Privacy Policy

Harbor Cloud provides hosted passkey sign-in, business identity integrations, a customer portal, and related websites and APIs. This policy describes personal information handled through those services. The operator’s legal name, postal address, and jurisdiction will be added before this policy takes effect. You can contact us at [email protected].

We determine how information is used to administer our own accounts, billing, security, and support. When a business customer determines the purposes of processing information through its application, that customer may be the controller and we may act as its processor under a separate agreement. The exact roles depend on the processing, rather than the name given to either party.

A connected site has its own privacy practices for information it receives. This policy does not govern that site or your device’s passkey provider. Contact the connected site about its use of your information; we can help route requests concerning data we process for it.

Account and contact information: information you provide when opening or administering an account, such as your business name, organization URL slug, contact email, account identifiers, administrator membership, and support correspondence. We record email verification and the version and time of business signup acceptance.

Authentication and connection information: your passkey’s public key and associated credential or device metadata, authentication events, the account identifier issued for each connected site, requested identity attributes, and your sharing choices. Harbor does not receive your passkey’s private key. Any biometric check used to unlock a passkey takes place through your device or passkey provider; Harbor does not receive your fingerprint or face scan from that check.

Business configuration and usage: application names, redirect URLs, OIDC or SAML configuration, webhook destinations, API-key metadata, plan information, and service usage needed to operate integrations and calculate allowances or charges. Keep secrets out of names, URLs, support messages, and other fields that are not intended to hold them.

Billing information: billing contact details, subscription state, invoices, payment-provider identifiers, and payment outcomes. Payments are handled through our payment provider. Payment card details submitted to its payment form are handled by that provider rather than stored as full card numbers in Harbor Cloud’s application database.

Technical and security information: IP address, browser or user-agent information, request path, timestamps, response information, and records of administrative changes. Requests and logs can contain information included in URLs, so avoid adding unnecessary personal information to integration URLs.

We receive information directly from you, from your browser or device when it contacts the service, from organization administrators configuring your access, and from providers processing payments or delivering service messages. Some fields are required to establish an account, authenticate you, or provide a requested integration; without them we may be unable to provide that function.

We use personal information to create and maintain accounts, verify contact details, authenticate users, process approved connections, operate integrations, measure usage, administer subscriptions, send service messages, respond to support requests, investigate abuse, troubleshoot failures, and meet legal and accounting obligations.

Where European or UK data protection law applies, our legal basis depends on the purpose: performing a contract with you or taking requested steps before one; our legitimate interests in securing, maintaining, and supporting the service and preventing fraud; compliance with legal obligations; or your consent where required for optional processing. Where an organization is our customer, administering its account may rely on our legitimate interests rather than a contract with each individual administrator.

Approving an identity attribute for a connected site authorizes that disclosure through Harbor. It does not authorize unrelated marketing or override the site’s obligation to establish its own legal basis. You can withdraw a sharing choice or disconnect a site through available controls; this stops future sharing but cannot retrieve information the site already received.

We do not use authentication attributes to build advertising profiles. These services are not designed to make decisions producing legal or similarly significant effects about you solely through automated profiling. Automated security controls may rate-limit or block suspicious requests; contact support if you believe a restriction is mistaken.

Connected sites receive their site-specific account identifier and attributes you approve, such as a verified email address. Harbor does not send them your passkey private key, identifiers for other sites, or Harbor Cloud billing details. A different identifier for each site does not prevent matching through other information you share.

Organization administrators can access account and integration information relevant to their authorized role. They may control your access to the organization’s applications. Ask your administrator about organization-specific monitoring, policies, and retention.

Service providers process information needed to deliver the service. The current infrastructure uses Hetzner for hosting, Cloudflare for network and edge protection, Brevo for transactional email, and Stripe for payment processing. These providers may receive network traffic, message addresses and content, or billing information according to their function. A provider may have its own legal obligations and privacy policy, particularly for payments and abuse prevention.

We may disclose information where required by law, to respond to valid legal process, or where reasonably necessary to investigate fraud, address a security incident, or protect people’s rights and safety. We assess requests and limit disclosure to what is appropriate. If the business is reorganized, sold, or transferred, relevant information may transfer subject to applicable law and notice of material changes.

We do not sell personal information or share it for cross-context behavioral advertising. We do not give advertisers access to authentication data or run targeted-advertising profiles through the public site. We do not use customer authentication data to train general-purpose AI models.

