What Harnace keeps, and who sees it.

This policy is from Harnace LLC, a Wyoming limited liability company, which runs Harnace. It covers harnace.com, a company account with its console and the connection your AI makes to Harnace at https://harnace.com/api/mcp. Where a company has signed an agreement with us, that agreement and its data terms come first wherever the two differ.

Who is responsible for what

• A company's data is the company's. Everything a company puts into Harnace or connects to it, including what it holds about its own people, its customers and its vendors, belongs to that company. The company is the controller of that data and Harnace processes it only on the company's behalf, under the Data Processing Addendum. If you want to see, correct or remove something a company put into Harnace about you, ask that company first, and we will help it answer.
• Your account and the site are ours. Harnace LLC is the controller of the data we keep to run accounts and the site: who you are, how you sign in, how the product is used and what you send us through the site.

When your AI connects

You add https://harnace.com/api/mcp to Claude, ChatGPT or another AI that speaks the Model Context Protocol. Your AI sends you to sign in through Descope, the service that runs Harnace's sign-in for AI connections. You sign in to Harnace with your email. If you have no account yet, you make one there and connect your company's systems. Then you choose which company your AI may read and allow it. Your AI is given a token that works for you alone, for that AI and that company, and only to read.

• What we receive from your AI. Each request it makes to one of Harnace's tools and the arguments it sends with it, such as a measure, a month or part of a customer's name. We never receive your conversation, your other files or your AI's memory, only what your AI puts in a request.
• What we send back. Figures, definitions, differences between systems and the records behind a figure, from the company's checked record. They are computed by Harnace's code from those records, not written by a model. Nothing about what a person is paid is served on this connection.
• Where it goes next. What Harnace sends your AI is then held by the company that runs your AI, under your agreement with it. See "Who else handles it" below.

The read ledger

Every request your AI makes is written down as one row on the company's read ledger. A row holds who asked, through which AI, which tool, the arguments as your AI sent them (cut short if they are long), the definitions and versions that answered, any rule that held something back or refused the request, how many rows and fields came back, a fingerprint of the answer, how long it took and the id your AI cites. It never holds the answer itself.

Each row carries a fingerprint of the one before it, so a row changed or removed afterwards breaks the chain, and the console shows whether it still holds. A company's leaders see its read ledger on the Your AI page, and so can the two of us who run Harnace when we look after the account.

What we keep for an account

• Who you are. Your name, your email and your company's name, with its domain if it has one. Also the people in the company's directory, and the role you gave when you accepted our terms, with the time, address and browser you accepted from.
• What we read from the systems a company connects. When a company connects its ledger, CRM, billing system or bank, we read the records its definitions need, read only, with a key or a sign-in the company can revoke at any time. We keep each record as the system sent it, its earlier versions and the figures computed from it, so any figure can be traced to its records and checked again later. Keys are stored encrypted.
• What you give us. Files you drop in the console or send to the company's inbox, such as a report the company trusts or an export. Each is kept until someone deletes it. Bank account, routing and card numbers are cut out of a dropped file before it is kept. In a spreadsheet or CSV their values are emptied and the column's name stays, so you can see what was taken out, and a tax or other government ID column is emptied the same way. A PDF or document that shows one is not kept at all, and a scanned page, which can only be checked once it is read, is deleted when it is.
• What Harnace makes. The definitions with every version and who approved it, the differences between systems and their causes, outputs and the record behind each one.
• Conversations. If a company uses Harnace in Slack, by email or by voice, the messages it is part of. A call is kept as a transcript, never a recording.
• How the product is used. Page views and clicks, and recordings of sessions on the site and in the console, through PostHog. Every field you type into and every piece of text on the page is masked before it leaves your browser, so a recording shows the layout and the clicks, never a word or a figure.

Signing in sets a cookie that keeps you signed in for thirty days. The console sets a few more that remember your choices on this device for up to a year, such as which company you last opened and which panels you closed, and one that holds your place for an hour while you finish connecting your AI. All are Harnace's own, all are needed for the console to work, and none tracks you anywhere else. Descope's sign-in screen may set its own. The public site sets none. PostHog keeps a random visitor id in your browser's local storage, not a cookie, so the visits of one browser count as one person. Once you sign in, it is tied to your email. Clearing site data removes it.

On the public site

If you write to us through the Talk to us form, we keep the message and the email address you give, to reply. If you use the builder on the site without an account, what you type and the documents you drop are read by Anthropic's model to write the draft, and what you say, if you talk to it, goes through Vapi, and we do not keep them unless you ask us to start an account from the draft.

Why we use it

• To provide the service you or your company signed up for, including signing you in, reading the systems your company connects, answering your AI and sending the email the service needs. Where the GDPR or UK GDPR applies, our legal basis is our contract with you or your company.
• To keep it secure and working, by finding faults, preventing abuse and enforcing our terms, and to improve it from how it is used. Our legal basis is our legitimate interest in running a safe and useful service, which we balance against your rights.
• To meet the law, where it requires us to keep or disclose something. Our legal basis is that legal obligation.

