Privacy Policy
1. Controller
The controller responsible for data processing on this website is:
[Your Name or Company][Your Address][Your Contact Email]
2. WorkOS (Authentication & SSO)
We use WorkOS (WorkOS, Inc., Palo Alto, CA, USA) to enable authentication and Single Sign-On (SSO). Processed data may include:
- login credentials or tokens from identity providers
- sign-in metadata (time, provider, device)
- identifiers such as email, name, or organizational IDs
Legal basis: Art. 6 (1) lit. b GDPR (contract) or Art. 6 (1) lit. f GDPR (legitimate interest in secure login).
Data may be transferred to the USA under the EU–US Data Privacy Framework or SCCs.
Details: https://workos.com/privacy
3. Convex (Backend & Database)
We use Convex (Convex, Inc., Palo Alto, CA, USA) as backend and database service. That includes processing of:
- user IDs and account information
- application‑specific data (entries, records, user actions)
- request metadata (timestamps, API usage)
Legal basis: Art. 6 (1) lit. b GDPR (contract) or Art. 6 (1) lit. f GDPR (service operation/security).
Data may be transferred to the USA under the EU–US Data Privacy Framework or SCCs.
4. Cloudflare (Domain, CDN, Security)
We use Cloudflare (Cloudflare, Inc., San Francisco, CA, USA) to provide DNS, CDN, and security (e.g. DDoS protection, WAF). Cloudflare processes:
- IP address and connection metadata
- requests for resources (pages, assets)
- security logs (traffic patterns, firewall logs)
Legal basis: Art. 6 (1) lit. f GDPR (interest in secure, fast, reliable website).
Global processing incl. USA under Privacy Framework or SCCs.
5. Cloudflare R2 (Storage)
We use Cloudflare R2 to store application data and user uploads (e.g. replace with what you actually store, e.g. files, images, backups).
- files/content uploaded by users
- metadata (timestamps, object identifiers)
- request logs when files are accessed
Legal basis: Art. 6 (1) lit. b GDPR (contract) or Art. 6 (1) lit. f GDPR (secure storage/delivery).
Data may be processed globally under Privacy Framework or SCCs.
6. OpenAI (Content Summarization/Analysis)
We offer optional features that use OpenAI services (OpenAI L.L.C., San Francisco, CA, USA). If you actively choose to use these features, the content you provide (e.g. text or files) is transmitted to OpenAI servers for processing. No data is sent to OpenAI unless you explicitly use these features.
Data processed may include:
- text or documents you provide when requesting a summary
- questions you ask in the chat, your earlier messages, and the names, descriptions, AI summaries, categories and linked persons of the files that match them
- metadata (request time, file identifiers)
Legal basis:
- For core use cases: Art. 6 (1) lit. b GDPR (performance of a requested service).
- As the feature is optional, we additionally rely on your explicit action/consent under Art. 6 (1) lit. a GDPR when you trigger the function.
Processing takes place in the USA. Safeguards: EU–US Data Privacy Framework (if certified) or EU Standard Contractual Clauses.
7. PostHog (Web Analytics & Error Tracking)
We use PostHog (PostHog, Inc., San Francisco, CA, USA) to understand how Harboro is used and to detect errors. The data is stored on PostHog's EU Cloud in Frankfurt, Germany. When you first visit Harboro, a banner asks for your choice. No analytics data is sent before you decide.
If you accept:
- PostHog stores a random identifier in a cookie and in your browser's local storage (
ph_*, up to 1 year) to recognize your browser across visits - we collect page views, clicks on buttons and links (without their text), errors that occur in the app, and actions such as uploading, editing, downloading or deleting files, managing persons, categories and folders, filtering and searching files, creating share links, using the AI summaries and chat, or switching the theme. These events only contain counts, file types and sizes and similar technical details, never names, descriptions, file contents, chat messages or search terms (only their length)
- browser, operating system, device type, screen size, referring website and approximate location (country, city) derived from your IP address
- if you are signed in, your internal user ID (not your name or email address) to link these events to your account
Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG (consent).
If you decline:
Nothing is stored on your device, apart from your choice. We still count page views and errors anonymously: PostHog calculates a hash from your IP address, user agent and a salt that changes daily on its servers, so visits can be counted within one day without recognizing you across days. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in basic usage statistics and a stable service). You can object to this at any time.
Your choice is stored in your browser's local storage (harboro_analytics_consent). You can change or withdraw it at any time with the button below or via "Cookie Settings" at the bottom of the home page. If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as declining.
We do not use session recordings. Links to shared files and the names of your files, persons and conversations are removed before any data is sent. Your IP address is not stored by PostHog.
Data may be transferred to the USA under the EU–US Data Privacy Framework or SCCs.
Details: https://posthog.com/privacy
8. Your Rights
Under the GDPR, you have the right to request access to the personal data we process, as well as the rights to rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with a supervisory authority.