Privacy Policy

Last updated: 20 October 2026

1. Who we are

This policy explains how Prius Data Technologies Ltd ("PDTL", "we", "us") handles personal data.

• Company number 16589578, registered in England and Wales
• Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• Email: support@priusdatatechnologies.co.uk
• Phone: +44 1452 905055
• Website: https://www.priusdatatechnologies.co.uk

2. What this policy covers

• Kestrel, our Windows app for protection and backup (earlier versions were called Prius), with its background services.
• Aerie, the web console organisations use to manage and protect their Kestrel devices.
• Kestrel for Outlook, our Outlook add-in that checks emails for phishing.
• Cloud backup, which stores the files you choose to protect.
• The PDTL website, including sign-in, the customer portal, the contact form, the Prius Agent assistant and live chat.
• The emails we send about your account.

3SETS, our fitness app for iPhone, is also built and run by PDTL. Because it handles health and fitness data, it has its own detailed privacy policy; section 9 summarises it.

This policy does not cover other websites we link to.

3. Our role: controller or processor

• Individual customers and website visitors: PDTL is the controller of your personal data.
• Organisations: when an organisation installs Kestrel on its computers and manages them in Aerie, that organisation decides what is monitored and what actions are taken. The organisation is the controller of the data about its devices and the people who use them, and PDTL is its processor. We process that data only to provide the service and on the organisation's instructions. If you use a computer managed by your employer or another organisation, please contact them first about how your data is used.

4. The short version

• To create an account we need your name, email address and password, plus your company name if you give one. Two-factor sign-in with an authenticator app is required.
• Backups are copies of the files in the folders you choose, stored with our cloud storage provider, together with a list of those files (names, paths, sizes, dates and a fingerprint of each file).
• On computers managed through Aerie, Kestrel reports security information about the computer to the organisation's administrators: device details, installed software, security status, threat detections and live activity. Section 6 lists exactly what.
• Administrators can act on managed computers remotely, for example end a process, isolate the computer from the network, take a screenshot or restart it. Some of these actions happen without a notice on screen.
• We do not sell personal data, we do not use it for advertising, and the website has no analytics or advertising cookies.

5. Information we collect for your account

5.1 Account and sign-in

• First name, last name, email address and, optionally, company name.
• Your password and authenticator set-up. These are held by our authentication provider (Supabase); we never see your password.
• A customer account record, a licence and a history of what has happened to the licence (for example trial started, plan changed, device added), including whether the customer or a named PDTL staff member made the change.

You can change your name and company name. To change your email address, contact us.

5.2 Devices

For each computer where Kestrel is installed and signed in, we record:

• a random device ID;
• the computer's network name (hostname), used as the device name;
• the operating system and its version;
• the Kestrel version and build;
• when the device was first added and last seen, and whether it is authorised or revoked.

Every request from Kestrel also sends its version and build, so we can refuse versions that are no longer supported.

5.3 Organisations and enrolment

When an organisation enrols computers, the installer uses an enrolment token issued by that organisation. Each computer then receives its own device credential. We store tokens and credentials only as one-way hashes. We record which token enrolled each device. People who sign in to Kestrel on an organisation's computer become members of that organisation's account.

5.4 Plans and payments

When you request a plan, we record the plan you chose, your account and the time, and our team is emailed your name, email address, company and licence number so they can complete the change. Card payments are not open yet, so we do not hold card details.

6. Information Kestrel sends from a computer

6.1 Backups

• File contents of the folders you choose are uploaded over encrypted connections (HTTPS/TLS) to our storage provider, Backblaze B2, using short-lived upload links.
• For each file we keep a catalogue entry: its storage location, its path inside the backed-up folder, its full original path on the computer (which can include the Windows user name, such as C:\Users\<name>\Documents\...), its size, its last-modified time and a SHA-256 fingerprint of its contents.
• File and folder names form part of the storage location.
• We do not open, read, index or scan the contents of backed-up files on our servers.

