Privacy Policy

At a glance

• We collect the information you give us through the contact form on our Website and through emails, plus limited technical data about how you use our Website and, if you allow it, the company associated with your IP address. If you are in the United States and turn on Identification, our partner RB2B may also tell us who you are, such as your name and work email.
• We use it to respond to you, contact you about our products and services, and run and secure the Website.
• We do not sell your personal data for money. If you are in the United States and turn on Identification in our cookie banner, our visitor-identification partner RB2B uses data about your visit for its own purposes, which some U.S. state laws may treat as a “sale” or “sharing” of personal data. Identification is off unless you click “Accept” or turn it on under “Preferences,” and you can opt out at any time (see Section 9).
• We do not use personal data collected through the Website to train AI models.

1. Introduction (Who We Are)

This Privacy Policy explains how Miralta Q, Inc., a Delaware corporation doing business as Harbor (“Harbor,” “we,” “us,” or “our”), collects, uses, shares, and protects personal data when you visit https://www.harbor.codes/ (the “Website”), contact us, or otherwise interact with us as a prospective customer, partner, investor, or member of the public. Harbor is the controller of this personal data. Our address is 865 Florida St Apt #1, San Francisco, CA 94110.

Harbor builds risk assessment and insurance-related products for organizations that deploy AI agents. This Privacy Policy does not cover:

• personal data we process on behalf of our customers when providing our services, which is governed by our agreements with those customers;
• personal data of job applicants, employees, and contractors, which we cover in separate notices provided to those individuals; or
• personal data collected in connection with any insurance application, quote, policy, or claim, which will be covered by a separate insurance privacy notice.

2. What Data We Collect

We do not intend to collect sensitive personal data (such as health information, government identifiers, or financial account numbers) through the Website. Please do not submit it, or confidential business information, through the contact form on our Website.

Cookies and similar technologies. We use cookies and similar technologies (such as local storage) that are strictly necessary for the Website to function. Wherever you are, we ask before we set any cookie or similar technology that is not strictly necessary. Nothing is turned on in advance, and declining is as easy as accepting. Until you make a choice, or if you decline, we set only strictly necessary cookies, and PostHog, Leadfeeder, and RB2B do not load. With your consent, we also use Analytics cookies from PostHog to understand how visitors use the Website and Marketing cookies from Leadfeeder to identify the company behind a visit from its IP address, for sales follow-up. If you are in the United States and turn on Identification, we also use RB2B, which may identify individual visitors to the Website for sales and business-development outreach, together with the identity networks it works with, such as LiveIntent (see Section 5). We offer Identification only to visitors whose IP address places them in the United States, and RB2B never loads for anyone else. If your browser sends a Global Privacy Control signal, Marketing and Identification stay off unless you turn them on yourself (see Section 9). When you make a choice, we keep a record of it (a random ID, your choices, the policy version, the date, and the country derived from your IP address), so we can show what you agreed to. We remember your choice for 12 months, or until a change to this Privacy Policy or our Cookie Policy affects what you agreed to, and then ask you again. You can change your choice at any time through the “Cookie settings” button in the Website’s footer. Vercel Web Analytics runs for every visitor without asking, because it sets no cookies and stores nothing on your device. It counts visits in aggregate (for example, pages viewed, referring site, country, device and browser type, which buttons are clicked, and whether the contact form was sent) and does not identify you or your company. Our Cookie Policy lists the cookies we use, what they do, and how long they last. We do not use cookies to show you ads. RB2B and the identity networks it works with may use identification cookies for their own advertising (see Section 5).

3. How We Use Personal Data

We use personal data to:

• respond to your inquiries and requests, including questions about our products, the systems that you deploy, and demo, meeting, and partnership requests;
• send updates, event invitations, and other communications you have asked for or that we are permitted to send, with an option to unsubscribe at any time;
• manage our relationships with prospective customers, partners, and investors;
• operate, maintain, secure, and improve the Website, including diagnosing technical problems and preventing fraud and abuse;
• understand, in aggregate, how visitors use the Website;
• identify the companies associated with visits to the Website, so we can understand which organizations are interested in our products and services, and if you are in the United States and turn on Identification, match your visit to you personally and use that information to contact you about our products and services and to prioritize our outreach;
• comply with legal obligations and respond to lawful requests from authorities;
• establish, exercise, or defend legal claims; and
• carry out or evaluate a merger, acquisition, financing, or sale of assets.

