Privacy Policy

1. Introduction

Harbor is an AI-powered SEO content generation platform operated by Kraft Agency Limited, a company registered in Ireland. "Harbor" and "Harbor SEO" are trading names of Kraft Agency Limited. In this policy, "Harbor", "we", "our" and "us" mean Kraft Agency Limited.

Kraft Agency Limited is the data controller for the personal data described in this policy. We are a company registered in Ireland under company registration (CRO) number 681636, VAT number IE3733031EH, with our registered office at Unit 2A, Deerpark Business Centre, Deerpark Industrial Estate, Oranmore, Co. Galway, H91 H9T8, Ireland. Because we are established in Ireland, our lead supervisory authority is the Irish Data Protection Commission (see section 6.5). You can reach us about anything in this policy, including any privacy or data protection request, at hamish@harborseo.ai.

This policy applies to everyone who uses Harbor and reflects our obligations under the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, the California Consumer Privacy Act (CCPA) and other applicable data protection laws.

This policy explains what we do with your data. It is not itself a consent mechanism: where we rely on your consent — for analytics and marketing cookies, or for marketing email — we ask for it separately, and you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us:

• Account Information: Name, email address, password, and profile details
• Billing Information: Payment card details, billing address (processed securely by our payment processors)
• Content Data: URLs, topics, keywords, and other inputs you provide for content generation
• Generated Content: Articles, drafts, and other content created using our Service
• Communications: Messages, feedback, and support requests you send to us
• Profile Preferences: Settings, customizations, and preferences for content generation
• Connected Accounts: Tokens and data you authorise us to access, such as Google Search Console properties or a WordPress or Shopify site you connect for publishing

2.2 Automatically Collected Information

When you access our Service, we automatically collect:

• Usage Data: Features used, content generated, API calls made, time spent on platform
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, clicks, and navigation paths
• Performance Data: Error reports, performance metrics, and debugging information
• Product Analytics and Session Replay: Where you have consented to analytics, our product analytics provider (PostHog) records page interactions so we can see how features are used. Form inputs are masked in these recordings
• Cookie Data: Information collected through cookies and similar technologies (see our Cookie Policy)

2.3 Information from Third Parties

We may receive information from:

• Authentication Providers: Profile information from Clerk authentication service
• Payment Processors: Transaction and payment verification data from Stripe
• Analytics and Advertising Services: Usage statistics from PostHog and Google Analytics, and conversion measurement data from Google Ads, where you have consented
• Affiliate Partners: Referral and attribution data from TrackDesk where you arrived through an affiliate link
• AI and Data Providers: Processing confirmations and usage data from the providers listed in section 4.1

3. How We Use Your Information

We use the collected information for the purposes below. Under Article 6 GDPR, every purpose has a legal basis, which we state alongside it.

3.1 Service Provision

• Process your content generation requests
• Provide AI-powered SEO content and recommendations
• Manage your account and subscriptions
• Authenticate and authorize access
• Store and manage your generated content
• Publish content to the sites you connect, at your instruction

Legal basis: performance of our contract with you (Article 6(1)(b)). Without this processing we cannot provide the Service.

3.2 Improvement, Security and Development

• Analyze usage patterns to improve our Service
• Develop new features and functionality
• Diagnose faults, monitor system performance, and manage capacity and cost
• Detect, prevent, and address fraud, abuse, and security issues

Legal basis: our legitimate interests (Article 6(1)(f)) in keeping the Service working, secure and free from abuse, and in understanding which features our customers actually use so we can improve them. Where this work relies on analytics cookies or similar technologies, we only carry it out after you have opted in (see section 7). You can object to processing based on legitimate interests at any time (section 6).

3.3 AI Content Generation

We send the inputs you provide — such as topics, keywords, URLs and brand information — to the AI and data providers listed in section 4.1 solely to produce the content you asked for.

We do not use your content, prompts or generated output to train Harbor's AI models, and our AI providers are contractually prohibited from using them to train their general-purpose models. Prompts are sent to AI providers only to fulfil the generation you requested.

Legal basis: performance of our contract with you (Article 6(1)(b)).

3.4 Communication

• Send you service updates and notifications
• Respond to your inquiries and support requests
• Send billing and payment confirmations
• Provide important security or policy updates
• Send promotional communications about Harbor

Legal basis: transactional and service messages are necessary for our contract with you (Article 6(1)(b)) or required by law. Marketing email is sent on the basis of your consent (Article 6(1)(a)), or, where you are an existing customer and local law permits it, our legitimate interest in marketing similar services to you (Article 6(1)(f)). Every marketing email contains an unsubscribe link.

3.5 Legal and Regulatory Compliance

• Keep invoices, payment records and tax records
• Comply with legal obligations and respond to lawful requests
• Establish, exercise or defend legal claims, and enforce our Terms of Service
• Protect the rights, property, and safety of Harbor, our users, and the public

Legal basis: compliance with a legal obligation (Article 6(1)(c)) for tax, accounting and statutory record-keeping; our legitimate interests (Article 6(1)(f)) in defending claims and enforcing our terms.

3.6 Analytics and Marketing Measurement

• Measure how visitors find and use our website
• Measure the effectiveness of our advertising and affiliate campaigns
• Record page interactions through session replay, with form inputs masked

Legal basis: your consent (Article 6(1)(a)), given through our cookie banner. For visitors in the EU/EEA, the UK and Switzerland, analytics and marketing technologies are not loaded until you opt in, and you can withdraw consent at any time through the "Cookie settings" link in the footer.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Processors and Service Providers

We use the third parties below to run Harbor. They process personal data on our documented instructions under written data processing terms, and may not use it for their own purposes. A current list of our sub-processors is maintained at /subprocessors.

Platform and infrastructure

• Clerk: Authentication, sessions and user management
• Convex: Application database and backend hosting
• Vercel: Website and application hosting, CDN, and custom domains
• Supabase: Content storage for generated sites
• Svix: Webhook delivery and signature verification

Payments and communications

• Stripe: Payment processing, subscriptions and billing
• Resend: Transactional and marketing email delivery

Analytics and marketing measurement (loaded only with your consent, as described in section 3.6)

• PostHog (EU hosting): Product analytics and session replay, with form inputs masked
• Google Analytics and Google Ads: Website analytics and advertising conversion measurement
• TrackDesk: Affiliate referral attribution

AI and data providers used to generate content on your instruction

• OpenAI, Anthropic, Google (Gemini) and OpenRouter: Text and image generation from the inputs you provide
• Google APIs (Search Console, Google Ads, PageSpeed Insights, Trends): Search performance, keyword and page data used to inform your content
• Jina AI and Bright Data: Fetching and reading the web pages whose URLs you supply

As stated in section 3.3, these providers may not use your content to train their general-purpose models.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal process (subpoenas, court orders, search warrants)
• Governmental or regulatory requests
• Requests to investigate potential violations of our Terms
• Protect the safety of any person or prevent illegal activity

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Service of any such change.

4.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

5. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

Retention Periods

• Account Data: Retained while your account is active and for a reasonable period after deletion
• Generated Content: Retained according to your plan and storage limits
• Billing Records: Retained for 7 years to meet Irish tax and accounting obligations
• Log Data: Retained for 90 days for security and debugging purposes
• Analytics and Session Replay: Retained by our analytics providers for no longer than their standard retention periods, and deleted when you withdraw consent
• Marketing Data: Retained until you withdraw consent or opt-out

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we need to retain it for legal compliance, dispute resolution, or fraud prevention.

6. Your Rights and Choices

6.1 GDPR Rights (European Users)

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to our processing of your data, including processing based on legitimate interests and direct marketing
• Right to Withdraw Consent: Withdraw consent for processing based on consent
• Right to Lodge a Complaint: File a complaint with a data protection authority (see section 6.5)

6.2 CCPA Rights (California Users)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (note: we do not sell personal information)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

Section 13 sets out these rights in full, together with the equivalent rights for residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other US states with comparable laws.

6.3 How to Exercise Your Rights

You can exercise these rights in two ways:

• In the app: open the "Your data" controls in your dashboard settings, where you can export a copy of your data and request erasure of your account and content
• By email: write to hamish@harborseo.ai and tell us which right you want to exercise

We respond within one month of receiving your request, as required by Article 12(3) GDPR. If your request is particularly complex, or you have made several requests, we may extend this by up to two further months and will tell you why within the first month.

Exercising your rights is free. We only charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive, and we will explain our reasoning if that ever happens.

We may need to verify your identity before processing your request to protect your privacy and security.

6.4 Marketing Communications and Cookie Choices

You can opt out of promotional emails by clicking the "unsubscribe" link in any marketing email or by updating your preferences in your account settings. You cannot opt out of transactional emails related to your account or the Service.

You can change or withdraw your cookie consent at any time using the "Cookie settings" link in the footer of our website. See our Cookie Policy for details.