We do not use your data for advertising, sell it or share it for anyone else's own purposes, and we do not use one company's data for another. Nothing a company gives us is used to train a model, ours or anyone else's.

Who else handles it

A few services handle data on our behalf, each only for the part it does and each bound by data protection terms. The full list, with where each one is, is on the subprocessors page.

• Vercel: hosts the site and runs the application.
• Supabase: the database, file storage and daily backups.
• Descope: sign-in and authorization when a customer's AI connects. When a user connects an AI to Harnace.
• Anthropic: the AI model Harnace uses inside the service: to read files a customer drops or emails in, sort mail sent to a company's inbox, answer questions asked in the console, in Slack or by voice, and match and map the records a company connects to build its outputs. The figures an AI reads through the endpoint are computed by Harnace's code, not by this model.
• Postmark: sends Harnace's email, including sign-in codes, and receives mail sent to a company's inbox.
• PostHog: product analytics and session recordings, on the public site and in the console.
• Slack: messages to and from Harnace in a customer's workspace, and Harnace's own alerts to its founders about an account. A customer's workspace only when the customer adds Harnace to it. Harnace's own alerts always.
• GitHub: holds Harnace's code, and the settings of a company Harnace set up by hand before sign-up opened. Only for a company Harnace set up by hand.
• Vapi: voice calls with Harnace, with Deepgram turning speech into text for Vapi. Only when someone talks to Harnace by voice.
• To show a company's logo, we look it up by domain name from a public icon service. Only the domain is sent.

Your AI's vendor is yours, not ours. When your AI reads Harnace, the answers go to the company that runs your AI, such as Anthropic for Claude or OpenAI for ChatGPT. That company handles them under your agreement with it and its own privacy policy, not ours. Before you connect a company's data, choose a plan whose data terms suit your company, including whether it trains on your conversations.

We may also disclose data where the law requires it, after telling the company concerned where we lawfully can, or to a buyer or successor if Harnace LLC is merged or sold, who would be bound by this policy.

How long we keep it

• A company account. Everything is kept for the life of the account: the records as each system sent them, their earlier versions, the figures computed from them and the read ledger. When a company connects a system, we read up to thirty-six months of its history. We delete it all within thirty days of a written request or of the account closing, and write to confirm when it is done.
• The two chained records. The record of what Harnace did and the read ledger are chained by fingerprints. On deletion their contents go with everything else. We keep each entry's number and fingerprint, which hold none of the company's data, so the chain can still be checked against a fingerprint the company kept.
• Backups are taken every day and age out seven days later.
• Messages through the Talk to us form are kept for twelve months after the last reply.

What you can do

• Take a connection back. A company's leaders see every AI that can read the company on the Your AI page in the console, who gave it, through which AI and everything it asked. Revoke one and its next request is refused. You can also remove Harnace in your AI's own settings, which stops it asking.
• Export. A leader can download any output and its record, and the record for any month, from the console. For everything we hold for a company, write to us and we send it as files within thirty days.
• Delete. A leader can delete any file the company gave us from Documents, and what was read from it goes with it. To delete a whole company account, write to us. We delete it within thirty days, as above, and confirm in writing.
• Ask. You can ask what we hold about you, ask for it to be corrected or deleted, or ask for a copy. Write to hello@harnace.com, and we will answer within thirty days. We may need to confirm the request comes from you, by email to the address we hold.

Your rights where you live

In the European Union, the United Kingdom and Switzerland, you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form and to withdraw any consent you gave. You also have the right to complain to your data protection authority, though we would like the chance to put it right first.

In California, you have the right to know what personal information we collect, use and disclose, to have it deleted or corrected and not to be treated differently for using these rights. We collect identifiers such as your name and email, professional information such as your title and company, and information about how you use the product, for the purposes above. We do not sell or share personal information, as California law uses those words, and we do not use sensitive personal information. You may use an authorized agent, and we will confirm the request with you.

Where it is kept

Data is stored in the United States, in Supabase's Oregon region, and the application runs on Vercel in Oregon. Where personal data comes to us from the European Union, the United Kingdom or Switzerland, we protect the transfer with the European Commission's standard contractual clauses and the UK Addendum, as the Data Processing Addendum section 12 says.

How we protect it

Every company's data is kept apart from every other's by the database itself. Harnace only reads the systems a company connects and cannot change a record in any of them, and the connection your AI makes reads Harnace and changes nothing. Data is encrypted in transit and at rest, and keys for connected systems are sealed again with their own key. Annex II of the Data Processing Addendum lists our measures, and the security page explains them.

Children

Harnace is for businesses and is not meant for anyone under 18. We do not knowingly collect a child's personal data, and we delete any we find.

Changes

If this page changes, the date at the top changes with it, and we email account owners before a material change. A change will not reach back to data you gave us before it without asking you first.

Contact

Harnace LLC is the controller of the data this policy covers. Write to hello@harnace.com about anything on this page, and a founder answers.