Privacy Policy

Last updated: October 8, 2026

Introduction

This Privacy Policy explains how HarnessHive ("we", "us", "our") collects, uses, and protects personal data. It applies to our website, our newsletter, and the HarnessHive application — our cloud-based wiring harness design platform ("the Service"), including paid subscriptions, the AI assistant, and access to your workspace through API tokens and the Model Context Protocol (MCP).

The data controller is HarnessHive ApS, a Danish company (CVR 46812549). For any privacy question you can reach us at info@harnesshive.com.

This policy complements our Cookie Policy, which governs cookies and similar technologies on our website and in the Service.

Our two roles: controller and processor

Because HarnessHive is a business-to-business tool, we handle personal data in two distinct capacities, and your rights and our responsibilities differ depending on which applies.

We are the data controller for the personal data we decide how and why to process: your account and profile details, billing information, our communications with you, and website/product analytics. This policy governs that data.

We are a data processor for the content you create, upload, or store in the Service — your wiring harness designs, projects, your conversations with the AI assistant, and any files or data they contain. If those materials include personal data about your own employees, customers, or other third parties, you remain the controller of that data and decide how it is used. We process it only to provide the Service to you and only on your instructions, under a data processing agreement (DPA). If you need our DPA, contact us at info@harnesshive.com.

In short: we control your account, billing, and marketing data; you control the content you put into your designs.

What we collect

Account and identity data: name, email address, company/organization, team and role information, login credentials (we store your password only in hashed form), and profile settings you provide when you register or use the Service.

Billing and subscription data: subscription plan, billing status, and transaction history. Payments are handled by our merchant of record, Polar (see Payments below) — we do not collect or store your full card number or other raw payment card details.

Customer content: the designs, projects, files (such as images you upload), and related data you create or upload in the Service, and your conversations with the AI assistant, including the changes it proposes and which ones you apply or reject. We process this as your processor, as described above.

API tokens: the name you give a token, its access level, who created it, its expiry, and when it was last used. We store only a hash of the token itself.

Usage and technical data: product analytics, feature usage, session and device information, IP address, log data (including logs of API and MCP requests), error/diagnostic information, and, for new accounts, which page or button on our website led to the sign-up, used to operate, secure, troubleshoot, and improve the Service.

Marketing contact data: email address, first name, last name, and company when you voluntarily subscribe to our newsletter (this includes everyone who joined our pre-launch waitlist), together with where you signed up and when you consented, plus limited email engagement metadata (delivery status, opens, clicks).

Purpose and lawful basis (GDPR)

Providing the Service: to create and manage your account, host your designs, run the AI assistant and API access, and deliver the features you subscribe to. Lawful basis: performance of a contract (Art. 6(1)(b)).

Billing and payments: to process subscriptions, invoices, and taxes, and to prevent fraud. Lawful basis: performance of a contract, and legitimate interests / legal obligation for fraud prevention and record-keeping.

Service communications: operational and transactional messages about your account, subscription, security, or support requests. Lawful basis: performance of a contract, or legitimate interests (Art. 6(1)(f)).

Website analytics, security, and logs: to understand how the website is used, keep the website and the Service reliable and secure, and improve them. Lawful basis: legitimate interests (Art. 6(1)(f)), balanced against your rights. On the website the balance is kept by storing nothing on your device and by using a daily-rotating hash instead of an identifier; you can object at any time, and the "Do Not Track" browser setting stops the counting altogether.

Product analytics in the Service: to understand how signed in users work with the editor and improve the Service. Lawful basis: consent (Art. 6(1)(a)), which you give or refuse when you sign up and can withdraw at any time in your account settings. If you do not consent, these analytics are not activated for you.

Error reports in the Service: when something in the editor fails, for example a change that could not be saved, the app sends a short technical report about that failure (what failed, in which harness, for which account, and diagnostic details) to our servers, which forward it to PostHog. This happens whether or not you consent to product analytics, but nothing is stored on your device for it and it is not used to follow how you use the Service. We use these reports only to find and fix faults and keep your work safe. Lawful basis: legitimate interests (Art. 6(1)(f)); you can object at any time by emailing us.

Newsletter and product updates: to send marketing emails about our product, features, roadmap, and company news when you ask to subscribe. Lawful basis: consent (Art. 6(1)(a)). You can withdraw consent at any time via the unsubscribe link in every email.

AI improvement (planned, not active): if a workspace admin opts in through a workspace setting, we will use AI inputs and outputs from that workspace, such as prompts, conversations, and accepted or rejected suggestions, to train and improve our AI features. Lawful basis: the customer's instruction and, where personal data is involved, consent (Art. 6(1)(a)). The setting is off by default and can be turned off at any time. We will update this policy with details before it goes live.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

Payments

Subscription payments are processed by Polar (polar.sh), which acts as our merchant of record. This means Polar is the seller of record for your purchase and independently handles payment processing, card data, and applicable sales tax/VAT as a separate controller for that payment data. We receive confirmation of your subscription and limited billing metadata, but not your full payment card details. Polar's own privacy terms govern its processing of your payment information.

Service providers and subprocessors

We rely on trusted providers to run the Service. They process personal data on our behalf under data processing agreements and only as needed to deliver their function. The list below describes our main providers. The complete and current list, with purpose and location, is published at harnesshive.com/subprocessors, and we update it before adding or replacing a provider.