Sign-in and the customer portal use necessary cookies or similar storage to maintain sessions, protect authentication flows, and remember state required to complete a request. Blocking this storage may prevent sign-in or break an in-progress signup. You can clear it through your browser settings, which may sign you out.

The public information pages do not set analytics or advertising cookies and do not require the customer portal’s session cookie. They do not run third-party analytics, advertising, or session-replay scripts. Our network providers and servers still process request information for delivery, security, and troubleshooting.

We do not change our behavior based on a browser’s Do Not Track signal because there is no uniform interpretation used by this service. Because we do not sell information or share it for behavioral advertising, a Global Privacy Control signal does not need to disable those activities. We will honor applicable opt-out requirements if our practices change.

We retain account and integration information while needed to provide your account and the services you request. Retention also depends on the information’s purpose, account status, security needs, contractual requirements, and applicable legal obligations. We do not retain all data for one uniform period.

You may request account closure and erasure by contacting support. Cancellation of billing alone is not an erasure request. Deletion may include removing records or destroying the encryption keys needed to read covered fields. This process is irreversible for the encrypted information and can affect your ability to use connected applications.

Financial and tax records, a limited security ledger, records needed for an active dispute or legal hold, and proof that an erasure request was completed may remain after deletion. Access to retained records is restricted to the purposes that justify keeping them. They are deleted or de-identified when that need ends.

Backup copies are not used as a substitute for an active account and expire through the applicable backup lifecycle. After restoring a backup, erasure restrictions must be reapplied before affected data returns to normal use. Detailed production retention periods, provider retention, and backup schedules are being confirmed for this draft; it does not promise a deletion deadline that has not been operationally verified.

We use technical and organizational measures intended to protect information, including encrypted public connections, access controls, audit records, and encryption of covered tenant and billing contact fields at rest. The Security page describes available controls and distinguishes planned features. No service can guarantee that every unauthorized access or loss will be prevented.

Protect your devices, passkeys, and administrator credentials. Harbor does not keep a copy of your passkey private key. If you lose all registered passkeys and have no supported recovery method configured, we may be unable to restore access. Report suspected security problems to [email protected].

Hosting and service providers may process information outside your country, where privacy protections can differ. The infrastructure includes hosting in Germany and providers with international operations. Your country alone does not determine where every copy of a message, payment record, or network log is processed.

Before this policy is published, we will confirm the operator’s location, processing locations, provider agreements, and any applicable international transfer mechanisms. This draft does not claim certification under a privacy framework or that particular contractual transfer safeguards are already in place. Business customers needing an agreed processing region or transfer arrangement should contact us before providing affected data.

Email [email protected] to request access to, correction of, a copy of, or deletion of your personal information. Where applicable law provides them, you may also request portability or restriction, object to processing based on legitimate interests, withdraw consent, or opt out of covered processing. Withdrawing consent does not change the lawfulness of processing before withdrawal. We will not discriminate against you for exercising an applicable privacy right.

We may need to verify your identity and authority before disclosing or changing information. We request only what is reasonably needed for that verification. Authorized agents may submit requests where permitted, with appropriate proof of authority. We respond within the period required by applicable law and explain if an exception limits what we can do.

If your request concerns a business customer’s application, that customer may need to respond as controller, and we will assist as required by our agreement and law. If we decline a request, you may ask support to review the decision and use any appeal rights available under local law. You may also complain to the data protection authority or regulator responsible for your location.

Self-service export is not currently available. Disconnecting a site does not close your Harbor account, delete information held by that site, or cancel a business subscription. Contact each service about the records it controls.

Direct Harbor Cloud accounts are intended for adults. We do not knowingly collect personal information from children under 13 through direct account enrollment. If you believe a child has provided information without appropriate authorization, contact support so we can investigate and take appropriate action.

A business customer serving children must establish the required legal basis, notices, parental permissions, and processing arrangements before using an integration for that purpose. Do not assume that a general business signup establishes compliance with children’s privacy requirements.

We will update the date on this page when the policy changes and provide additional notice of material changes by email or through the service where appropriate. We will obtain consent where a new use requires it. A policy update does not itself authorize a use that requires a separate legal basis.

For privacy requests and questions, email [email protected]. For security reports, email [email protected]. The operator’s legal identity, postal contact, and any required representative details will be included before this draft takes effect.