Privacy Policy

Information We Collect

• Account info: email, name, optional phone number, brokerage name, and signature block.
• Team data: teams, team members, office location, and invite codes.
• Prospecting data you enter: listings, neighbor and lead contacts, notes, dispositions, call outcomes, and voice recap audio (deleted after transcription unless you save it).
• Usage data: device type, OS version, app version, and error diagnostics. Used solely to fix crashes and improve reliability.
• Purchase info: Apple-provided transaction identifiers only. We never see your card numbers.

Device Permissions

How We Use Your Information

• Provide the Harvest service.
• Keep your team's data fully separate from other teams.
• Generate AI follow-up drafts, voice recap summaries, and call-script briefings.
• Process payments through Apple In-App Purchase.
• Send transactional emails: account verification, password resets, and team invites.
• Detect abuse and protect the integrity of the service.

AI Processing

When you generate a follow-up message, post-call summary, or AI calling script, a minimal subset of your data (such as lead name, status, recent notes, or your voice recap audio) is sent to our third-party AI providers solely to fulfill that specific request.

These providers (Anthropic and OpenAI) contractually agree not to train their models on our customers' data. Voice recap audio is processed for transcription and then immediately deleted from their servers.

Sharing

We may also disclose information when required by law, court order, or to protect the rights and safety of Harvest, our users, or the public.

Retention

• Account data is retained while your account is active.
• If you delete your account (Settings → Account & Security → Delete my account), we delete your profile and associated data within 30 days.
• Some transactional records (payment receipts, audit logs) may be retained to meet tax and legal obligations.
• Voice recap audio is deleted immediately after transcription unless you explicitly save it to a contact.

Your Rights

Residents of certain jurisdictions (California, EU, UK) have additional rights. See the next two sections for details.

California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect about you.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information (Harvest does not sell or share personal information for advertising).
• Limit the use of sensitive personal information.

To exercise these rights, email support@harvest-app.net. We will respond within 45 days. We will not discriminate against you for exercising your rights.

EU / UK Privacy Rights (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the right to:

• Access your personal data.
• Request rectification or erasure.
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with your local supervisory authority.

The legal bases on which we process your data:

• Contract: to provide the service you signed up for.
• Legitimate interest: to improve, secure, and protect the service.
• Consent: for optional features you explicitly enable, such as AI summaries, location, and notifications.
• Legal obligation: when required by law.

To exercise any GDPR right, email support@harvest-app.net.

Security

• All data is encrypted in transit using HTTPS / TLS.
• Data at rest is encrypted by our infrastructure providers (Supabase, Apple).
• Authentication is handled by Supabase Auth with industry-standard password hashing.
• We review the security practices of our infrastructure providers annually.
• No system is perfectly secure. Use a strong, unique password and enable device-level biometrics.

If you discover a security vulnerability, email security@harvest-app.net. We will respond within 48 hours.

Children's Privacy

Harvest is a business tool for licensed real estate professionals and is not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal information from children under 13. If you believe a child has provided data to Harvest, email support@harvest-app.net and we will delete it promptly.

International Data Transfers

Harvest's primary infrastructure (Supabase, Anthropic, OpenAI, and Resend) operates from the United States. If you are in the EU or UK, your data may be transferred to and processed in the US. Where required by law, we rely on Standard Contractual Clauses approved by the European Commission and the UK ICO.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email at least 7 days before they take effect. The "Effective" date at the top of this page always reflects the latest revision.

Contact