Free Audit

Privacy Policy

Last updated: 24/06/2026

This Privacy Policy explains how Kestrel Audit (“Kestrel”, “we”, “us”), a service at kestrelaudit.com operated by Ontrepreneur Limited, collects, uses, shares, and protects your information when you use our website and service. Kestrel is an independent, read-only Google Ads auditing tool; it is not created by, endorsed by, or affiliated with Google. We handle personal information in line with the New Zealand Privacy Act 2020 and, where they apply, the EU/UK GDPR and other data-protection laws.

1. Who we are

Ontrepreneur Limited, Auckland, New Zealand, is the data controller for Kestrel Audit. Contact: info@ontrepreneur.co.nz.

2. Information we collect

  • Account & business details you give us: business name, website, email address, and password (stored hashed, never in plain text).
  • Google Ads data you authorise us to read on a read-only basis — described in full in section 3.
  • Billing data for paid plans, handled by our payment processor; we do not store your full card number.
  • Usage & technical data: log data, device/browser information, IP address (used, among other things, to show prices in your local currency), and basic analytics about how the site is used.

3. Google user data

When you connect your Google account, you authorise Kestrel to access certain Google Ads data on a read-only basis, using the https://www.googleapis.com/auth/adwords scope, solely so we can run automated checks and show you your audit inside Kestrel.

What Google user data we access

Through the Google Ads API, and only for the Google Ads accounts you choose to audit, Kestrel reads:

  • account and manager (MCC) identifiers, names, currency and time-zone settings;
  • campaign, ad group, ad, keyword, and asset structure and settings;
  • budgets, bidding strategies, and status;
  • performance metrics such as impressions, clicks, cost, conversions, conversion value, click-through rate, and quality-related signals;
  • Google Ads recommendations and account-level diagnostics.

Kestrel is strictly read-only. We never create, edit, pause, enable, spend from, or otherwise change anything in your Google Ads account.

How we use it

We use Google Ads data for one purpose only: to generate and display your audit — your health score, the results of our checks, trends over time, and the plain-English findings and notifications shown to you inside Kestrel. We use it to provide and improve these user-facing audit features and for no other purpose. We do not use Google user data for advertising, and we do not use it to train, develop, or improve generalised artificial-intelligence or machine-learning models.

How we store and protect it

To run your audit and show trends, Kestrel stores results derived from your Google Ads data — such as daily health-score snapshots, findings, and notifications — associated with the specific account they came from. Your OAuth token is stored so we can refresh your audit while your account stays connected. This data is held on secured servers and protected with encryption in transit (HTTPS/TLS), encryption of stored credentials, access controls on a least-privilege basis, and tenant isolation so that one customer’s data is never accessible to another.

Who we share it with

We do not sell your Google user data. We do not transfer or disclose it to third parties, except to a limited set of infrastructure and hosting providers who process it on our behalf, under confidentiality obligations, strictly to operate the service — or where we are required to by law, or where you explicitly ask us to. We never share, transfer, or disclose Google user data for any purpose unrelated to providing you the audit.

Limited Use

Kestrel’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not allow humans to read your Google user data unless: (a) you have given specific consent (for example, to help you with a support request); (b) it is necessary for security purposes, such as investigating abuse; (c) it is required to comply with applicable law; or (d) the data has been aggregated and anonymised for internal operations.

Retention and deletion

We keep data derived from your Google Ads account only while you keep that account connected. You control it directly:

  • Disconnecting an individual audit account inside Kestrel immediately and permanently deletes that account’s stored history, findings, and notifications.
  • Disconnecting Google entirely, or deleting your Kestrel account, revokes our access and deletes the associated stored Google Ads data and your OAuth token.
  • You can also revoke Kestrel’s access at any time from your Google Account permissions.

After revocation or deletion we remove the data within a reasonable period, except anything we must retain to comply with law. We do not retain Google user data beyond what is needed to provide the audit.

4. How we use your information

To create and run your account and audits; to provide support; to process payments and prevent fraud; to operate, secure, and improve the service; to communicate with you about your account and (where permitted) relevant updates; and to meet legal obligations.

5. Legal bases (EU/UK visitors)

Where the GDPR applies, we process data to perform our contract with you, to pursue legitimate interests (running and improving the service, security), to comply with legal obligations, and — where required — with your consent (which you can withdraw at any time).

6. Who we share data with

We share data only with service providers who help us run Kestrel, under appropriate safeguards — for example payment processing (Stripe), hosting, and email delivery. We may disclose information if required by law or to protect our rights, users, or the public. We do not sell your personal information. Our handling of Google user data specifically is set out in section 3.

7. Cookies

We use essential cookies to keep you signed in and the site working, and limited analytics cookies to understand usage. You can control cookies through your browser settings.

8. Data retention

We keep your information for as long as your account is active and as needed to provide the service, then for any period required to meet legal, tax, accounting, or security obligations. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain it by law. Google user data has its own retention and deletion rules, described in section 3.

9. Security

We use technical and organisational measures — encryption in transit, hashed passwords, encrypted credentials, access controls, and tenant isolation — to protect your data. No system is perfectly secure, but we work to keep your information safe and will notify you and the relevant authority of a serious breach as required by law.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. To exercise these, email info@ontrepreneur.co.nz. You can also delete your account at any time from within Kestrel.

11. International transfers

We operate from New Zealand and may process data in other countries via our service providers. Where required, we put safeguards in place so your data stays protected when it crosses borders.

12. Children

Kestrel is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.

13. Changes

We may update this policy from time to time. We’ll post the new version here and, for material changes, notify you by email or in-app.

14. Contact & complaints

Questions or concerns? Email info@ontrepreneur.co.nz. If you are in New Zealand and aren’t satisfied with our response, you can contact the Office of the Privacy Commissioner (privacy.org.nz). Visitors elsewhere may have the right to complain to their local data-protection authority.