Who is responsible
The Agalma Tech, LLC is responsible for personal data we process to operate HarperHarbor, including account administration, billing, security and support. Contact: privacy@harperharbor.com.
This Policy covers the HarperHarbor website, console, APIs and related Services. An App you use may independently decide how to collect and use data within that App; its own privacy policy applies to that processing. Where we process data on an organization’s instructions under a separate data-processing agreement, that agreement also applies. This Policy does not imply that every third party acts as our processor.
What we collect and why
| Data | Purpose |
|---|---|
| Account details: public account number, nickname, avatar, email and sign-in information | Account access, authentication and support |
| Wallet records, orders, usage, refunds and payment references | Providing credits, metering usage, resolving billing issues and meeting applicable recordkeeping obligations |
| Agent configurations, Lorebooks, media, notes, messages and model output | Storing, displaying and processing the content you use with the Services |
| App authorizations, access credentials and security or moderation records | Applying permissions, protecting accounts and investigating abuse or disputes |
| Connection and device information, such as IP address, browser information and error reports | Operating and securing the Services and diagnosing failures |
We do not sell personal data or use your content to train our own models without your explicit opt-in. Upstream model providers are addressed separately below.
Where data comes from
We receive data you provide when you register, upload content, use a model, contact support or submit a rights request. We also receive content and requests from Apps you authorize, responses from model providers, and the technical records created when your device or App connects to the Services. Payment providers supply the transaction information needed to confirm and reconcile payments.
Support correspondence may include your contact details, a description of the issue and records you choose to provide. Please share only what is needed to investigate, and do not send passwords, API keys, recovery codes or full payment-card details. If you provide another person’s information, ensure you have the authority or other lawful basis to do so.
Account and authentication information is needed to provide an account; content is needed to fulfill the requests you submit. Withholding necessary information may prevent us from providing the relevant feature. You can choose which optional content to submit and which Apps to authorize.
Grounds for processing
Where applicable data-protection law requires a lawful basis, we process data as necessary to provide the Services you request or take steps at your request before an agreement; meet legal obligations such as required transaction records; or pursue legitimate interests in securing accounts, preventing abuse, resolving disputes and diagnosing service failures, subject to your rights and the required balancing of interests.
Where a particular optional use requires consent, we ask for that consent separately. You may withdraw it through the relevant setting or by contacting privacy@harperharbor.com. Withdrawal does not affect processing that was lawful before withdrawal, or processing that must continue on another valid basis. Accepting the Terms is not blanket consent for every possible data use.
Apps you authorize
An App’s access depends on the permissions you grant and the permissions of the resource it requests:
- Profile and wallet: an authorized App can read your public account number, nickname, avatar and shared wallet balance. Its wallet ledger access is limited to entries attributed to that App.
- Email: an App can receive your email if you separately grant email access.
- Content: content permissions can include reading your own private agent configurations and Lorebooks, and creating, modifying or deleting agent configurations, Lorebooks and media. Authorizing an App is not limited to sharing public content.
- Conversations and model use: the relevant permissions allow an App to submit content for generation and spend credits from your wallet. Conversation access is limited by account and App permissions.
These permissions do not grant platform staff privileges. You can revoke an App’s authorization from your account; revoked credentials can no longer make authorized requests. Revocation does not erase information the App already received. Its use and retention of that information are governed by its own privacy policy.
Storage and service providers
Our primary services are located in the United States. Some requests may be processed and content may be cached in other countries.
Model requests are sent to the upstream provider serving the selected model or route. These requests can include messages, agent configuration instructions, Lorebook entries and other context needed for generation, including any personal information you put in that content. Processing locations and retention or training practices depend on the provider and service terms; we do not make a blanket promise that every provider retains nothing or never uses data for training.
If you reference an externally hosted image or other media, its source remains responsible for that hosted file. Loading it can disclose connection information to that host. Media with a public URL can be accessed by anyone who has that URL. Publicly shared content can also be viewed or copied by others; content submitted for review may be accessed by authorized reviewers.