We do not use personal data collected through the Website to train AI models. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. Legal Basis for Processing (EEA/UK)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under Article 6 of the GDPR and UK GDPR on the following bases:

We do not use RB2B, or identify individual visitors, in the EEA, the United Kingdom, or Switzerland.

Where we rely on legitimate interests, you may object at any time (see Section 9). Where we rely on consent, you may withdraw it at any time without affecting earlier processing.

5. Who We Share Data With

We share personal data only as described below.

Service providers. We use vendors that process personal data on our behalf and under our instructions, bound by contracts that require them to protect it:

Visitor identification partner. If you are in the United States and turn on Identification, RB2B (operated by GetEmails, LLC, which does business as RB2B and Retention.com) collects data about your visit through its code on our Website, such as your IP address and the approximate location derived from it, cookie identifiers, pages viewed, and referring URL. Its code also sends this kind of data to an IP-geolocation service and to LiveIntent and other identity networks that RB2B works with, which set their own cookies (see our Cookie Policy). RB2B and these partners may associate your visit with other personal information that they or others have about you, including your email address, and RB2B sends us the identification data described in Section 2. We, or service providers on our behalf, may then send communications and marketing to that email address. RB2B is not our service provider. It acts as an independent business and a “third party” under the CCPA (see Section 11) and uses this data under its own privacy policy (https://www.rb2b.com/privacy-policy), including to provide, develop and improve its service. RB2B and the identity networks it works with may also use it for advertising. You can opt out of receiving this advertising, and ask RB2B to remove you from its database, at https://app.retention.com/optout. You can also turn off Identification at any time through the “Cookie settings” button in the Website’s footer, and unsubscribe from our emails using the link in each one.

Professional advisers. Lawyers, accountants, auditors, and insurers, under duties of confidentiality.

Corporate transactions. A buyer, investor, or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations.

Legal and safety reasons. Authorities, courts, or other parties where required by law or legal process, or where needed to protect the rights, property, or safety of Harbor, our users, or others.

With your consent or at your direction. For example, if you approve a public testimonial.

We do not sell personal data for money. Making data about your visit available to RB2B and the identity networks it uses when you turn on Identification may be a “sale” or “sharing” of personal data under the CCPA and similar U.S. state laws. You can opt out at any time, as described in Section 9.

6. International Transfers

Harbor is based in the United States, and we and our service providers process personal data in the United States and in the European Union. These countries may have data protection laws that differ from those in your country.

When we transfer personal data from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, or an adequacy mechanism such as the EU-U.S. Data Privacy Framework where the recipient is certified. You may request a copy of the relevant safeguards at [email protected].

7. Data Retention and Storage

We keep personal data only as long as needed for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Vercel Web Analytics sets no cookies and does not identify you. Some of our providers may keep limited data for their own security, legal, or backup purposes, as described in their own privacy notices.

We may keep data longer where needed to comply with legal obligations, resolve disputes, or enforce our agreements. When data is no longer needed, we delete or anonymize it.

8. How We Secure Personal Data

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption in transit (TLS), access controls limited to personnel who need the data, multi-factor authentication on our business systems, and due diligence on our service providers.

No method of transmission or storage is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires.

9. Data Subject Rights and How to Exercise Them

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete personal data;
• delete your personal data;
• receive your data in a portable format and have it transmitted to another controller;
• restrict our processing of your personal data;
• object to our processing based on legitimate interests, and object at any time to direct marketing;
• withdraw consent at any time, where we rely on consent;
• opt out of the sale or sharing of personal data, targeted advertising, and profiling that produces legal or similarly significant effects (see “Opting out of sale or sharing” below);
• appeal our decision on your request, where state law provides this right; and
• complain to a data protection authority or state Attorney General.

How to make a request. Email [email protected]. Tell us which right you want to exercise and how we can reach you. You can unsubscribe from marketing emails at any time using the link in each email. You can withdraw your consent to Analytics, Marketing, or Identification cookies, or change your cookie preferences, at any time through the “Cookie settings” button in the Website’s footer.

Opting out of sale or sharing. To opt out of the sale or sharing of your personal data, use the “Cookie settings” button in the Website’s footer. It opens your cookie preferences, where you can turn off Marketing and Identification. You can also turn on Global Privacy Control in your browser (see below) or email [email protected] with the subject “Do Not Sell or Share.” You do not need to verify your identity to opt out. To ask RB2B to remove you from its database, use its opt-out form at https://app.retention.com/optout (see Section 5).