6.2 Security information on managed computers

On a computer managed through Aerie, Kestrel sends the following to PDTL's servers so the organisation's administrators can see it:

• Device facts: hostname, operating system and version.
• Security status: what Windows Security reports about antivirus, firewall and updates.
• Installed software: a list of installed programs and versions, sent at most once a day, so we can match it against known vulnerabilities.
• Detections: threats and suspicious behaviour Kestrel finds, including the program involved, its command line, and startup entries (Run keys, services, scheduled tasks and Startup folders).
• Live activity:
• CPU, memory and disk use;
• the busiest processes (name, process ID, CPU and memory use, number of connections, and whether the program is signed and by whom);
• for each app, the number of network connections and of distinct destinations;
• whether the camera, microphone, location or screen capture is in use, and by which app;
• isolation and backup image status.

Live activity does not include file paths, the addresses or names of the sites apps connect to, or the content of any traffic. Only the latest reading is kept; each report replaces the one before.

• Messages and files exchanged between the person at the computer and the organisation's administrators, including screenshots or documents the person chooses to attach.
• An audit log of device events and of commands sent to the device.

Kestrel never reads the content of network traffic, never intercepts HTTPS and installs no certificates.

6.3 Remote actions by administrators

An organisation's administrators can send signed commands to a managed computer from Aerie. These include:

• sending a message or alert;
• requesting a screen share;
• running a Microsoft Defender scan;
• starting a backup;
• updating apps or Kestrel;
• isolating the computer from the network, or lifting isolation;
• locking the screen and muting it, or cutting camera and microphone access;
• taking a screenshot (kept for 24 hours, then deleted);
• finding the device's location;
• ending a process;
• restarting or shutting down;
• creating or restoring a system image;
• uninstalling Kestrel.

Messages, alerts, screen share requests and lifting isolation appear on the screen. Other actions, including screenshots and location, may run without a notice on screen. Powerful actions require an administrator with the right role and recent two-factor sign-in. Restarts, shutdown, restoring an image and uninstalling also require the organisation to have switched on containment. On a managed computer, signing out of Kestrel needs approval from an administrator.

Organisations that use these features are responsible for telling the people who use their computers, and for having a lawful basis to monitor them.

6.4 Information that stays on the computer

Kestrel also keeps some information only on the computer, in the Windows user profile. This includes the local backup database, the signed-in session (encrypted with a key protected by Windows for that user), a small diagnostic log without email addresses, passwords or codes, display preferences, and detailed local security history. Kestrel's network service counts traffic per app in memory and discards it after 10 minutes.

7. Kestrel for Outlook

When you open an email, the add-in checks the sender, links and attachments for signs of phishing or malware. To check links against Google's Web Risk service, it sends only a short fingerprint (the first 4 bytes of a SHA-256 hash) of each link's host, through PDTL's servers. The content of your emails is not stored by PDTL.

8. The website

8.1 Contact form and feedback

The contact form and in-app feedback send your name, email address, company (optional), subject, category, rating (optional) and message to our support inbox by email, and send you a confirmation. They are not saved in a database. To prevent abuse, the website counts messages per IP address in memory for 10 minutes; the IP address is not written to a database.

8.2 Prius Agent and live chat

Prius Agent answers basic questions about PDTL and its products, using only information published on our website. It cannot see customer accounts, devices, backups or billing. Your questions are sent to our website server to produce answers. We do not save these conversations on our servers or log what you ask. If we use an AI provider (Anthropic) to generate answers, your questions are sent to it for that purpose only, and are not used to train AI models.

Live chat. If you choose to talk to the PDTL team, we store your name, email address, company (if given), your messages and files you attach, the assistant conversation so far (up to 20 messages), our replies and the staff member's name, timestamps, and the page where you started. We use these to answer you, and we may email you replies. A chat is deleted automatically, with its messages and files, after 30 days without activity. Only PDTL staff signed in with two-factor authentication can open live chats.

8.3 Cookies and browser storage

We do not use analytics, advertising or tracking cookies, and the website loads no third-party scripts or fonts.

These are strictly necessary for the features you use, so they do not need consent.