Who else may receive data
In addition to authorized Apps and model providers described above, the following recipients may receive data where needed for the stated purposes:
| Recipient | Purpose and scope |
|---|---|
| Hosting, storage, network and communications providers | Operating the Services, delivering content and sending account or support communications; the data needed for the service they perform |
| Authorized staff and support or moderation personnel | Resolving a reported issue, investigating abuse or reviewing submitted content; access relevant to that task |
| Payment providers | Processing and reconciling purchases, refunds and disputes |
| Legal or professional advisers and competent authorities | Establishing or defending legal claims, complying with lawful requirements, or addressing a serious safety or security issue; relevant information only |
A proposed merger, acquisition or transfer of the Services may require limited disclosure to advisers or a successor, subject to appropriate confidentiality and data-protection requirements. A change of operator does not by itself authorize unrelated uses of your data; material changes will be communicated as required.
You can contact privacy@harperharbor.com for information about the providers or international-transfer arrangements relevant to your use. We will address applicable transfer requirements before making transfers that require additional safeguards. This Policy does not represent that every provider offers the same location, retention or training terms.
Payments
Stripe processes payment information under its own privacy policy. We do not store your full card number. We retain order, amount, status and payment-reference information needed to provide credits and handle billing inquiries and refunds.
Retention and deletion
We have not set a single automatic deletion period for ordinary account data and saved content. We keep it while providing the Services; content kept as part of your continuing paid use is not deleted merely because a fixed number of days has passed. This does not create a fixed deadline for deleting an unpaid account’s data.
Some temporary data, such as incomplete uploads, sign-in credentials and trial resources, has its own expiry or cleanup process. Deleting content through the product may first remove it from active use; it does not necessarily erase every database record, backup or cached copy immediately. We may retain records needed for security, disputes or applicable legal obligations, and backup copies are subject to rotation.
You can use the deletion controls available for individual content. For account deletion, a broader erasure request or a data export, contact privacy@harperharbor.com. We will verify your account and explain any information that must be retained, subject to applicable law.
We determine retention by the purpose of each record, whether the account or content is still in use, outstanding requests or disputes, security needs, and applicable recordkeeping or limitation periods. Support and security records are kept for as long as needed for their purpose and any related obligations. When data is no longer needed and no applicable requirement supports retention, we delete it or anonymize it. Backup and cache removal may follow their normal rotation rather than occur at the same instant as deletion from active use.
Deletion of an account or revocation of App access does not automatically erase copies already held by an independent App, an upstream provider or someone who copied public content. Requests concerning their independent processing may need to be directed to them; we can help identify the relevant recipient where possible.
Your rights
Depending on the law that applies to you, you may request access to and a copy of your personal data, correction, deletion, or a portable copy, and may request that processing be restricted. These rights have legal conditions and exceptions; for example, we may need to retain a transaction record while deleting unrelated account content.
Objection and consent withdrawal: where applicable, you may object to processing based on legitimate interests and withdraw consent for processing that depends on it. Contact privacy@harperharbor.com and identify the processing you want us to review.
To make a request, email privacy@harperharbor.com from your account email where possible, describe your request and identify the affected service or data. We may ask for proportionate information to verify your identity and protect other people’s data. An authorized representative may act for you where permitted by law and may need to provide evidence of authority. Do not send identification documents unless we explain why they are needed and how to provide them.
We respond within the applicable legal time limits. If a request requires an extension, cannot be fulfilled in full or is refused, we will explain the reason and available review or complaint options as required by law. You may ask us to review our response and may complain directly to the data-protection authority competent for your location or the processing. You do not have to complete our support process before exercising that right.
Browser storage
The website and console use browser storage for functions such as sign-in and display preferences. You can manage or clear that storage through your browser; doing so may sign you out or reset preferences, and does not itself delete data stored on our servers. Connected Apps, external media hosts and payment providers may use their own storage technologies under their respective policies.
Security and incident handling
We use measures appropriate to the data and risks, including encrypted web connections, authentication and access controls. Access permissions and credential revocation help limit who can use an account or private content. No online service can guarantee that every incident will be prevented.
If you suspect an account compromise, revoke affected credentials where possible and contact support@harperharbor.com. For a personal-data concern, contact privacy@harperharbor.com. We investigate reported incidents and provide notices to affected people or authorities where applicable law requires them.
Children
The Services are not directed at people under 18. If you believe a minor has created an account, contact us so we can investigate and take appropriate action.
Changes
We will post changes here with a new updated date and notify account holders of material changes through the Services or their account email. If a new purpose requires your consent, a policy update alone does not provide that consent. Questions about this Policy or its application can be sent to privacy@harperharbor.com.