6.5 Supervisory Authority

We would like the chance to resolve your concern directly, so please contact us first. You can also complain to a supervisory authority at any time. Our lead supervisory authority is the Irish Data Protection Commission:

If you are in the EU or EEA, you may also lodge a complaint with the data protection authority in the country where you live or work, or where the issue arose. Users in the United States should see section 13; other users outside the EU/EEA can find their relevant authority in section 14.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to keep you signed in, to remember your cookie choices, and — where you consent — to measure how our website and product are used and how our advertising performs.

For visitors in the EU/EEA, the UK and Switzerland, analytics and marketing cookies are only loaded after you opt in through our cookie banner. Your choices are stored for six months and you can change or withdraw them at any time using the "Cookie settings" link in the footer.

For a full inventory of the cookies and browser storage we use, see our Cookie Policy.

You can also control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in and using the Service.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Security Measures Include:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication mechanisms
• Least-privilege access to production systems and customer data
• Employee training on data protection and privacy
• Incident response and breach notification procedures, including notification to the Data Protection Commission within 72 hours where required
• Regular backups and disaster recovery planning

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

9. International Data Transfers

Harbor is operated from Ireland, but some of the providers listed in section 4.1 are based outside the European Economic Area, principally in the United States. This means your information may be transferred to, stored, and processed in countries whose data protection laws differ from your own.

When we transfer personal data outside the EEA, we rely on appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission, which we put in place with our providers
• The EU-US Data Privacy Framework, where applicable — that is, where a US provider is certified under it
• Transfer risk assessments and additional technical measures such as encryption in transit and at rest

You can request a copy of the safeguards we use for a specific transfer by emailing hamish@harborseo.ai.

10. Automated Decision-Making and Profiling

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, solely by automated means within the meaning of Article 22 GDPR.

Harbor uses AI to generate content, keyword ideas, topic suggestions and SEO recommendations. These are suggestions: you review them, edit them, decide whether to publish them, and remain in control of what goes on your website. Nothing in the Service automatically decides your eligibility, pricing, or access to a service without human involvement.

We also use analytics to understand aggregate product usage. This is not used to build behavioural profiles that affect your rights or the terms on which we serve you.

11. Data We Process on Our Customers' Behalf

Some Harbor features involve data about our customers' own website visitors. When a customer installs the Harbor tracking snippet on their website, Harbor acts as a processor on that customer's behalf and the customer is the controller of that data.

In that role we process a limited set of information about visits to the customer's site:

• The page URL visited
• The referrer
• The utm_source value, where present
• Connection metadata such as IP address and user agent, which are transmitted as part of the request

We process this data only to provide the analytics and reporting features the customer has asked for, on their documented instructions. The customer is responsible for its own visitor-facing privacy notice and for obtaining any consent required in the jurisdictions where its visitors are located.

Our data processing terms for this relationship are available at /dpa. If you are a visitor to a customer's site and want your data corrected or deleted, please contact that website's operator; we will support them in responding.

12. Children's Privacy

Harbor is a business tool and is not intended for children. In Ireland and across the European Economic Area, the age of digital consent is 16, and we do not knowingly collect personal data from anyone under 16. Elsewhere, our Service is not intended for anyone under 13, or such higher age as local law requires.

If we become aware that we have collected personal information from a child below the applicable age without parental consent, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child, please contact us immediately at hamish@harborseo.ai.

13. United States State Privacy Rights

This section applies in addition to the rest of this policy. It does not replace or limit anything set out above: the protections described elsewhere in this policy, including those we provide under the GDPR, continue to apply in full.

13.1 Who This Section Applies To

This section applies to residents of US states with comprehensive consumer privacy laws, including California (CCPA, as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon and Montana, and to residents of other states with comparable laws as those laws take effect. Where a right described below is available only to residents of particular states, we say so.

13.2 Categories of Personal Information We Collect

In the 12 months before the date of this policy, we collected the following categories of personal information, described using the categories set out in the CCPA. We collect them for the purposes given in section 3, share them with the service providers listed in section 4.1, and keep them for the periods set out in section 5.

• Identifiers: name, email address, account identifier, and IP address
• Commercial information: subscription plan, transaction and payment records, and billing history
• Internet or other electronic network activity information: usage of the Service, pages viewed, features used, and interactions with our website and product, including session replay where you have consented
• Geolocation data: coarse, country-level location inferred from your IP address
• Inferences: conclusions drawn from the above for product analytics, such as which features a segment of users adopts

We collect this information from you directly, automatically as you use the Service, and from the third parties listed in section 2.3.