Storage (EU): Cloudflare R2 for file/object storage and Neon for our database, both hosting your data in Europe.

Compute (edge): application compute (Cloudflare Workers) runs close to the user for performance and may take place outside the EU/EEA. Where that happens, transfers rely on the safeguards described under International transfers.

Email: Resend (resend.com) sends our transactional emails such as account and security messages, and our newsletter, and keeps our newsletter contacts with where they signed up and when they consented. It measures deliveries, bounces, and basic engagement.

Team notifications: Slack (slack.com). When someone signs up, we post a short note to our internal Slack (name, email, workspace name, country, and which page or button brought them to sign up) so the team can welcome them.

Payments: Polar (polar.sh), as merchant of record — see Payments.

Analytics: PostHog (PostHog Inc., EU hosting in Frankfurt) for website and product analytics and error tracking. On the website it runs in a cookieless mode: nothing is stored on your device, and visits are counted with a privacy-preserving hash of your IP address and browser that is rotated daily, so no persistent identifier and no profile exist. Inside the Service it stores an analytics identifier so we can understand how signed-in users work with the editor, but only if you have consented. Error reports from the Service reach PostHog through our servers either way, without anything stored on your device. Session recordings are not used in any case.

Feedback: UserJot (userjot.com, run by LogSnag LLC, United States) runs the in-app feedback widget. It loads only when you open it, and receives your name and email so we can follow up on your feedback.

AI assistant: the AI assistant is available on paid plans and during the free trial; it is a beta feature that we are rolling out gradually. It is powered by Anthropic (Anthropic, PBC, United States). When you use it, we send Anthropic what it needs to answer: your messages, the conversation so far, and the parts of your harness designs, libraries and workspace it reads to respond, which may include names or other personal data contained in them. Anthropic processes this under its commercial terms and data processing addendum. Under those terms Anthropic does not use this data to train its models and keeps it only for a limited period, for example to detect misuse. We do not use your customer content to train AI models without your consent (see AI improvement above).

Assistants you connect yourself: if you connect an external assistant (such as Claude or Cursor) to your workspace with an API token, the data that assistant reads is sent to the provider you chose, under your own agreement with that provider. We are not responsible for how that provider handles it.

Disclosures: We do not sell personal data. We share data only with the providers above (and their own subprocessors under contractual safeguards), and where required by law or to protect our rights, users, or the Service.

International transfers

Your stored data (database and files) is held in Europe. However, edge compute and certain providers may process personal data outside the EEA/UK (e.g., in the U.S. or other regions). In particular, AI assistant requests are processed by Anthropic in the United States. Where personal data is transferred outside the EEA/UK, we rely on recognized transfer mechanisms such as the Data Privacy Framework between the EU and the US where the provider is certified, or the European Commission's Standard Contractual Clauses and appropriate supplementary safeguards. Contact us at info@harnesshive.com for details about our transfer measures.

Retention

Account and content data: retained for as long as your account exists. If you delete your account, we delete your personal data and customer content without undue delay. If your subscription ends or is cancelled, we keep your account and customer content for 90 days so you can export it or resubscribe, and then delete it. Deleted data disappears from our backups within 30 days. We keep data longer only where the law requires it, for example for tax and accounting. You can request earlier deletion (subject to the controller/processor distinction above).

AI assistant conversations: stored so you can return to them, for as long as your account exists, and deleted together with your account.

Billing records: retained as required by applicable tax and accounting law.

Marketing contact data: retained until you unsubscribe or request deletion, or until it is no longer necessary.

Logs and analytics: security and access logs, including logs of API and MCP requests, are kept while your account exists and deleted with it. Analytics data is retained for a limited period for troubleshooting and improving the Service.

Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, or data portability, and you may object to certain processing. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

If your request concerns customer content for which we act as processor, and you are an end user rather than our direct customer, we may direct you to the relevant customer (the controller) or handle your request on their instructions.

You can unsubscribe from marketing using the link in our emails, or contact us at info@harnesshive.com. You also have the right to lodge a complaint with your local data protection supervisory authority. In Denmark this is Datatilsynet (datatilsynet.dk).

How to unsubscribe or opt out

Email footer: click "Unsubscribe" in any marketing message to stop receiving marketing emails.

Product analytics: change your analytics choice at any time in your account settings.

Direct request: email info@harnesshive.com to withdraw consent or request deletion.

Cookies and tracking

Our Cookie Policy governs all cookie-based processing on our website and in the Service, including cookies or similar technologies used for product analytics (PostHog), measuring newsletter signup conversions, and email engagement. The website stores nothing on your device that requires consent. In the Service we ask for your consent to product analytics when you sign up, and nothing is stored for analytics unless you agree.

Security

We implement appropriate technical and organizational measures and require our providers to do the same, including encrypted transmission, encryption at rest where applicable, access controls, hashed passwords and API tokens, and incident response procedures consistent with GDPR Art. 32. No system is perfectly secure, but we work to protect your data and will notify affected users and authorities of breaches as required by law.

Children's data

The Service is a professional tool not directed to children, and you must be at least 18 years old to create an account. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will remove it.

Changes

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated on this page with a revised "last updated" date, and, where appropriate, by additional notice, for example by email or in the Service.

Contact

For privacy inquiries, data rights requests, our DPA, or questions about our processors, contact us at info@harnesshive.com.