How we handle your data.

Harbor Ops Ltd (“Harbor”, “we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information when you use the Harbor Ops platform (“Platform”). It is written in compliance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Harbor Ops Ltd is registered in England and Wales (Company Number: 17215410) and acts as the data controller for personal data collected from Users and website visitors.

2.1 Data you provide directly

• Account registration information — name, email address, business name, and contact details.
• Billing information — payment details processed and stored by our third-party payment provider (we do not store full card details).
• Customer Data — tenant records, property information, lease documents, rent histories, and other data you upload or create within the Platform.
• Support and communications — information you provide when contacting us for support.
• Connected account data — if you connect a Google or Microsoft account, the limited data described in Section 5.

2.2 Data collected automatically

• Usage data — pages visited, features used, session duration, and interactions within the Platform.
• Device and technical data — IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies — session cookies for authentication and analytics cookies (see Section 9).

We process your personal data for the following purposes and on the following legal bases:

When you upload Customer Data to the Platform, which may include personal data of your tenants or third parties, Harbor acts as a data processor and you are the data controller. We process such data only on your documented instructions and in accordance with our contractual obligations.

As the data controller for Customer Data, you are responsible for ensuring you have a lawful basis to process that data and for providing any required notices to the individuals concerned.

Agencies can choose to connect a Google account (Gmail or Google Workspace) or a Microsoft 365 account to Harbor. Connecting an account is optional, and is done by an administrator of the agency through Google’s or Microsoft’s own sign-in and consent screen. This section explains exactly what we access, why, and what we do with it.

5.1 What we access and why

5.2 How we store and protect it

• The access tokens Google or Microsoft issue to us are encrypted (AES-256-GCM) before they are stored on our servers. They are used only by the parts of Harbor that send email or import enquiries, and they are never sent to your browser.
• We do not keep copies of the emails we send through your mailbox. We keep a delivery log (recipient, subject, time and whether it was delivered) so you can see what was sent and so we can fix problems.
• Leads created from enquiry emails are Customer Data. We hold them on your behalf as described in Section 4, and keep them as described in Section 8.

5.3 How we use and share it

• We use Google and Microsoft account data only to provide the features described above, which you can see and control in Harbor.
• We do not sell this data, use it for advertising, or use it to work out anyone’s creditworthiness or for lending.
• We do not transfer it to anyone else except as needed to provide these features (for example our hosting infrastructure), to comply with the law, or as part of a merger or acquisition, with notice to you.
• Our staff do not read it unless you ask us to for a specific message (for example when you contact support), it is needed to investigate security issues or abuse, it is needed to comply with the law, or it has been aggregated and anonymised for running the service.
• We do not use data from Google or Microsoft accounts to develop, improve or train artificial intelligence or machine-learning models.
• Harbor’s optional AI features use OpenAI’s API (see Section 6). Names, contact details, property references and message content from enquiries imported from your Gmail inbox are never sent to it: our AI assistant sees only an imported enquiry’s status, the portal it came from and the date it arrived. Your connected account’s access tokens and email address are never sent to any AI service.

5.4 Disconnecting and deleting your data

• An agency administrator can disconnect at any time: email sending under Settings → Email Sending → Disconnect, and enquiry import under Leads → Settings. Disconnecting deletes the stored tokens straight away, and we stop accessing the account.
• You can also remove our access from your side at any time, in your Google Account permissions or your Microsoft account’s app permissions.
• Leads already imported stay in Harbor as Customer Data until you delete them or your account is closed. To ask us to delete any data we hold from a connected account, email legal@harborops.co.uk.

We do not sell your personal data. We may share data with the following categories of third parties:

All third-party processors are subject to contractual data processing obligations and are required to implement appropriate security measures.

We primarily store and process data within the United Kingdom and the European Economic Area. Where data is transferred to third countries, we ensure adequate safeguards are in place, such as UK adequacy decisions or Standard Contractual Clauses as appropriate.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including:

You may request deletion of your personal data at any time, subject to our legal retention obligations.

We use the following categories of cookies:

• Strictly necessary cookies — required for the Platform to function, including authentication and session management. These cannot be disabled.
• Analytics cookies — used to understand how the Platform is used, in aggregate. You may opt out of analytics cookies via your account settings.

We do not use advertising or third-party tracking cookies.

As a data subject, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at legal@harborops.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• encryption in transit (TLS) and at rest;
• role-based access controls and least-privilege provisioning;
• regular security reviews and dependency auditing.

The Platform is intended for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email or in-platform notice at least 14 days before they take effect. The effective date at the top of this document will be updated accordingly.

If you have any questions about this Privacy Policy or how we handle your data, please contact: