Sub-processors
Last updated · July 2026
1. About This Page
Harbor uses a small number of third-party providers to deliver our Service. Where those providers process personal data on our behalf, they act as our sub-processors under the General Data Protection Regulation (GDPR) and equivalent laws.
This page lists every sub-processor we currently use, what they do for us, the categories of personal data they may process, and where that processing takes place. It is maintained alongside our Privacy Policy and our Data Processing Addendum.
Each sub-processor is bound by a written contract that requires it to protect personal data and to process it only for the purposes we specify.
2. Infrastructure and Platform Sub-processors
These providers run the Harbor product itself — accounts, data, hosting, payments, and communications.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Clerk | Authentication & user identity | Name, email, auth metadata | US/EU |
| Convex | Application database & backend | All account and content data | US |
| Vercel | Hosting, CDN, custom domains | Request metadata, IP | US/EU edge |
| Stripe | Payments & subscriptions | Name, email, billing address, payment metadata | US/EU |
| Resend | Transactional and marketing email delivery | Name, email | US/EU |
| Svix | Webhook signature verification | Webhook payload metadata | US |
| Supabase | Content storage for generated sites | Site content | EU/US |
3. Analytics and Marketing Sub-processors
These providers help us understand how the Service is used and measure our own marketing.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| PostHog (EU Cloud) | Product analytics & session replay | Usage events, pseudonymous IDs, email when signed in | EU (Frankfurt) |
| Google (Analytics, Ads) | Marketing measurement | Pseudonymous IDs, hashed contact data for enhanced conversions | US/EU |
| TrackDesk | Affiliate attribution | Click ID | EU |
4. AI and Content Sub-processors
These providers process the prompts, URLs, and content you submit when you ask Harbor to generate or research content. They act on your instruction and only for the request you have made.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| OpenAI, Anthropic, Google (Gemini), OpenRouter | AI content generation on the customer's instruction | Prompts and content the customer submits | US/EU |
| Jina AI, Bright Data | Fetching and reading web pages the customer specifies | Target URLs, page content | US/EU |
| Google Search Console API, Google Ads API, Google PageSpeed Insights, Google Trends | Search performance and keyword data for sites the customer connects | The customer's own site data | US/EU |
5. International Transfers
Some of the sub-processors above process personal data outside the European Economic Area, primarily in the United States.
Where personal data is transferred outside the EEA, we rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework, together with any additional technical and organisational measures required to protect the data.
A copy of the transfer mechanism relied on for a particular sub-processor is available on request at hamish@harborseo.ai.
6. Notice of New Sub-processors
We give customers 30 days' notice before adding a new sub-processor or replacing an existing one. Notice is given by updating this page and, where the change is material, by email to the account owner.
If you object to a new sub-processor on reasonable data protection grounds, you may tell us within the notice period at hamish@harborseo.ai. We will work with you to find an alternative, and if we cannot, you may terminate the affected part of the Service.
To be notified of changes to this page, email hamish@harborseo.ai and ask to be added to our sub-processor notification list.
7. Contact
Questions about this page, our sub-processors, or the safeguards applied to them:
Kraft Agency Limited, trading as Harbor / Harbor SEO
Unit 2A, Deerpark Business Centre, Deerpark Industrial Estate, Oranmore, Co. Galway, H91 H9T8, Ireland
Company registration (CRO) number: 681636
VAT number: IE3733031EH
Email: hamish@harborseo.ai
We aim to respond to all legitimate requests within 30 days.
This list forms part of our Data Processing Addendum. Customers who have signed a DPA with Harbor are authorising the sub-processors listed above.