Privacy policy

Harbour Property Solutions (“Harbour”, “we”) provides the Harbour Inspect property-management platform and this website.

Privacy questions and rights requests: info@harbourpropertysolutions.co.uk or 03333 444 506.

Harbour acts in two roles, and your rights differ slightly depending on which applies.

• Controller for visitors to this website, people who enquire or book a demo, and the agency staff who hold a Harbour account. We decide why and how that data is used.
• Processor for the records an agency keeps inside its workspace: its properties, landlords, tenants, applicants, contractors, inspection reports, photos, messages and payments. The agency is the controller of that data and we act only on its instructions under our terms of service. If you are a tenant, landlord or applicant and want to exercise your rights over data an agency holds about you, please contact that agency first; we will help them respond.

• Enquiries and demo requests — name, work email, company, optional phone number, role and portfolio size, plus the campaign that brought you here. Lawful basis: our legitimate interest in responding to a business enquiry, and your consent before we call you.
• Agency accounts — name, work email, hashed password, role, sign-in times and IP addresses of sign-in attempts (kept for rate limiting and security). Lawful basis: performance of a contract.
• Workspace records — everything an agency enters or uploads. We process this as the agency’s processor.
• Client portal accounts — the name and email of a landlord or tenant an agency invites, a hashed password, and the messages exchanged in the portal. Processed on the agency’s behalf.
• Public links — tenant sign-off links, 3D-tour links and application forms use a time-limited token instead of an account. Anything you submit through them is stored in the agency’s workspace.
• Billing — GoCardless collects Direct Debit details on its own pages; Harbour stores only the mandate reference, plan and payment status, never bank details.
• Support and error reports — when you send a help request we record the page, browser, device and the message. Our error monitor (Sentry) receives stack traces and the request that failed; it does not record your screen or keystrokes.
• Copilot and the concierge assistant — when an agency turns them on, the question and the bounded workspace context needed to answer it are sent to Anthropic’s API. Anthropic does not train on this data under the terms we use.

We do not run advertising pixels, session-replay tools or third-party analytics on this site. Fonts are served from our own domain, not from Google.

Harbour is a business product. Agency accounts and enquiries are for people aged 18 or over, and the sign-up form asks you to confirm this. If you believe a child has provided us with personal data, email info@harbourpropertysolutions.co.uk and we will delete it.

• Enquiries and demo requests: 24 months from the last contact.
• Agency and portal accounts: for the life of the workspace, then deleted or anonymised within 90 days of the workspace closing, unless the agency asks for a longer retention period for its own legal obligations.
• Sign-in attempt logs: 30 days. Email delivery logs: 12 months.
• Workspace records: as long as the agency keeps them. A scheduled retention job removes expired sharing tokens and stale temporary uploads.
• Backups: encrypted database backups are kept for 14 days and then overwritten.

We use these suppliers to run the service. Each acts under a contract that restricts them to processing on our instructions.

• Vercel — Hosting, serverless functions and file storage (Vercel Blob). Functions run in London (lhr1); Vercel is US-headquartered.
• Supabase (on AWS) — Postgres database. AWS eu-west-2, London.
• Resend — Transactional and service email delivery. US-headquartered; EU sending region.
• GoCardless — Direct Debit collection for agency subscriptions. United Kingdom.
• Sentry — Error monitoring (no session replay, no keystroke recording). EU data region (ingest.de.sentry.io).
• Anthropic — Harbour Copilot and lead-qualification assistant, when an agency enables them. United States.
• Google / Microsoft — Calendar sync, only for a user who connects their own calendar. Provider-dependent.
• Xero / QuickBooks — Ledger export, only for an agency that connects its own accounting. Provider-dependent.

Where a supplier is outside the UK we rely on the UK International Data Transfer Addendum or an adequacy decision. We do not sell personal data.

All traffic is encrypted in transit (HTTPS with HSTS). Passwords are hashed with bcrypt. Every database table has row-level security enabled, production data lives in a separate schema from development with separate credentials, and admin routes require a separate owner session. Sign-in and sign-up are rate limited, and sensitive downloads are logged. Private media is served only to signed-in members of the owning agency.

Under UK GDPR you can ask to access, correct, delete or restrict the data we hold about you, object to processing based on our legitimate interests, and take your data elsewhere. To make a request, email info@harbourpropertysolutions.co.uk with the subject “Data request”. Agency managers can also raise a deletion request from Settings → Your data inside the workspace. We respond within one month.

You can unsubscribe from any non-essential email with the link in its footer. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.

We will post any change here with a new “last updated” date, and email account holders about changes that materially affect them.