Pre-authorisation draft · Version 2026-09-26-v0.3 · Updated 26 September 2026
Privacy and cookies
This notice describes the current website, fictional demonstrations and private workspace. The provider and data-controller details below remain outstanding.
Controller and contact awaiting verification. The operator’s legal name, address and monitored privacy contact have yet to be confirmed. These are required privacy details, including for information already held. Real self-registration is disabled by default pending launch approval. Use fictional information in the public demo and avoid submitting real confidential or sensitive material while these details remain outstanding.
1. Who is responsible
Kestrel is the proposed service brand. The legal entity operating this website, its registered or correspondence address and a privacy contact must be identified here before real registration opens. A data-protection officer will be identified if one is appointed or required. An ICO fee registration must be assessed and any published number verified.
For a company’s public Legal Centre, that company must explain its own data-controller role and contact details at the collection point. Kestrel’s role in its legal work and any hosted administrative functions must be documented for the actual engagement. A company complaint may be seen by that company and the team acting for it.
If you already have a private account, use the verified person who arranged it to raise a privacy concern. A dedicated monitored route remains to be published. The ICO’s complaint route remains available.
2. Information the system handles
| Information | What is recorded |
|---|---|
| Accounts and onboarding | Name, email, company name and a protected password record for a real account. Onboarding can include company number, address, jurisdiction, industry, company size, legal needs, phone, website and additional authorised contacts. It records account-term acceptance, privacy acknowledgement, authority confirmations, document versions, dates, progress and staff review. The fictional onboarding demo uses simulated acknowledgements. |
| Matters and documents | Instructions, facts, parties, deadlines, messages, files, agreement fields, draft versions, review decisions and case history entered by users or staff. |
| Voice and AI intake | Audio during a live call, typed conversation, AI responses, selected document content and unreviewed briefs. A transcript and documents can be saved to a matter when the intake is confirmed. |
| Email and public enquiries | Manually imported or simulated email, sender and recipient details, subject, content, attachments, message references and thread information. A company’s public form collects contact details and the submitted message. |
| Billing and administration | Company plans, invoice records, amounts, payment records entered by staff and references used for manual reconciliation. Card payments are not collected by the current application. |
| Technical records | Session identifiers, account and staff action records, voice call identifiers and usage limits. The host may process network, request and security logs. |
| Earlier website records | Earlier callback requests, typed legal intake, meetings and lawyer applications held separately from the current demonstration. |
Information comes from you, authorised company users, the people communicating about a matter and files they provide. Files may contain information about employees, customers, witnesses, counterparties or other people. Supply only what is needed and what you have authority to share. The current service is intended for business users.
3. Purposes and legal bases
The system uses this information to create access, assess onboarding, organise requests, prepare and review work, maintain version history, publish authorised company documents and keep billing and security records. The demo illustrates those functions with fictional information. Creating an account does not itself accept legal instructions.
The operator must approve and publish a purpose-by-purpose lawful-basis assessment. The proposed assessment covers:
- Account administration and business enquiries: assess legitimate interests in responding, operating the service and managing business relationships, including the impact on individuals. Contract necessity may apply where the individual is the contracting person.
- Accepted legal work: identify the bases relevant to the particular client, individuals and purpose. Any legal-obligation basis must identify the applicable obligation.
- Security, fraud prevention, complaints and records: assess the relevant legitimate interests and any statutory or professional recordkeeping duties.
- Optional uses that rely on consent: explain the choice and withdrawal route separately before starting that use.
Health, other special-category information and criminal-offence information require an additional applicable condition or authority. That assessment must precede processing. A privacy acknowledgement confirms that the notice was presented. Browser microphone permission enables microphone access. Neither supplies a blanket legal basis for every use of personal data.
4. Voice and AI document reading
When you start an OpenAI real-time call and allow the microphone, audio travels to OpenAI for the conversation. Typed input in that conversation is also processed by OpenAI. The application does not create stored audio recordings. Conversation text is held during the call; confirmed intake can save the transcript, summary and selected attachments into the matter.
AI document reading is a separate deliberate action. It sends the chosen file or its extracted text to OpenAI’s Responses API to prepare an unreviewed factual brief. Supported formats are PDF, DOCX, TXT and Markdown, currently limited to 2 MB per file and three files per conversation. Read the brief against the original, including any images, tables or annexes that may have been omitted. A direct case attachment can be stored without choosing AI document reading.
OpenAI’s service-specific processing and retention depend on the applicable account, agreement and feature. The document request disables response storage through its API setting; that setting alone does not establish zero retention across provider systems. See OpenAI’s API data controls. The operator must verify its actual supplier terms and settings.
Optional browser speech entry may use the browser provider’s speech service. You can type, decline microphone permission and end a call. AI helps prepare information; individual legal approval and decisions about an accepted matter require human review. The current workflow does not automatically decide the merits of a claim or accept a legal engagement.
6. Retention and security
| Record | Current behaviour |
|---|---|
| Public demonstration | The isolated demo workspace has a 24-hour lifetime. Related records are removed during expiry cleanup. This covers the demo’s application records; provider logs, backups and other systems have separate retention. |
| Private workspace | Accounts, onboarding applications, matters, documents, review and publication history, audit records and invoices persist beyond the browser session. A record-specific retention schedule and deletion process remain to be approved. Closing the browser or signing out does not delete them. |
| Earlier website data | Earlier intake, meeting and application records persist separately. Their purpose, continuing need, contact route and deletion dates require review. |
| Voice and providers | The app saves no audio recordings. Submitted transcripts can form part of the persistent matter. A separate usage store manages daily call limits. Hosting logs, backups and AI-provider records follow their applicable arrangements, which need verification. |
The application uses password hashing, protected session cookies and role-based access. The operator still needs to validate operational security, staff access reviews, backup recovery, incident handling and supplier controls. The final retention schedule must balance the purpose, professional duties, tax or other legal obligations and any justified need to establish or defend claims. Keeping every record indefinitely is not the proposed policy.
7. Your rights and privacy complaints
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, object to processing, or withdraw consent where it is relied on. Rights have conditions and exemptions, including protection of other people’s information and applicable privilege. Withdrawing consent does not change the lawfulness of earlier consent-based processing.
Requests should receive a response without undue delay and normally within one calendar month. Where the law permits an extension for complexity or the number of requests, up to two additional months may be used, with an explanation within the first month. Necessary identity checks, clarification and exemptions must follow the applicable rules. Requests are generally free. See the ICO’s current access-request guidance.
A data-protection complaint has a separate process: acknowledgement within 30 days, appropriate investigation, progress information and an outcome without undue delay. The proposed internal target is an earlier acknowledgement, as set out on the complaints page. You can raise a concern with the Information Commissioner’s Office. The monitored Kestrel contact must still be completed.
9. Updates to this notice
The version and date appear above. The operator must complete the outstanding controller, contact, lawful-basis, retention and supplier details before enabling real registration, and address the same gaps for any existing data. Material changes in purposes or handling require timely notice. A new website version does not authorise an incompatible new use of existing personal data.