Privacy policy

About us

harperOS helps business leaders architect, build, and implement AI Operating Systems. We provide consulting and implementation services: Knowledge Architecture, Expert AI Assistants, and Automated Workflows.

• Website: https://www.harperos.ai
• Email: mc@harperOS.ai
• Privacy inquiries: privacy@harperOS.ai
• Legal entity: harperOS (Delaware, USA)

1. About this privacy policy

This Privacy Policy applies when you:

• Visit our website (harperos.ai)
• Request information about our services
• Engage harperOS for consulting services
• Contact us

Important: We handle two types of data differently:

1. harperOS's own data (website visitors, marketing) — We're the data controller
2. Client data (processed to build AI systems) — We act as a data processor/service provider

For client data, we process it under your company's instructions and our Data Processing Agreement. If you have questions about how your company handles your data, contact them directly.

2. Who is responsible for processing your personal data?

We process your personal data as Data Controller when it's our own data (website visitors, marketing, business operations).

harperOS as Data Controller:

• Website visitors and marketing data
• Contact inquiries
• Business operations data
• We determine how and why we process this data

harperOS as Data Processor:

• Client data processed on behalf of clients
• We process per client instructions
• Client is the data controller
• Client data stays within client's authorized systems

If you have questions about how we handle your data, contact us at privacy@harperOS.ai.

3. The personal data we collect

We collect personal data when you use our website or services:

4. How we use your personal data and our legal basis

We process your personal data in accordance with applicable laws.

We process your personal data to:

• Provide consulting and implementation services to our clients
• Manage our relationship with clients (payments, contracts, transactions)
• Contact clients and prospects about events, demos, webinars, and new features
• Improve our website and services

Our legal basis:

• Performance of a contract with our clients
• Compliance with legal obligations
• Our legitimate interest
• Your consent (where legally required)

If we rely on your consent, you can withdraw it anytime by contacting us at privacy@harperOS.ai.

5. How long we keep your personal data

We keep your personal data only as long as necessary for the purposes in this Privacy Policy, in accordance with applicable laws.

• Delivering services, customer service, managing payments and contracts: For the duration of our agreement with clients, then archived for 5 years
• Fulfilling requests and contract-related communications: For the duration of our agreement with clients, then archived for 5 years
• Marketing communications: 3 years from last contact
• Events: For the duration of the event, then 5 years in archives
• Website analytics and technical data: 1 year from collection

6. When and with whom we share your personal data

Only authorized harperOS personnel have access to your personal data. We may share your personal data with third parties to carry out our business practices, only for the purposes described above.

Our service providers include:

• Cursor — Development and operations platform
• Notion — Documentation and knowledge management
• Cassidy — AI assistant platform (when used for client services)
• Beehiiv — Website hosting and email marketing
• Google Analytics — Website analytics

Foundational model providers (when used for client services): OpenAI, Anthropic, Mistral, Google, and other AI model providers are prohibited from using customer and personal data for model training. They apply a "Zero Data Retention" policy.

We don't use your data for advertising or marketing.

7. How we transfer your personal data globally

Your personal data may be accessed, transferred, stored, or processed outside the European Economic Area (EEA), specifically in the United States.

If we transfer your personal data outside the EU, we ensure that (i) the transfer is to a country recognized by an adequacy decision from the European Commission; or (ii) the transfer is covered by appropriate safeguards, such as Standard Contractual Clauses published by the EU Commission.

8. How we secure your personal data

We use industry-standard physical, procedural, and electronic security measures to protect your personal data.

