Privacy Policy

1. Introduction

Kestrel Labs, Inc. ("the Company," "we," "us," or "our") operates kestreilabs.com and the Kestrel Labs building-code compliance analysis platform (the "Service"). We provide AI-assisted tools for architecture and engineering firms that process BIM model files to identify possible code violations before municipal plan review. This Privacy Policy describes the personal data we collect, how we use it, disclosures we make, and available choices. It covers data collected through the Service and our direct communications.

The Company is located at 1600 Wynkoop Street, Suite 200, Denver, CO 80202. Contact us at [email protected].

2. Information We Collect

2.1 Information You Provide

Information you provide to us may include:

• Name, work email, and phone number provided when you register, request a trial, or contact us;
• Firm details you share, including employer, role, and office location;
• Subscription and billing details, including plan tier and billing contact information. Our payment processor handles payment card data, which is not stored on our servers;
• BIM model files uploaded in IFC, Revit RVT, ArchiCAD, or other supported formats for compliance checks;
• Submission details such as project name, jurisdiction, design phase, and file notes;
• Messages sent through our contact form, support inbox, or email.

2.2 Compliance Query and Results Data

Running a Service compliance check involves collecting:

• The standards selected for your check, including IBC, ADA Standards for Accessible Design, NFPA 101, Colorado state amendments, and others;
• Check results and violation flags associated with each model file;
• Compliance reports produced from your submissions.

We process this information to provide results and evaluate and improve accuracy across the check library. We will not use BIM model content to train our AI models without your explicit written consent.

2.3 Information Collected Automatically

kestreilabs.com automatically receives limited technical data when you visit:

• IP address and approximate city and region;
• Browser, operating system, and device class;
• Pages visited, referrer, and time on page;
• Cookies and similar IDs (see Section 5).

2.4 We Do Not Knowingly Collect Children's Data

kestreilabs.com serves architecture and engineering professionals and is not intended for children under 13. We do not knowingly collect children's personal information. If you believe a child provided information, email [email protected] and we will promptly delete it.

3. How We Use Information

The Company uses submitted BIM model files and project information to perform compliance analysis and provide results. We do not use uploaded model content for another purpose without your written consent. We also use collected information to:

• Analyze BIM models against IBC, ADA, NFPA 101, Colorado amendments, and other applicable building-code standards;
• Produce reports identifying possible violations and citing relevant code sections;
• Operate, maintain, and improve your account and subscription;
• Answer questions and provide support;
• Send service notices, code-change alerts, and, where required with consent, marketing messages;
• Detect, investigate, prevent fraud or abuse;
• Meet our legal obligations.

We do not sell personal information for monetary value. If state law classifies certain advertising arrangements as a "sale" or "share," consult the relevant state section below.

4. Sharing of Information

We share personal information only with:

• Providers supporting our operations, including hosting, email, payments, and analytics, under confidentiality and data-processing agreements;
• Authorities when law, court order, or protection of rights, safety, or property requires it;
• A successor following a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

Cookies and similar tools help operate the site, retain preferences, and measure use. See our Cookie Policy for details and choices.

6. Data Retention

Data processed through the Service is retained according to these practices:

• BIM model files: kept on processing servers during active compliance analysis and for up to 30 days after report generation for re-download. They are then permanently deleted unless you expressly save them in account storage.
• Compliance reports and violation logs: kept while your account is active and for 12 months after termination or expiration.
• Account and subscription data: kept during the account term and as applicable financial record-keeping laws require.
• Contact and marketing records: inactive marketing records are purged after 24 months.
• Server access logs: kept for 90 days, then aggregated and anonymized.

7. Security

The Company maintains administrative, technical, and physical safeguards intended to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege controls for processing systems. BIM files being processed are handled in isolated compute environments. No system is completely secure, so absolute security cannot be guaranteed.

8. Your General Rights

Your jurisdiction may provide rights such as access, correction, deletion, or limits on certain processing. To request action, email [email protected]. We will reply within the period required by applicable law.

9. Colorado Residents (CPA)

Under the Colorado Privacy Act ("CPA"), Colorado residents have the following rights with respect to personal data the Company controls.

9.1 Your CPA Rights

• Right of Access: confirm whether we are processing your personal data and obtain a copy.
• Right to Correction: correct inaccuracies, considering the nature and purposes of processing.
• Right to Deletion: request deletion of personal data concerning you.
• Right to Data Portability: obtain a portable copy where technically feasible (up to twice per year).
• Right to Opt Out: opt out of (a) targeted advertising, (b) sale of personal data, and (c) profiling that produces legal or similarly significant effects.

9.2 Universal Opt-Out Mechanism

The Company honors browser-transmitted universal opt-out signals, including the Global Privacy Control ("GPC"), as a request to opt out of sale and targeted advertising. Configuring GPC in your browser is sufficient; no separate request is required.

9.3 How to Exercise

Submit a request by emailing [email protected]. The Company responds within 45 days; one 45-day extension is available where reasonably necessary, with notice.

9.4 Appeal

You may appeal a denial by replying to our response email. If we maintain the denial, you may contact the Colorado Attorney General at coag.gov.

9.5 California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. The Company does not sell personal information and does not "share" personal information for cross-context behavioral advertising.

To submit a CCPA or CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

The Company may revise this Policy periodically. We will show material updates with a new "Last updated" date at the top of this page and, when appropriate, a notice through the Service.

11. Contact

Questions, requests, or complaints can be sent to:

Kestrel Labs, Inc.
1600 Wynkoop Street, Suite 200
Denver, CO 80202
Email: [email protected]
Phone: +1 (303) 771-0184