Privacy Policy

At a glance

• We collect the information you give us through our forms and emails, plus limited technical data about how you use our Website, including the company associated with your IP address.
• We use it to respond to you, send updates you asked for, and run and secure the Website.
• We do not sell your personal data or share it for targeted advertising.
• We do not use personal data collected through the Website to train AI models.

1. Introduction (Who We Are)

This Privacy Policy explains how Miralta Q, Inc., a Delaware corporation doing business as Harbor ("Harbor," "we," "us," or "our"), collects, uses, shares, and protects personal data when you visit https://harbor.ai/ (the "Website"), contact us, subscribe to our updates, or otherwise interact with us as a prospective customer, partner, investor, or member of the public. Harbor is the controller of this personal data. Our address is 865 Florida St Apt #1, 94110, San Francisco, CA.

Harbor builds risk assessment and insurance-related products for organizations that deploy AI agents. This Privacy Policy does not cover:

• personal data we process on behalf of our customers when providing our services, which is governed by our agreements with those customers;
• personal data of job applicants, employees, and contractors, which we cover in separate notices provided to those individuals; or
• personal data collected in connection with any insurance application, quote, policy, or claim, which will be covered by a separate insurance privacy notice.

2. What Data We Collect

We do not intend to collect sensitive personal data (such as health information, government identifiers, or financial account numbers) through the Website. Please do not submit it, or confidential business information, through our forms.

Cookies and similar technologies. We use cookies and similar technologies (such as local storage) that are strictly necessary for the Website to function. We also use analytics cookies from PostHog and Leadfeeder to understand how visitors use the Website and to identify the companies that visit it. If you are in the United States, we also use RB2B, which may identify individual visitors to the Website for sales and business-development outreach. If you are in the EEA or the United Kingdom, we only set analytics cookies if you accept them. Elsewhere, analytics cookies are on by default, and you can turn them off. You can change your choice at any time through the "Cookie settings" link. Our Cookie Policy lists the cookies we use, what they do, and how long they last. We do not use advertising cookies.

3. How We Use Personal Data

We use personal data to:

• respond to your inquiries and requests, including questions about our products, the systems that you deploy, and demo, meeting, and partnership requests;
• send updates, event invitations, and other communications you have asked for or that we are permitted to send, with an option to unsubscribe at any time;
• manage our relationships with prospective customers, partners, and investors;
• operate, maintain, secure, and improve the Website, including diagnosing technical problems and preventing fraud and abuse;
• understand, in aggregate, how visitors use the Website;
• identify the companies associated with visits to the Website, so we can understand which organizations are interested in our products and services, and if you are in the United States, match your visit to you personally and use that information to contact you about our products and services and to prioritize our outreach;
• comply with legal obligations and respond to lawful requests from authorities;
• establish, exercise, or defend legal claims; and
• carry out or evaluate a merger, acquisition, financing, or sale of assets.

We do not use personal data collected through the Website to train AI models. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. Legal Basis for Processing (EEA/UK)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under Article 6 of the GDPR and UK GDPR on the following bases:

Where we rely on legitimate interests, you may object at any time (see Section 9). Where we rely on consent, you may withdraw it at any time without affecting earlier processing.

5. Who We Share Data With

We share personal data only as described below.

Service providers. We use vendors that process personal data on our behalf and under our instructions, bound by contracts that require them to protect it:

Professional advisers. Lawyers, accountants, auditors, and insurers, under duties of confidentiality.

Corporate transactions. A buyer, investor, or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations.

Legal and safety reasons. Authorities, courts, or other parties where required by law or legal process, or where needed to protect the rights, property, or safety of Harbor, our users, or others.

With your consent or at your direction. For example, if you approve a public testimonial.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

6. International Transfers

Harbor is based in the United States, and we and our service providers process personal data in the United States and in the European Union. These countries may have data protection laws that differ from those in your country.

When we transfer personal data from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, or an adequacy mechanism such as the EU-U.S. Data Privacy Framework where the recipient is certified. You may request a copy of the relevant safeguards at legal@harbor.ai.

7. Data Retention and Storage

We keep personal data only as long as needed for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

We may keep data longer where needed to comply with legal obligations, resolve disputes, or enforce our agreements. When data is no longer needed, we delete or anonymize it.