• We store usage data in encrypted databases, inaccessible from the Internet
• Data is stored securely in our database
• We use secure cloud infrastructure with industry-standard security measures
• Access to personal data is protected with user-specific logins, passwords, and user rights

Client data security:

• Client data stays within client's authorized systems
• Work is performed inside client's AI platform environment
• We don't store client data outside client systems without consent
• We follow client security protocols

9. Your privacy rights and how to exercise them

Subject to applicable data protection laws, you have these privacy rights:

• Request confirmation that we're processing your personal data
• Request access to your personal data
• Request that we delete, update, or correct your personal data
• Request that we restrict how we use your personal data
• Request data portability (where applicable)
• Object to our processing of your personal data
• Withdraw consent (where we process based on consent)
• Lodge a complaint with the relevant data protection authority

To exercise these rights, contact us at privacy@harperOS.ai.

Response timeframes:

• We respond within 45 days (may extend to 90 days with notice)
• For European residents exercising GDPR rights, we respond within one month (may extend to two months with notice)
• For California residents exercising opt-out rights, we respond within 15 business days

10. Your California privacy rights

If you're a California resident, you have the right to:

• Access: Up to two times per year, you can request that we disclose the categories and specific pieces of personal information we've collected from you, the sources, the business purpose for collection, the categories disclosed for a commercial purpose, and the categories of third parties with whom we've shared your information.
• Deletion: You may request that we delete any personal information we've collected from or about you.
• Opt-out: You have the right to opt-out of the sale or sharing of your personal information. harperOS does NOT sell personal information.
• Non-discrimination: We won't discriminate against you for exercising your privacy rights.

To exercise your rights under California law, contact us at privacy@harperOS.ai.

11. Your Delaware privacy rights

If you're a Delaware resident, you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Delete your personal data
• Obtain a copy of your personal data (data portability)
• Opt-out of targeted advertising, sale of personal data, or profiling

To exercise your rights under Delaware law, contact us at privacy@harperOS.ai.

12. Your European privacy rights (GDPR)

If you're located in the European Economic Area (EEA) or United Kingdom (UK), you have the right to:

• Access your personal data
• Rectify inaccurate personal data
• Erase your personal data ("right to be forgotten")
• Restrict processing of your personal data
• Data portability
• Object to processing of your personal data
• Withdraw consent (where processing is based on consent)

To exercise your rights under GDPR, contact us at privacy@harperOS.ai.

13. Children's privacy

Our services are designed for business leaders and enterprises. We don't knowingly collect personal data from children under 16. If we learn that someone under 16 is using our services, we'll prohibit and block such use and make reasonable efforts to promptly delete any personal data stored with us.

If you believe we might have such data, contact us at privacy@harperOS.ai.

14. Cookies and tracking technologies

We use cookies and similar tracking technologies to track activity on our website and store certain information.

Types of cookies we use:

• Essential cookies: Necessary for the website to function properly
• Analytics cookies: Help us understand how visitors use our website (via Google Analytics)

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you don't accept cookies, you may not be able to use some portions of our website.

harperOS does NOT use advertising cookies or sell your data to third parties for advertising purposes.

15. Universal opt-out signals

Some states require us to honor universal opt-out signals, such as the Global Privacy Control ("GPC"). If you enable GPC or a similar universal opt-out signal, we'll process it as a request to opt-out of targeted advertising, sale of personal data, or profiling.

16. Links to other websites or services

Our website may include links to third-party websites and services that we don't operate. A link to a third-party website doesn't mean we endorse it. If you visit a third-party website, you're subject to its privacy practices and policies. This Privacy Policy doesn't apply to personal data you provide to other websites and services.

17. How to contact us

You may contact us regarding this Privacy Policy or our processing of your personal data at privacy@harperOS.ai.

You can also contact us at:

• Email: mc@harperOS.ai
• Website: https://www.harperos.ai

18. Updates and amendments to this privacy policy

The "Last Updated" date at the top shows when this Privacy Policy was last revised. We may update this Privacy Policy from time to time. Changes become effective when we post a revised version.

If we make changes that materially alter your privacy rights, we'll provide additional notice, such as via email or through our website.

Your use of our website and services is subject to the version of this Privacy Policy posted at the time of your use.