Privacy policy
Last updated: 30 September 2026
Harold (harold.pm) is run by its owner ("we", "us"). For anything in this policy, contact [email protected]. We are the data controller for the personal data described here, under the UK GDPR and the Data Protection Act 2018.
What we collect
- Your account: your name, email address and profile picture from Google when you sign in, and the country and timezone you give us.
- What you put into Harold: projects, tasks, notes, completion notes, budgets and expenses, documents you attach, and your conversations with Ask Harold.
- Your calendar, if you connect it (Google or Microsoft): the events Harold needs to schedule work around, read with your permission and only while connected. If you allow it, Harold also adds your tasks to a separate calendar it creates for that purpose. It does not change or delete your own events.
- Billing: if you subscribe, our payment provider Stripe holds your card details. We never see your full card number. We keep your subscription status, plan and billing country.
- Technical data: error reports when something breaks, and basic usage of our public website pages (which pages were visited, not who you are), without advertising cookies.
How we use it and why
| Use | Lawful basis |
|---|---|
| Running your account and your projects | Contract |
| Harold's AI features: building plans, reading your notes, answering questions | Contract |
| Taking payment and keeping billing records | Contract; legal obligation (tax records) |
| Fixing errors and keeping the service secure, including limiting abuse | Legitimate interests |
| Understanding which public pages are useful | Legitimate interests |
We do not sell your data and we do not use it for advertising.
AI processing
To make plans, read your notes and answer questions, the relevant parts of your project are sent to AI model providers through OpenRouter, which routes each request to a model provider. Those providers process the content to produce a response. We send the context a request needs, not your whole history. We make no promise about how any provider may use data beyond what their own terms say.
Who we share it with
Only the service providers that run Harold for us, each under its own data-protection terms:
- Supabase — database, sign-in and file storage
- Railway — hosting
- OpenRouter and the AI model providers it routes to — AI features
- Google — sign-in, and calendar if you connect it
- Microsoft — calendar, if you connect an Outlook or Microsoft 365 calendar
- Stripe — payments
- Sentry — error reports (scrubbed of project content)
- PostHog (EU) — anonymous public-page statistics
Some of these providers process data outside the UK. Where they do, we rely on the UK's adequacy regulations or the International Data Transfer Addendum / standard contractual clauses.
How long we keep it
- Your account and projects: until you delete your account. Deleting your account (Settings → Danger zone) permanently removes your projects and personal data.
- Unfinished new-project drafts: deleted after 48 hours.
- Billing records: as long as tax law requires (currently six years in the UK).
- Error reports: up to 90 days (Sentry's default).
If your trial ends without a subscription, your projects become read-only and are kept until you subscribe or delete your account.
Your rights
You can ask to access, correct, delete or restrict your data, object to its use, or take a copy with you. Most of this you can do yourself in Settings: exports (while your account can make changes) and account deletion. For anything else, email [email protected]. You can also complain to the Information Commissioner's Office (ico.org.uk).
Cookies
We use only the cookies needed to keep you signed in and remember your theme. Our public-page statistics do not use cookies.
Changes
We will update this page and change the date above. If a change matters, we will tell you in the app before it takes effect.