Data Processing Agreement

Categories of data, processing purposes, duration, and the customer's instructions are defined by the applicable service agreement and the evidence the customer chooses to provide.

Clarity Harbor processes personal data only to deliver the contracted service.

Access is limited to those who need it to deliver the service. Evidence is stored in access-controlled storage, transported over encrypted connections, and credentials are held in managed secret storage.

Clarity Harbor maintains a subprocessor registry, published at /legal/subprocessors, covering hosting, database, AI providers, email, payment processing, analytics, file storage, authentication and automation.

On request or at the end of the engagement, data is exported, returned or deleted in line with the retention policy and any legal retention requirement.

Security incidents affecting customer data are notified without undue delay. International transfer mechanisms, where applicable, are described in the final legally reviewed version of this agreement.