1. Two kinds of data
- Our own records. Information about visitors, waitlist members and customer accounts: names, emails, billing details, support messages. We decide how this is used. Most of this policy is about it.
- Customer Content. Everything a customer and their AI agents put into their own AI company: instructions, tasks, documents, files and outputs. The customer decides how that is used, and we handle it only to run the Service for them (see our Terms, section 11). If your information is in a customer's AI company, contact that customer.
2. What we collect
When you join the waitlist: email, full name, whether you'd use OpsHarbor for your own business or for clients (and roughly how many clients), the referral code you arrived with, the page and campaign that sent you (for example, utm tags), and a one-way hash of your IP address used only to spot fake sign-ups.
When you create an account: name, email, password (stored only as a secure hash, never readable by us), company name, plan, and the people you invite.
When you pay: you enter your card on Stripe's checkout. Stripe stores it, not us. We receive limited details back: billing name and address, card brand, last four digits, and subscription status.
When you use the Service:
- Your AI provider key, encrypted, with only its last four characters readable.
- Plan and usage counts (for example, number of agents and client workspaces) to apply your plan's limits. We use counts, not the content of your work.
- Bug reports and support requests you send, including the page you were on and your browser type.
- Security logs: IP address, browser, times, pages and sign-in events.
- Agent run logs: the technical record of each run your AI agents do (steps, tool calls, errors). We keep them to troubleshoot and keep the service secure. They are not shown in the app; you can ask us for a copy at any time.
On the website: we use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you. We don't use advertising pixels or cross-site tracking. If that changes, we'll update this policy and ask for consent where the law requires.
Cookies: only the ones needed to sign you in and keep your session secure.
3. How we use it
- To run the Service: create your AI company, sign you in, apply your plan, and keep it secure.
- To run the waitlist: confirm your email, show your place in line, credit referrals, and send invites.
- To bill you and handle failed payments and cancellations.
- To send account emails (confirmations, receipts, payment problems, security alerts, important changes). You can't turn these off while you have an account.
- To send product updates and launch news, only if you joined the waitlist or opted in. Every one has an unsubscribe link, with an option to get launch emails only.
- To answer support requests and fix reported bugs.
- To prevent fraud and abuse, including fake referral sign-ups.
- To meet legal, tax and accounting duties.
We don't sell personal information, we don't share it for targeted advertising, and we don't use Customer Content to train AI models.
Legal bases (EEA and UK): to perform our contract with you; our legitimate interests in running, securing and improving the Service and in telling business contacts about it; your consent for marketing emails; and legal obligations.
4. Your AI provider
Customers connect their own AI provider account (today, Anthropic). When an agent runs, the content it works on goes from the customer's AI company straight to that provider, under the customer's own agreement with it. The provider's privacy policy covers that data. Anthropic says it doesn't train its models on content sent through its commercial API; check your own account's settings.
5. Who we share it with
We share personal information only with the service providers that help us run OpsHarbor, under contracts that limit what they can do with it:
| Provider | What they do | Data |
|---|---|---|
| Stripe | Payments, subscriptions, invoices | Billing details, email, subscription status |
| Resend | Sending account, waitlist and update emails | Email, name, place in line, referral link, email content |
| Cloudflare | Website delivery, DNS, security, cookieless analytics, encrypted backup storage | Visitor technical data; encrypted backups |
| Namecheap | The server that runs the website and the account app | Account data, Customer Content |
| Hetzner | The servers that run customers' AI companies (Germany or Finland) | Account data, Customer Content |
We'll update this list, and tell customers by email, before we add a new provider that handles Customer Content.
We also share information when the law requires it, to protect people's safety or our rights, in a merger or sale of our business (under this policy's protections), or when you ask us to.
6. How long we keep it
| Data | How long |
|---|---|
| Customer Content | While your account is active. After you cancel or stop paying, 12 months, with an email at least 30 days before deletion. Sooner if you ask. |
| Backups | Rolling; deleted data is gone from backups within about 35 days. |
| Account details | While you have an account, then deleted or anonymized within 90 days of closing it. |
| Billing records | 7 years, for tax and accounting. |
| Waitlist details | Until you unsubscribe or ask us to delete them, or 12 months after public launch if you don't sign up. |
| Security logs | 90 days, longer only during an investigation. |
| Agent run logs | 90 days, longer only during an investigation or while a support request is open. |
| Support requests and bug reports | 2 years after they close. |
7. Security
Each customer's AI company runs in its own isolated environment with its own resource limits. AI keys are encrypted. Backups are encrypted. All connections use HTTPS. Cards are handled only by Stripe. Staff access to a customer's AI company happens only when the customer asks for support. No system is perfectly secure; if a breach affects your information, we'll tell you and the authorities as the law requires.
8. Where data is processed
We're based in the United States, and most of our providers are too. Customers' AI companies run on Hetzner servers in Germany or Finland. If you're outside the US, your account information is transferred here. Where the law requires, we rely on safeguards such as the EU Standard Contractual Clauses.
9. Your rights
Depending on where you live, you can ask to see, correct, delete or get a copy of your personal information, object to or limit some uses, and withdraw consent (for example, by unsubscribing). We won't treat you differently for using these rights. We don't sell or share personal information as California law defines those terms, and we don't use sensitive information to infer things about you.
Email [email protected] from the address on your account. We'll confirm it's you and reply within 30 days (45 at most where the law allows). An authorized agent can ask for you where the law allows. In the EEA or UK you can also complain to your data protection authority.
For information inside a customer's AI company, contact that customer; we'll help them answer.
10. Children
The Service is for businesses and isn't meant for children. Accounts are for people 18 and over, and we don't knowingly collect information from anyone under 16. If you think a child gave us information, tell us and we'll delete it.
11. Changes
We'll post updates here and change the date at the top. For important changes, we'll email customers before they apply.
12. Contact
OpsHarbor · 1020 West Heritage Club Circle, Delray Beach, FL 33483 · [email protected]