We do not collect sensitive personal information as defined by the CPRA. We do not process biometric information or precise geolocation data, and we do not knowingly collect personal information from anyone under 16 (see section 12).

13.3 Your Rights

Depending on the state you live in, you have the right to:

• Know and access: ask what personal information we collect, use and disclose about you, and get a copy of it
• Delete: ask us to delete the personal information we hold about you
• Correct: ask us to correct inaccurate personal information
• Portability: receive your personal information in a portable and, where technically feasible, readily usable format
• Opt out of sale or sharing: opt out of the "sale" of personal information and of "sharing" for cross-context behavioural advertising (see section 13.4)
• Opt out of targeted advertising and profiling: opt out of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects — we do not carry out that kind of profiling (see section 10)
• Limit the use of sensitive personal information: we do not collect sensitive personal information and do not use it to infer characteristics about you, so there is nothing to limit
• Non-discrimination: we will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right
• Appeal: if we refuse your request, you may appeal that decision by replying to the email in which we told you our decision. We will respond to your appeal in writing, and will explain how to complain to your state attorney general if we uphold our refusal. Residents of Virginia, Colorado and Connecticut, among others, have this right by law; we make it available to everyone

13.4 Sale and Sharing of Personal Information

We do not sell your personal information for money, and we never have. However, US state privacy laws define "sale", "sharing" and "targeted advertising" broadly. Our use of advertising cookies for Google Ads conversion measurement and audience signals may constitute "sharing" for cross-context behavioural advertising, or "targeted advertising", under some of those laws.

You can opt out at any time using the "Your privacy choices" or "Cookie settings" link in the footer of our website — both open the same panel, where turning off marketing cookies stops any sharing.

We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out of sale and sharing. If your browser or extension sends a GPC signal, marketing cookies are switched off automatically and no further action is needed from you.

13.5 How to Exercise Your Rights

• By email: write to hamish@harborseo.ai and tell us which right you want to exercise
• In the app: open Settings and use the "Your data" controls to export a copy of your data or request erasure

We verify requests using the email address on your account, so please write from that address. An authorised agent may submit a request on your behalf if they provide written permission signed by you; we may still contact you to confirm.

We respond within 45 days. If we need more time, we may extend this by a further 45 days and will tell you why within the first 45. Exercising these rights is free of charge.

13.6 Notice at Collection

We collect the categories listed in section 13.2 — identifiers, commercial information, internet or network activity, coarse geolocation and inferences — to provide and secure the Service, bill you, support you, communicate with you, and, with your consent, to measure how our website and advertising perform. We do not sell personal information for money. We keep each category only for the retention periods stated in section 5, principally: billing records for 7 years to meet Irish tax and accounting obligations, log data for 90 days, and account data for the life of your account and a short period afterwards, with deletion or anonymisation within 30 days of account deletion except where we must keep records for legal reasons.

14. Additional Information for Specific Jurisdictions

Our lead supervisory authority is the Irish Data Protection Commission (section 6.5). If you are a United States resident, see section 13. If you are elsewhere outside the EU/EEA, the following authorities also apply:

14.1 Australia

Australian users have rights under the Privacy Act 1988 (Cth). If you have a complaint about how we handle your personal information, please contact us. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

14.2 United Kingdom

UK users have rights under the UK GDPR and Data Protection Act 2018. You may lodge complaints with the Information Commissioner's Office (ICO).

14.3 Canada

Canadian users have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA). You may file complaints with the Office of the Privacy Commissioner of Canada.

15. Third-Party Links and Services

Our Service may contain links to third-party websites, products, or services that are not owned or controlled by Harbor. We are not responsible for the privacy practices of these third parties.

We encourage you to review the privacy policies of any third-party services you access through our platform.

16. AI and Content Generation

When you use our AI-powered content generation features:

• Your prompts and inputs are sent to the AI and data providers listed in section 4.1, solely to produce the content you requested
• Pages you ask us to analyse are fetched by our scraping providers using the URLs you supply
• Generated content is stored in accordance with your plan's storage limits
• You retain ownership of all content generated using our Service
• AI output can be inaccurate — you are responsible for reviewing content before publishing it

We do not use your content to train Harbor's models, and our AI providers are contractually prohibited from using your data to train their general-purpose models.

17. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date
• Sending you an email notification (for significant changes)
• Displaying a prominent notice on our Service
• Asking for your consent again where the law requires it

We encourage you to review this page periodically so you know how your data is handled.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made multiple requests, in which case we will tell you within the first month.