Privacy Notice
Original document and image uploads are processed in memory and discarded after processing. During the displayed retention period, KESTREL keeps bounded private derived representations, provenance, and conversations on isolated private storage.
Before private workspace deletion or expiry, KESTREL may create a separate learning candidate. It is retained only when a fail-closed gate reliably removes direct and indirect identifiers, embedded metadata, confidential content, and every link back to the account, workspace, upload, or source. Uncertain or ineligible candidates are rejected and destroyed. A retained candidate remains unverified until independent claim verification qualifies it for canonical memory.
Deleting a workspace removes its private representation and conversation and returns a non-content receipt that truthfully reports whether a separately de-identified candidate survived. Account isolation prevents one customer from accessing another customer’s workspace.
Email verification is not currently configured. New accounts are labeled unverified and receive conservative trial access.