9. 3SETS

3SETS is PDTL's own fitness app for iPhone. It is in testing through Apple TestFlight and is due for release on the App Store. PDTL is the controller of 3SETS users' personal data. The full 3SETS Privacy Policy is at https://3sets.co.uk/privacy-policy, and it takes precedence for 3SETS. In summary:

• Account and profile: name and email (or Sign in with Apple), date of birth, and optional gender, height, weight, goal and weekly training target.
• Training, food and recovery: workouts, sets and weights, food and drink, body measurements and recovery check-ins. Health and body data is special category data and is used only with your explicit consent.
• Apple Health (optional, read-only): steps, distance, activity, workouts (no routes), sleep, heart rate and related readings.
• AI features: food photos, meal descriptions, the Gym Buddy chat and Social moderation use Anthropic's Claude. Food analysis and Gym Buddy conversations are not stored.
• Location (optional, only while the app is open): used for weather, gym search and the Social map. You control who sees you; users aged 13–17 must opt in, and only friends see them.
• Social: posts, stories, messages, friends, challenges and check-ins, visible to the people you choose. Stories expire after 24 hours.
• 3SETS is for people aged 13 and over, with more private defaults for under-18s.
• No ads, no data sales, no advertising networks and no tracking.
• You can delete your account and its data at any time from Profile → Delete account in the app.

For questions about 3SETS, email support@3sets.co.uk.

10. Why we use your information

Automated decisions. Our servers automatically decide what an installation may do, based on the account's plan, trial dates, device limit, storage use and app version, and automatically delete trial accounts that are not converted (see our Data Retention & Account Deletion page). You can contact us to have any such decision reviewed by a person.

11. Who we share information with

We use these service providers, who process data on our behalf under contract:

Kestrel's optional speed test connects to Cloudflare's public speed test, which sees your IP address like any website. Kestrel does not store your IP address.

We may also disclose information when the law requires it, or to protect the rights, property or safety of PDTL, our customers or others.

12. International transfers

Some of our providers store or access data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK-US data bridge), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

13. How we protect information

• HTTPS/TLS for every connection between Kestrel, Aerie, the website, our servers and storage.
• Two-factor sign-in on every account. Aerie administrators need two-factor sign-in, and recent re-entry of their code for powerful actions.
• Storage keys stay on our servers. Kestrel receives links for single files that expire within 15 minutes.
• Database security rules let each signed-in user and organisation read only their own records.
• Commands to devices are cryptographically signed, and devices check the signature.
• Enrolment tokens, device credentials and approval tokens are stored only as hashes.
• The saved sign-in session on your computer is encrypted.

Backups are not end-to-end encrypted, so our storage provider, and authorised PDTL systems, can technically access file contents. Do not rely on Kestrel as your only copy of anything irreplaceable.

14. How long we keep information

Our Data Retention & Account Deletion page gives the full detail. In short:

• account, device, organisation and backup data are kept while the account exists;
• trial accounts that do not subscribe are deleted automatically after a grace period;
• screenshots are deleted after 24 hours;
• live chats are deleted after 30 days without activity;
• a short deletion record, without your email address or name, is kept after an account is deleted.

15. Your rights

Under UK data protection law you have the right to:

• access your personal data;
• correct it;
• have it erased;
• restrict or object to its use;
• data portability;
• withdraw consent where we rely on consent.

To use them, email support@priusdatatechnologies.co.uk. We may need to confirm your identity first. We reply within one month, which can be extended by two further months for complex requests; if we extend it, we will tell you why. If your data is held for an organisation (section 3), we will pass your request to that organisation and help it respond.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

16. Children

Kestrel, Aerie, Kestrel for Outlook and our cloud backup are not intended for anyone under 18, and we do not knowingly collect children's data through them. 3SETS is for people aged 13 and over (see section 9).

17. Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we use your data, we will tell customers by email or in Kestrel before it takes effect.

18. Contact

Prius Data Technologies Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom support@priusdatatechnologies.co.uk · +44 1452 905055