harbenOS

Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how personal data is collected, used, and protected when you use harbenOS (the “Platform”). harbenOS is operated by Charlie Medwin, a sole trader trading as “harbenOS” (“harbenOS”, “we”, “us”, or “our”). We are the data controller for the personal data described in the “Our role” section below. You can contact us about privacy at charlie@harbenos.com.

Our role

We act as a data controllerfor the account and identity data we hold about the individuals who sign in, and for the technical and security data our systems generate. Where you use the Platform under an agreement with your organisation and enter your organisation’s content, that organisation is the controller of that content and we act as its data processor, processing it on the organisation’s instructions under that agreement.

The personal data we process

  • Account and identity data. When you sign in with your Microsoft account, we receive your name, email address, and organisational identity from Microsoft Entra ID. We do not receive or store your Microsoft password.
  • Content you provide. The projects, documents, and other information you create or upload to the Platform. This may contain personal data if you choose to include it.
  • AI feature inputs and outputs. When you use a feature powered by artificial intelligence, the relevant content for that feature is sent to the configured AI provider (Anthropic or OpenAI) to generate a response, which is returned to you.
  • Technical and usage data. Standard information generated by our hosting infrastructure, such as request metadata, error logs, and usage and cost metrics, used to operate, secure, and maintain the Platform.
  • Cookies. We use strictly-necessary cookies to keep you signed in and to secure your session. We do not use advertising cookies or third-party analytics cookies.

How we use personal data, and our lawful bases

Under the UK GDPR we rely on the following lawful bases for processing personal data:

  • To provide, operate, and support the Platform, and to authenticate you and manage your session — performance of a contract and our legitimate interests in running the service.
  • To operate the AI features you choose to use — performance of a contract and our legitimate interests.
  • To keep the Platform secure, prevent and investigate misuse, and maintain audit and system logs — our legitimate interests in protecting the service and its users, and, where applicable, compliance with a legal obligation.
  • To comply with applicable laws and respond to lawful requests — legal obligation.

Artificial intelligence features

Some features send the specific content you submit for that feature to a third-party AI provider (Anthropic or OpenAI) to generate a response. Only the content needed for that particular feature is sent; no other data is shared with these providers. We do not use your content to train our own models. The AI providers process the content under their own terms, which may include retaining it for a limited period to operate and secure their services. AI-generated outputs can be inaccurate or incomplete — you remain responsible for reviewing them before relying on them.

Who we share personal data with

We do not sell personal data. We share it only with the service providers (sub-processors) that help us run the Platform:

  • Microsoft— Entra ID for sign-in and session management; Azure for database, application hosting, secrets, and operational telemetry.
  • Anthropic and OpenAI— AI processing for the specific features registered to each provider.
  • GitHub— source-code version control and deploy automation (source code only, not your Platform content).
  • Cloudflare— domain-name resolution and a lightweight edge redirect (DNS queries only, no Platform content).

We may also disclose personal data where required by law, to protect our rights or the safety of others, or in connection with a business transfer.

Where your data is stored, and international transfers

The Platform’s application data is hosted in Microsoft Azure’s UK South region, within the United Kingdom. Some of our sub-processors (for example, the AI providers) may process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, or an equivalent mechanism recognised under UK data protection law.

How long we keep personal data

We keep account and identity data for as long as your account is active and for a reasonable period afterwards. We keep content you provide until it is deleted by you or your organisation, or until your account is closed. We keep technical and security logs only for as long as needed for the operational and security purposes for which they were collected. When personal data is no longer needed, we delete or anonymise it.

How we protect personal data

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls and authentication via Microsoft Entra ID, secrets management, and hosting on Microsoft Azure. No system can be guaranteed completely secure, but we work to protect personal data against unauthorised access, loss, or misuse.

Your rights

Under the UK GDPR, you have the right to access your personal data; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; to data portability; and to withdraw consent where we rely on it. Where we process content on behalf of your organisation as a processor, please direct these requests to your organisation, which is the controller of that content. To exercise your rights in respect of data for which we are the controller, contact charlie@harbenos.com.

You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113. We would appreciate the chance to address your concerns before you approach the ICO.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and, where the changes are significant, take reasonable steps to let you know.

Contact us

If you have any questions about this Privacy Policy or how we handle personal data, contact Charlie Medwin (trading as harbenOS) at charlie@harbenos.com.