when required by law.

We keep your data while your account is open. You can delete your account at any time in Settings: we cancel any active subscription, revoke Gmail access and delete your account and associated data from our database. Backups roll over within 30 days. Billing records that we must keep by law are retained by Stripe.

Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority (in France, the CNIL). Write to hello@kestreljobs.com and we'll respond within one month. Transfers to providers in the United States rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We use only the cookies needed to keep you signed in and secure. Your theme preference is stored in your browser. We don't use advertising or cross-site tracking cookies.

If we make material changes, we'll tell you by email or in the app before they take effect. The date at the top shows the latest revision.