Privacy
Privacy notice
Last updated
Contents
In short
- This site sets no cookies, and uses no analytics or advertising cookies.
- We only hold what you send us — newsletter sign-ups, enquiries (including the copy emailed to our mailbox) and issue reports — plus keyed hashes of IP and email addresses to prevent abuse.
- Your theme preference and saved items stay in your browser and are never sent to us.
- You can ask for access to, correction or deletion of your data, or object to how we use it.
Who is responsible
HARBAN AI LABS is responsible for the personal data collected through this site. To contact us about your data, see Your rights. To report a security vulnerability, use the Work with us form (enquiry type “Something else”) and ask how to send the details — please don’t put them in the form itself.
Newsletter sign-ups
- Your email address
- Your subscription status
- The page you signed up from
- Timestamps — for example, when you signed up, confirmed or unsubscribed
- Hashed versions of the confirmation and unsubscribe tokens in your email links (we keep only the hash, not the token)
Why: to send you the newsletter you asked for and to record that you confirmed it.
Double opt-in: signing up sends a confirmation email. You are only subscribed once you click the link in it. You can unsubscribe at any time.
How long: sign-ups that are never confirmed are deleted within 8 days of the last confirmation email we sent. If you unsubscribe, your address is deleted within 31 days.
Work-with-us enquiries
What we collect
- Your name and work email
- Your company and company website, if you give them
- The project type, your requirements and your message
- Budget and timeline, if you choose to give them
- An attached brief, if you add one (PDF, DOCX, TXT or MD, up to 4 MB), stored privately with its file name, type and size
- The time you gave consent
- A keyed hash of your IP address, for abuse prevention
- The results of automated spam checks — for example, whether the bot check was passed and whether the email address belongs to a free email provider
Why: to reply to your enquiry and work out whether and how we can help.
About the keyed hash: it is a one-way code computed from your IP address with a secret key. It lets us recognise repeated abuse without keeping the address itself.
Who sees it: a copy of your enquiry is emailed to our mailbox so we can reply — the details you entered, the name and size of any attached brief (not the file itself) and the spam-check results. See Service providers.
Confirmation email to you: if confirmation emails are switched on and your enquiry passes our spam and bot checks, we may email the address you entered a one-time “Message received” confirmation with your name, the enquiry type, your requirements and message (shortened to about 1,200 characters, with web addresses, email addresses and phone numbers removed) and your reference number. The same inbox gets at most three such emails a day (one a week while our bot check is switched off), and we limit how many are sent per connection, per hour and per day, to make it hard to use the form to email someone else. It is sent through our email provider (see Service providers). We keep a note with your enquiry that it was sent (or that sending failed); it is deleted together with the enquiry. If you reply to it, your reply reaches our mailbox.
How long: every enquiry, whatever its status, is deleted within 24 months and one day of when you submit it, together with any attached brief. Enquiries flagged as spam are deleted within 31 days. We delete the copy in our mailbox on the same schedule — and the copy of any confirmation email we sent you that our mailbox keeps among its sent messages; that deletion is done by hand.
“Report an issue” submissions
What we collect
- Which page the report is about
- Your message
- Your email address, if you choose to give it
- A keyed hash of your IP address, for abuse prevention
Why: to check the problem you reported and correct the page if needed.
How long: deleted within 12 months and one day.
Website assistant
When the assistant at /assistant is switched on, the questions you type and the recent turns of the conversation are sent to xAI, the provider of the Grok model, to generate each answer. We do not store or log the conversation: it stays in your browser tab and is gone when you reload the page. We keep only counters, based on a keyed hash of your IP address, to limit how many messages one visitor and the whole site can send. Before your first question you pass a bot check (Cloudflare Turnstile).
xAI says it keeps API requests and responses for 30 days for abuse auditing and does not train its models on them (xAI security FAQ (external site)). The answers are generated by AI and can be wrong. Please do not type personal or confidential information into the assistant.
Rate limiting
To stop automated abuse of our forms, we count requests using keyed hashes of IP addresses and, for newsletter sign-ups and enquiries, of email addresses — never the addresses themselves. These records are deleted within 3 days, except the one that limits confirmation emails to one per inbox every 7 days (used while our bot check is switched off), which is deleted within 9 days.
Stored only in your browser
Two things are kept only in your browser’s local storage and are never sent to us:
- your theme preference (light, dark or system);
- the pages you save with the Save button — see Saved items.
You can remove saved items on the Saved items page, or clear both by clearing this site’s data in your browser.
Cookies
This site does not set cookies, and uses no analytics or advertising cookies. If you press play on a video, the YouTube player loads under Google’s own terms — see Service providers.
Service providers
We use each of these providers only if the feature that needs it has been set up for this site.
Service providers and what they are used for
| Provider | Used for |
|---|---|
| Hosting provider | Hosting and serving this site |
| Postgres database provider | Storing newsletter sign-ups, enquiries, issue reports and rate-limiting records |
| Resend | Sending email when the site sends through Resend — the newsletter confirmation email, the notification of a new enquiry to our mailbox and the “Message received” confirmation to you |
| Google (Gmail) | Sending our email when the site sends through Gmail — the notification of a new enquiry to our mailbox and the “Message received” confirmation to you |
| Mailbox provider | Receiving and storing our email: the notification of each new enquiry, which contains the details you entered, the name and size of any attached brief (not the file) and the spam-check results; any reply to our emails; and the copies of the emails we send, which a mailbox keeps among its sent messages. We delete enquiry notifications and our copies of confirmation emails on the same schedule as the enquiry itself. |
| Notification webhook | Telling us a new enquiry has arrived. It receives only the enquiry reference and the type of enquiry — not your name, contact details, company, message or attachment. |
| Cloudflare Turnstile | Bot protection on the Work with us form and the website assistant. Cloudflare says it processes signals including your IP address, TLS fingerprint and browser user agent (Turnstile privacy addendum (external site)). |
| xAI (Grok) | Generating the website assistant’s answers from the questions you type there. See Website assistant. |
| Object storage | Storing attached briefs privately |
| YouTube | Playing videos — only when you press play on one. Players use YouTube’s privacy-enhanced mode (YouTube Help (external site)). |
How long we keep data
Deletion runs as a daily clean-up job, so each period below includes up to one extra day for the job to run.
Retention periods, by type of data
| Data | How long we keep it |
|---|---|
| Newsletter sign-ups that are never confirmed | Deleted within 8 days of the last confirmation email |
| Newsletter subscriptions | While you are subscribed; deleted within 31 days after you unsubscribe |
| Work-with-us enquiries, including any attached brief | Deleted within 24 months and one day of submission, whatever the enquiry’s status |
| Enquiries flagged as spam | Deleted within 31 days |
| Enquiry notification emails and our copies of confirmation emails, in our mailbox | Deleted by hand on the same schedule as the enquiry |
| “Report an issue” submissions | Deleted within 12 months and one day |
| Keyed IP and email hashes used for rate limiting | Deleted within 3 days (for the weekly limit on confirmation emails: within 9 days) |
| Theme preference and saved items | Only in your browser, until you remove them — never sent to us |
Your rights
You can ask us to:
- give you access to the personal data we hold about you;
- correct it if it is wrong;
- delete it;
- object to how we use it.
How to ask: send your request through the Work with us form — choose “Something else” as the enquiry type; a company name is not needed — and say what you would like us to do.