We recognize and honor browser- and device-based Global Privacy Control (GPC) signals. When we receive a valid GPC signal, we treat it as a request to opt out of the sale or sharing of personal data and of targeted advertising for that browser. Marketing (Leadfeeder) and Identification (RB2B) then stay off, even if you click “Accept” in our cookie banner, and the banner tells you that we have recognized the signal. You can still turn them on yourself under “Preferences.” The signal does not affect Analytics (PostHog).

At this time, we do not respond to browser “Do Not Track” (DNT) signals. DNT is not yet a standardized framework, and we do not interpret or act on these signals in our systems.

Verification. We will verify your identity using information we already hold, and we will ask for more only when necessary. We do not need to verify your identity to act on a request to opt out of the sale or sharing of personal data. An authorized agent may submit a request on your behalf with your signed permission, and we may ask you to confirm your identity directly.

Timing and cost. We respond within one month for EEA and UK requests (extendable by two months for complex requests) and within 45 days for U.S. state requests (extendable once by 45 days where permitted). Requests are free, unless they are manifestly unfounded or excessive.

Non-discrimination. We will not discriminate against you for exercising your privacy rights.

10. Automated Processing

We do not use personal data collected through the Website to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you within the meaning of Article 22 of the GDPR, Articles 22A–22D of the UK GDPR, or equivalent U.S. state laws.

Harbor’s products assess the risks of AI systems deployed by organizations. Any personal data processed in delivering those products is governed by our customer agreements, not by this Privacy Policy.

11. California Residents

This section applies to California residents and supplements the rest of this Privacy Policy. It serves as our notice at collection and our disclosure under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

Personal information we collected in the past 12 months:

We do not collect sensitive personal information as defined by the CCPA. We collect these categories from the sources described in Section 2, including RB2B for identification data, use them for the purposes in Section 3, and keep them for the periods in Section 7.

Sale and sharing. We do not sell personal information for money. If you turn on Identification, we make identifiers (such as your IP address and cookie IDs) and internet or other electronic network activity (such as pages viewed and referring URL) available to RB2B and to the identity networks it uses, such as LiveIntent, and approximate location available to RB2B, so that RB2B can identify visitors for our sales outreach. RB2B also uses this information for its own purposes, as an independent business (see Section 5), and so may the identity networks it uses, so this may be a “sale” or “sharing” under the CCPA. We have no actual knowledge of selling or sharing the personal information of consumers under 16. You can opt out at any time through the “Cookie settings” button in the Website’s footer, by turning on Global Privacy Control in your browser, by emailing [email protected] with the subject “Do Not Sell or Share,” or through RB2B’s opt-out form (see Section 9).

Your California rights. You have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. See Section 9 to make a request.

Shine the Light. Except as described in Section 5 for visitors in the United States who turn on Identification, we do not disclose personal information to third parties for their own direct marketing purposes.

12. Other US States Residents

If you live in a state with a comprehensive consumer privacy law, such as California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, and Delaware, you may have the rights described in Section 9, including to confirm whether we process your personal data, access, correct, delete, and obtain a copy of it, and opt out of targeted advertising, sale, and certain profiling. Some of these laws may treat our use of RB2B as a sale of personal data, which you can opt out of as described in Section 9.

Appeals. If we decline your request, you may appeal by emailing [email protected] with the subject line “Privacy Request Appeal.” We will respond within the period your state’s law requires. If we deny your appeal, you may contact your state Attorney General.

Nevada. We do not sell covered information as defined in Nevada Revised Statutes Chapter 603A.

13. EEA and UK Residents

If you are in the EEA or the United Kingdom, Harbor is the controller of your personal data processed through the Website. See Section 4 for our legal bases, Section 6 for international transfers, and Section 9 for your rights.

Complaints. You may complain to the data protection authority in your country of residence, place of work, or place of the alleged infringement (a list of EEA authorities is available from the European Data Protection Board), or, in the UK, to the Information Commissioner’s Office. You can also complain to us directly at [email protected]. If you are in the UK, we will acknowledge your complaint within 30 days and keep you informed of its progress, as the Data (Use and Access) Act 2025 requires.

14. Children’s Privacy

The Website is intended for business professionals and is not directed to anyone under 18. We do not knowingly collect personal data from children under 18. If you believe a child has given us personal data, contact [email protected] and we will delete it.

15. Changes to This Notice

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. If we make material changes, we will post a prominent notice on the Website at least 30 days before the changes take effect.

16. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact:

Miralta Q, Inc. Attn: Privacy [email protected]