HARRIS ("we", "our", "us") is operated by Horizon Frame Limited, a company registered in England and Wales. This privacy policy explains how we collect, use, and protect your data when you use our AI marketing platform.
1. Data We Collect
When you use HARRIS, we may collect:
Account information: name, email address, password (hashed with bcrypt)
Organisation details: company name, website URLs, business descriptions, brand voice and target market context you provide
Platform connections: when you connect any of the supported third-party platforms (see section 9), we receive OAuth access/refresh tokens, API keys, and the per-platform identifiers needed to operate on your behalf (page IDs, ad account IDs, pixel IDs, channel IDs, shop domains, etc.). All credentials are encrypted at rest.
Campaign and content data: ad campaigns, organic posts, images, copy, content plans, and the performance/engagement metrics retrieved from connected platforms
Inbound webhook data: when you connect platforms that push events to us (GitHub repository events, Telegram bot messages, Shopify order webhooks), we receive and store those events scoped to your website
Conversation history: your messages to HARRIS, the agent's responses, tool calls made on your behalf, and approval decisions
Usage data: API calls, agent execution traces, scheduled task runs, and per-AI-call cost tracking (model, token counts, USD)
2. How We Use Your Data
To manage advertising campaigns on your behalf across connected platforms
To publish content to your connected social media accounts
To display analytics and performance dashboards
To run AI agents that automate marketing tasks you configure
To track platform API costs associated with your account
3. Data From Meta (Facebook & Instagram)
When you connect your Meta account, we access:
Your Facebook Pages and their access tokens (to post content and read analytics)
Your Instagram Business accounts linked to those Pages
Your Ad Accounts (to create and manage ad campaigns)
Your Pixels (to track campaign conversions)
Page and post insights (reach, engagement, impressions)
We only access data you explicitly authorise via the OAuth consent screen. We do not sell, share, or use your Meta data for any purpose other than providing our services to you.
4. How We Store Your Data
All credentials and access tokens are encrypted at rest using AES-256-GCM
Data is stored on Cloudflare's infrastructure (D1 database, R2 storage, KV)
All data is scoped to your organisation and website — no cross-tenant access
We do not store your platform passwords; we use OAuth tokens which you can revoke at any time
5. Lawful Basis for Processing
Under GDPR Article 6, we process your data on the following legal bases:
Contract (Art. 6(1)(b)): Account management, campaign generation, and platform management — necessary to provide our services
Consent (Art. 6(1)(a)): Platform connections (via OAuth), email processing — you explicitly authorise these
Legitimate Interest (Art. 6(1)(f)): Cost tracking, execution tracing, and service improvement — balanced against your rights
6. Data Retention
HARRIS runs an automated retention cleanup once a day (08:00 UTC). The schedule below is the source of truth: every row corresponds to a step the cleanup job actually performs (function runDataRetentionCleanup in src/routes/compliance.ts), alongside the user-controlled deletions described in sections 7 and 8.
Account data: retained while your account is active; deleted on account deletion (cascades to your websites, credentials, campaigns, content plans, and other website-scoped rows)
Platform credentials: deleted immediately when you disconnect the platform; any webhook subscriptions registered with the provider are deregistered at the same time
Execution traces and spans: 30 days, then automatically deleted
Agent error logs: 30 days, then automatically deleted
Email processing logs: 12 months, then automatically deleted
Cost tracking (per-call model, token-count, and cost rows): 12 months, then automatically deleted
Facebook Conversions-API events: 12 months, then automatically deleted
Refresh tokens: deleted as soon as they expire or are revoked
Completed data-deletion requests: retained 6 months as an audit trail of the deletion itself, then deleted
Consent records: retained 24 months as a lawful-basis audit trail (GDPR Art. 7(1)), then deleted
This list is reconciled with the cleanup job line-for-line so policy and code cannot drift. If the cleanup job changes, the policy must change in the same commit, and vice versa — a unit test asserts both sides agree.