8. How We Secure Personal Data

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption in transit (TLS), access controls limited to personnel who need the data, multi-factor authentication on our business systems, and due diligence on our service providers.

No method of transmission or storage is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires.

9. Data Subject Rights and How to Exercise Them

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete personal data;
• delete your personal data;
• receive your data in a portable format and have it transmitted to another controller;
• restrict our processing of your personal data;
• object to our processing based on legitimate interests, and object at any time to direct marketing;
• withdraw consent at any time, where we rely on consent;
• opt out of the sale or sharing of personal data, targeted advertising, and profiling that produces legal or similarly significant effects (we do not engage in these activities);
• appeal our decision on your request, where state law provides this right; and
• complain to a data protection authority or state Attorney General.

How to make a request. Email legal@harbor.ai. Tell us which right you want to exercise and how we can reach you. You can unsubscribe from marketing emails at any time using the link in each email. You can withdraw your consent to analytics cookies or change your cookie preferences at any time through the "Cookie settings" link on the Website.

We recognize and honor browser- and device-based Global Privacy Control (GPC) signals. When we receive a valid GPC signal, we will treat it as a request to opt out of certain data processing or sales/sharing of personal information, as applicable under relevant privacy laws.

At this time, we do not respond to browser “Do Not Track” (DNT) signals. DNT is not yet a standardized framework, and we do not interpret or act on these signals in our systems.

Verification. We will verify your identity using information we already hold, and we will ask for more only when necessary. An authorized agent may submit a request on your behalf with your signed permission, and we may ask you to confirm your identity directly.

Timing and cost. We respond within one month for EEA and UK requests (extendable by two months for complex requests) and within 45 days for U.S. state requests (extendable once by 45 days where permitted). Requests are free, unless they are manifestly unfounded or excessive.

Non-discrimination. We will not discriminate against you for exercising your privacy rights.

10. Automated Processing

We do not use personal data collected through the Website to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you within the meaning of Article 22 of the GDPR, Articles 22A–22D of the UK GDPR, or equivalent U.S. state laws.

Harbor's products assess the risks of AI systems deployed by organizations. Any personal data processed in delivering those products is governed by our customer agreements, not by this Privacy Policy.

11. California Residents

This section applies to California residents and supplements the rest of this Privacy Policy. It serves as our notice at collection and our disclosure under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

Personal information we collected in the past 12 months:

We do not collect sensitive personal information as defined by the CCPA. We collect these categories from the sources described in Section 2, use them for the purposes in Section 3, and keep them for the periods in Section 7.

No sale or sharing. In the past 12 months, we have not sold personal information or shared it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Your California rights. You have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. See Section 9 to make a request.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

12. Other US States Residents

If you live in a state with a comprehensive consumer privacy law, such as California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, and Delaware, you may have the rights described in Section 9, including to confirm whether we process your personal data, access, correct, delete, and obtain a copy of it, and opt out of targeted advertising, sale, and certain profiling.

Appeals. If we decline your request, you may appeal by emailing legal@harbor.ai with the subject line "Privacy Request Appeal." We will respond within the period your state's law requires. If we deny your appeal, you may contact your state Attorney General.

Nevada. We do not sell covered information as defined in Nevada Revised Statutes Chapter 603A.

13. EEA and UK Residents

If you are in the EEA or the United Kingdom, Harbor is the controller of your personal data processed through the Website. See Section 4 for our legal bases, Section 6 for international transfers, and Section 9 for your rights.

Complaints. You may complain to the data protection authority in your country of residence, place of work, or place of the alleged infringement (a list of EEA authorities is available from the European Data Protection Board), or, in the UK, to the Information Commissioner's Office. You can also complain to us directly at legal@harbor.ai. If you are in the UK, we will acknowledge your complaint within 30 days and keep you informed of its progress, as the Data (Use and Access) Act 2025 requires.

14. Children's Privacy

The Website is intended for business professionals and is not directed to anyone under 18. We do not knowingly collect personal data from children under 18. If you believe a child has given us personal data, contact legal@harbor.ai and we will delete it.

15. Changes to This Notice

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was last revised. If we make material changes, we will post a prominent notice on the Website at least 30 days before the changes take effect.

16. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact:

Miralta Q, Inc. Attn: Privacy legal@harbor.ai