Privacy Policy

This Privacy Notice for Harbr Change (doing business as Harbr Change) describes how and why we might access, collect, store, use, and/or share your personal information when you use our services, including when you visit our website at https://app.harbrchange.com or use Harbr Change, our AI-powered change management platform.

Questions or concerns? Contact us at phil@harbrchange.com.

1. What Information Do We Collect?

We collect personal information you voluntarily provide when you register on the Services or use them. This includes:

• Email addresses
• Names
• Job titles
• Programme data entered by users (stakeholder names, organisational details, change programme information)

We do not process sensitive personal information (racial/ethnic origins, health data, etc.).

2. How Do We Process Your Information?

We process your information to:

• Facilitate account creation and authentication
• Deliver our services to you
• Respond to user enquiries
• Send administrative information
• Request feedback
• Protect our services from fraud
• Identify usage trends to improve the platform
• Power AI document generation via Anthropic's API

3. Legal Bases for Processing

We rely on the following legal bases under UK GDPR:

• Performance of a Contract — to provide the service you signed up for
• Legitimate Interests — to improve the platform, prevent fraud, and deliver AI-powered features
• Legal Obligations — where required by law

4. When Do We Share Your Information?

We share your data with the following third-party service providers (our sub-processors):

• Anthropic — AI document generation (processes user-entered programme data). Processing location: United States.
• Supabase — database, authentication, and file storage hosting. Processing location: United Kingdom (eu-west-2, London).
• Vercel — website and application hosting. Processing location: United States.
• Resend — transactional email delivery (account and notification emails). Processing location: United States.

We do not sell your personal information. We do not share it with advertisers or business affiliates.

5. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication sessions and analytics. For full details, see our Cookie Notice.

6. AI-Powered Services

Harbr Change offers AI document generation powered by Anthropic's Claude API. When you generate artefacts, your programme data is sent to Anthropic for processing. To opt out, contact us at phil@harbrchange.com.

Anthropic does not train its models on data submitted through its commercial API (Anthropic Commercial Terms, Section C; Anthropic Data Processing Addendum, Section B.3.b). Anthropic retains this data only for the duration of our agreement with Anthropic and deletes it within 30 days of that agreement's termination or expiration, except where retention is required to comply with law, resolve disputes, or address violations of Anthropic's usage policies (Anthropic Data Processing Addendum, Section H.1.b). Anthropic's current subprocessors are listed at trust.anthropic.com/subprocessors.

7. International Data Transfers

We use the following infrastructure providers. Some of these may process your data outside the United Kingdom:

• Supabase (database, authentication, storage) — hosted in the United Kingdom (region eu-west-2, London). Your programme, stakeholder, and account data held in Supabase does not leave the UK.
• Vercel (application hosting) — currently processes requests in the United States (region: Washington, D.C. / iad1). We have not yet configured an EU hosting region for this project.
• Anthropic (AI processing) — United States.
• Resend (transactional email) — United States.

Where personal data is transferred outside the United Kingdom, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or equivalent safeguards offered by each provider) to protect that data.

8. How Long Do We Keep Your Information?

We retain your personal information for as long as you have an account with us. Upon account deletion, we will delete your data from active databases within a reasonable timeframe.

9. How Do We Keep Your Information Safe?

We implement appropriate technical and organisational security measures including encrypted data storage (Supabase), row-level security, HTTPS encryption via Vercel, and regular security reviews. No system is 100% secure, but we take all reasonable steps to protect your data.

10. Do We Collect Information from Minors?

No. We do not knowingly collect data from or market to children under 18 years of age.

11. Your Privacy Rights

Under UK GDPR, you have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, contact us at phil@harbrchange.com. You also have the right to complain to the UK Information Commissioner's Office (ICO). Our ICO registration number is [pending — ICO registration not yet submitted].

12. Do-Not-Track

We do not currently respond to Do-Not-Track browser signals as no uniform standard has been finalised.

13. Updates to This Notice

We may update this Privacy Notice from time to time. The updated version will be indicated by the 'Last updated' date at the top of this page.

14. Contact Us

For questions about this Privacy Notice, contact our Data Protection Officer:

Phil Horton
Data Protection Officer, Harbr Change
phil@harbrchange.com
United Kingdom

Harbr Change Ltd
Company number: 17377475
Registered office: [pending]

15. How to Review, Update, or Delete Your Data

To request access to, correction of, or deletion of your personal data, email us at phil@harbrchange.com.