7. Your Rights
Under GDPR and UK data protection law, you have the right to:
Access your personal data — download a full export via Dashboard > Settings > Privacy > Export Data, or GET /api/user/data-export
Rectify inaccurate data — update your profile in Dashboard > Settings
Erase your data ("right to be forgotten") — delete your account via Dashboard > Settings > Privacy > Delete Account, or POST /api/user/delete-account
Restrict processing — pause all agent processing via POST /api/user/restrict-processing
Data portability — receive your data in JSON format via the export endpoint
Object to processing — file an objection via POST /api/user/object; our DPO will respond within 30 days
Withdraw consent at any time by disconnecting platforms, restricting processing, or deleting your account
We will respond to all data subject requests within 30 days as required by GDPR.
8. Data Deletion
You can request deletion of your data at any time:
Through the dashboard: Settings > Privacy > Delete Account
Always engaged — required for the platform to function:
Cloudflare: hosting, database (D1), storage (R2), caching (KV), Durable Objects — data processor for all platform data
Anthropic (Claude Sonnet / Opus): AI content generation, conversation, planning — business context only; PII (email, phone, postcode) is stripped before transmission
OpenAI (GPT-4o, GPT-Image): image generation and supporting AI tasks — business context only; PII stripped
Perplexity: market research queries — no personal data sent
Ideogram: image generation — prompt text only, no personal data
Optional — only engaged when you explicitly connect them per website:
Meta (Facebook + Instagram): Pages, Instagram Business accounts, Ad Accounts, Pixels, page/post insights
Google: Gmail — read, compose, and send messages and manage labels for inbox triage (restricted scope gmail.modify plus non-sensitive gmail.labels; we do not request the broader https://mail.google.com/ scope), Search Console (read), Google Ads (campaign reads; writes pending basic-access upgrade), YouTube (channel read-only)
TikTok: Content Posting + Display APIs for the connected creator account
X (Twitter): posting + ad account access via your authorised credentials
GitHub: repository read + PR review + issue dispatch for repos you connect
Bitbucket / GitLab: personal-access-token connections for git hosting
Shopify: custom-app admin API token + (optional) orders/create webhook for stores you connect
Stripe: read-only restricted key for financial summaries
PostHog: product analytics ingestion via your project key
Beehiiv: newsletter publication management
Discord: outbound webhook posting (no inbound data)
Bing Webmaster: SEO data + IndexNow submissions
Telegram: bot-to-user messaging for project notifications (inbound + outbound)
Each optional integration is per-website and revocable at any time via Settings > Connections. Disconnecting deletes the stored credentials and (where supported) revokes the underlying token with the provider. Inbound webhook subscriptions you registered with the provider are deregistered at the same time.
A maintained, machine-generated register of the sub-processors we engage in production — with processing locations and DPA references — is published at /sub-processors. Customers are notified at least 30 days before a material change to the always-engaged set takes effect, in line with the commitment described on that page.
We do not sell your data to any third party. AI providers process data under their API terms, which prohibit using API inputs for model training.
10. AI Processing Disclosure
HARRIS is an AI agent platform: every conversation, scheduled report, and delegated task is processed through third-party LLMs (primarily Anthropic Claude, with OpenAI used for image generation and specialised tasks). Before transmission, we strip personally identifiable information (PII) including email addresses, phone numbers, and postal codes from prompts. AI-generated marketing content always requires your review and approval before it is published or sent on your behalf; campaigns are created in a paused state by default.
Tool calls the AI makes on your behalf (e.g. "post to Facebook", "merge this PR", "send this email") are gated by a tier system: low-risk read tools run silently; write/external tools require interactive confirmation or a pre-authorised scheduled task. Every AI call is recorded against your website with model, token count, and USD cost.
11. International Data Transfers
Your data may be transferred to and processed in countries outside the United Kingdom and the EEA, including the United States — where Cloudflare, Anthropic, OpenAI, Perplexity, and Ideogram operate — and the other jurisdictions listed for each sub-processor in section 9. For transfers from the EEA we rely on the European Commission's Standard Contractual Clauses (2021 modules, in the controller-to-processor configuration appropriate to each engagement). For transfers from the United Kingdom we additionally rely on the UK International Data Transfer Addendum (UK IDTA) or the equivalent UK Addendum to the EU SCCs issued by the Information Commissioner's Office. These instruments are incorporated into our data processing agreements with each sub-processor and are reviewed when a sub-processor is added or its terms change.
