Harbor
Sign inRequest access
Sign inRequest private access
Harbor legal

Privacy Policy

How Harbor intends to collect, use, disclose, retain, and protect information across the website and private-alpha platform.

Pre-launch draftLast updated August 11, 2026
Draft for counsel review

This page is a product and policy scaffold. It should not be published as Harbor’s final legal agreement until the legal entity, jurisdiction, vendors, security commitments, commercial terms, and required notices are confirmed.

1. Scope

This draft describes how Harbor intends to handle personal information when people visit the Harbor website, request access, create an account, or use the private-alpha platform. It does not apply to third-party websites, federal data systems, or services that Harbor does not control.

2. Information we collect

The information available to Harbor depends on how a person or company uses the service. Payment-card details are collected by Harbor’s payment provider and are not stored in Harbor’s application database.

  • Account and profile information, such as name, work email, authentication records, company affiliation, and workspace role.
  • Billing information, such as the selected plan, billing interval, subscription status, customer identifier, invoice history, and billing contact details.
  • Company and pursuit content submitted to Harbor, including company identity, registrations, capabilities, evidence files, past performance, opportunity decisions, quote assumptions, proposal materials, and workflow records.
  • Public federal-market information retrieved from connected sources, including opportunity notices, amendments, attachments, identifiers, dates, and award context.
  • Technical and usage information needed to operate and protect the service, such as device, browser, IP address, timestamps, diagnostic events, and feature interactions.
  • Communications sent through access requests, support conversations, feedback, or other direct contact.

3. How we use information

  • Provide, maintain, authenticate, and secure Harbor.
  • Create and administer workspaces and support authorized collaboration.
  • Process company evidence and federal-market information to deliver requested analysis, workflow, extraction, and generation features.
  • Respond to access requests, support questions, product feedback, and service communications.
  • Understand reliability and product usage, prevent misuse, and improve Harbor.
  • Meet legal obligations and enforce applicable agreements.

4. AI-assisted processing

Harbor features may send selected content to service providers that support document extraction or AI-assisted analysis. Those providers should receive only the information needed to perform the requested operation under the applicable service terms. The production policy must identify the actual provider configuration and any customer-data training controls before public launch.

5. When information may be shared

  • With infrastructure and service providers that support hosting, databases, authentication, storage, payments, diagnostics, communications, document processing, or AI-assisted features.
  • Within the customer workspace, according to membership, permissions, and product configuration.
  • When required by law or reasonably necessary to protect Harbor, its users, or the public.
  • In connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections.
  • At the direction of the customer or with the individual’s consent.

6. Sale and targeted advertising

Harbor does not currently intend to sell personal information or use private customer content for cross-context behavioral advertising. This statement must be confirmed against the production analytics, advertising, and vendor configuration before launch.

7. Retention and deletion

Harbor intends to retain information only while it is needed to provide the service, maintain security and business records, resolve disputes, or meet legal obligations. Specific retention periods and workspace-deletion procedures must be finalized before production launch.

8. Security

Harbor uses administrative, technical, and organizational measures intended to protect information. No system is perfectly secure. Customers remain responsible for choosing appropriate content for the current unclassified private-alpha environment and for protecting their account credentials.

9. Choices and privacy rights

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, portability, restriction, or information about how personal information is used. Harbor will need a verified request process, response timeline, and appeal process before relying on this section in production.

10. Children

Harbor is a business service for government-contracting teams and is not directed to children under 13. Harbor does not knowingly seek personal information from children.

11. Changes to this policy

Harbor may update the production policy as the service, vendor configuration, and legal requirements evolve. Material changes should be communicated through the service or another appropriate channel.

12. Contact

Before launch, Harbor must add the legal entity name, mailing address, privacy contact, and any required jurisdiction-specific notices. Until then, privacy questions can be raised through the Request Access page.

Questions before launch?

Define the policy around the real deployment.

Use the access conversation to surface data, security, procurement, and commercial requirements early.

Request private access