Privacy

Who we are

Harper is a UK-based AI marketing service operated by Bond Design & Co Ltd. Our data controller for the purposes of UK GDPR is Bond Design & Co Ltd. Contact: admin@harpsai.com.

What we collect

• Account data — your email address, name, business name, and business profile information you share with us during onboarding (including voice recordings if you use voice intake).
• Brand data — logos, images, sample copy, claims, and other brand assets you upload or generate within Harper.
• Ad account credentials — encrypted OAuth refresh tokens for the ad platforms you choose to connect (Meta, LinkedIn, Google Ads, TikTok, Google Business Profile). We never see your password; we only hold a token that lets Harper act in your account on your behalf.
• Generated content — copy, images, video, and campaign structures Harper produces for you. You own this.
• Lead data — names, emails, and form fields submitted to landing pages Harper hosts on your behalf. You are the data controller for this data; Harper acts as your processor.
• Usage data — basic logs of which features you use, when, and from which device. Used to operate the service and find bugs. Not sold.

Why we collect it

To run the service. Each item above is collected only to make Harper work for you. No data is collected for advertising or resale.

Third parties we share data with

Harper relies on the following processors. We only share the minimum data needed for each to do its job.

• Anthropic — generates text and reasoning. Your business profile and brand context are sent so generations stay on-brand. Anthropic does not train on your data.
• FAL.ai — generates images and video. Prompts (not your account data) are sent.
• Supabase — hosts our database and authentication. Account data is stored here, encrypted in transit and at rest.
• Stripe — handles billing. Payment card details go directly to Stripe; Harper never sees them.
• Vercel — hosts the Harper application. Standard server logs apply.
• Brevo — sends transactional and notification emails on our behalf. Recipient email addresses are shared.
• Ad platforms you connect — Meta, LinkedIn, Google Ads, TikTok, Google Business Profile. Each receives only the data needed to create campaigns in your account.

Where your data lives

Our primary database (Supabase) is hosted in the EU. Some processors store data in the United States; transfers are covered by Standard Contractual Clauses or equivalent safeguards.

How long we keep it

We keep your data while your account is active and for 30 days after cancellation, so you can export anything you need. After 30 days, account data is deleted unless retention is required by law. Generated content and brand assets you produced remain available for export until full deletion.

Your rights (UK GDPR)

• Access — request a copy of the data we hold about you.
• Rectify — correct anything that's wrong.
• Delete — ask us to delete your data ("right to be forgotten").
• Port — receive your data in a machine-readable format.
• Object — object to processing for specific reasons.
• Withdraw consent — at any time, for processing based on consent.

Email admin@harpsai.com to exercise any of these rights. We aim to respond within 7 days and will always respond within 30 days, as required by UK GDPR.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we've mishandled your data.

Cookies

We use essential cookies for authentication and security (Supabase session cookies). We do not use third-party tracking, advertising, or analytics cookies at this time. If that changes, this page will update first and you'll be asked for consent.

Children

Harper is not directed to children under 13. We do not knowingly collect data from anyone under 13.

Changes to this policy

We will update this page if our practices change. Material changes will be communicated by email to active customers before they take effect.

Contact

Privacy questions or requests: admin@harpsai.com. We read these.