12. Cookies
We use two strictly necessary cookies to maintain your session:
We do not use tracking cookies, advertising cookies, or third-party analytics. No cookie consent banner is required as these are strictly necessary for authentication. For a full breakdown — including the informational dismissal cookie set when you close the on-page notice — see our Cookie Policy.
13. Data Breach Notification
In the event of a personal data breach, we will notify the Information Commissioner's Office (ICO) within 72 hours where required under GDPR Article 33. If the breach poses a high risk to your rights and freedoms, we will notify affected individuals directly.
14. Google API Services User Data Policy (Limited Use)
When you connect a Google account, HARRIS accesses Google user data only to provide the features you explicitly enable. The Gmail integration uses the restricted gmail.modify scope together with the non-sensitive gmail.labels scope so an operations agent can read, organise, label, compose, and send email on your behalf during inbox triage; the Search Console, Google Ads, and YouTube integrations are read-only and inform marketing and SEO decisions.
HARRIS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
We use Google user data only to provide and improve user-facing features that are prominent in the HARRIS interface.
We do not transfer or sell Google user data to third parties for advertising, market research, or any other purpose.
We do not use Google user data to train, develop, or improve generalised AI or machine-learning models. (PII is stripped before any business context is sent to our AI sub-processors, and those providers are contractually prohibited from training on API inputs.)
We do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security or to comply with applicable law, or the data is aggregated and anonymised for internal operations.
You can revoke HARRIS's access to your Google account at any time via myaccount.google.com/permissions or by disconnecting Google in Settings > Connections, which deletes the stored credentials.
15. Children's Data
HARRIS is a business-to-business platform intended for use by adults responsible for operating a business or website. The service is not directed at children under the age of 16, and we do not knowingly collect, store, or process personal data of children under 16. If you become aware that a child has provided us with personal data — for example through an account opened without the parent or guardian's knowledge, or through data inadvertently routed to us via a connected platform — please contact dpo@harrishq.ai. On verification we will delete the data without undue delay and will not retain copies, subject only to the minimum retention needed to demonstrate the deletion itself in line with section 6.
16. Marketing Communications
HARRIS does not currently send marketing or newsletter email. All email we send today is transactional — password resets, security alerts, billing receipts, and operational notifications about your account or connected platforms — and is sent only as needed to provide the service you signed up for.
If we introduce marketing or newsletter email in the future, the following terms will apply, and we have already built our systems to honour them:
Opt-in only. You will only receive marketing email if you have actively opted in via Settings > Privacy & Data > Marketing Email. Accepting the Privacy Policy and Terms of Service when you sign up does not opt you in to marketing — marketing consent is a separate, distinct action, never bundled with account creation, and is unticked by default for every user.
Easy withdrawal. You may withdraw consent at any time from the same Settings panel, or by clicking the one-click unsubscribe link that will be included in every marketing message, or by emailing dpo@harrishq.ai. Withdrawing is as easy as opting in. Once withdrawn, your status changes immediately and we will not send you further marketing email.
One-click unsubscribe. Marketing messages will include List-Unsubscribe and List-Unsubscribe-Post headers (RFC 2369 / RFC 8058) so your mail client can unsubscribe you without you having to open the message — the same mechanism Gmail and Outlook expose as a banner unsubscribe button.
Audit. Every grant and withdrawal is recorded in our consent log against your account, including which mechanism you used (Settings toggle, in-message link, mailbox-provider one-click, manual email).
Transactional mail is separate. Withdrawing marketing consent does not stop transactional mail. Transactional mail is part of providing the service and is lawful without separate consent under contract necessity.
The legal bases above are GDPR Article 7 (consent — freely given, specific, informed, unambiguous, withdrawable) and Privacy and Electronic Communications Regulations (PECR) regulation 22.
17. Contact
For any privacy-related questions or data subject requests: