Privacy policy

• Account information. Your name, email address and password (stored only as a one-way hash), or your Google profile if you sign in with Google, plus the workspaces you belong to and your role in each.
• Workspace data. What you and your team store in Harp: accounts, contacts, qualification answers with their evidence, sequences, email copy and copy notes, and settings. This includes the details of prospects you import or that Claude adds for you, such as names, work email addresses, job titles, companies and LinkedIn profile URLs.
• Mailbox and calendar data. When you connect a mailbox, Harp stores its address and access tokens, any reply signature you set for it, and the emails it sends for you. It reads new mail in that mailbox to find replies, bounces and LinkedIn notification emails, and it stores only messages to or from contacts in your workspace and the details of those notices, not the rest of your inbox. To book a meeting, it reads free and busy times on that mailbox’s calendar and creates the event. Open and click tracking is off by default; only if your workspace turns it on does Harp count how often each email it sends is opened and its links are clicked.
• LinkedIn activity. If you use the Harp app for Mac, it records the LinkedIn actions it performs for you, the messages it sends and receives in those conversations, and the profile details it reads. It also saves screenshots of the LinkedIn pages it works on, to check what is on screen. These stay on your Mac, and each time the app starts it deletes the ones more than 30 days old. If Claude screen analysis is turned on for your workspace, the app sends those screenshots to Claude through the Claude setup on that Mac. The app reports its errors to Sentry.
• Slack. If you connect Slack, Harp stores the connection and the channel it posts to, the messages it posts there (such as LinkedIn reply drafts waiting for your go-ahead, and notes on the replies Claude handled) and your responses to them.
• Claude connections. When you connect Claude to Harp, Harp stores a record of the connection: the Claude app that connected, your user and the workspace you chose, when it was created and last used, and whether it has been revoked. The tokens themselves are stored only as one-way hashes.
• Tool-call inputs.When Claude calls a Harp tool, Harp receives the inputs Claude sends for that call (for example, the accounts to save or the text of a reply) and uses them to perform the action. What the action saves becomes part of your workspace data. Harp's request and error logs may show that a call was made and any error it hit.
• Technical data. Error reports and performance traces from the Harp app, and the IP address and browser details that come with any web request.
• Cookies. Harp sets a session cookie to keep you signed in. Harp does not use analytics or advertising cookies.

Harp does not receive your conversations with Claude. It receives only the inputs Claude sends when it calls a Harp tool, and it returns the result of that call to Claude. Harp does not store anything else from your Claude conversations, and it does not use tool-call data to build profiles of you or for advertising.

What Claude does with the results Harp returns is governed by your agreement with Anthropic, not by this policy.

• To run the service: store your records, send email from your mailbox, detect replies, book meetings, run sequences and LinkedIn steps, and answer Claude’s tool calls.
• To secure the service, prevent abuse and enforce workspace roles.
• To support you and to find and fix problems.

Harp does not sell personal data, does not use it for advertising and does not train AI models on it.

Harp uses data from Gmail and Google Calendar only to provide the features described in this policy. When Claude handles your replies, Harp passes each reply to your Claude through the connector and, if Slack is connected, posts a short note there saying who replied and what Claude did. Otherwise, if your workspace has set up an AI model provider, Harp sends the text of an incoming reply, with the earlier messages in its thread, to that provider to sort the reply and suggest a response. Harp does not use Google user data for advertising, does not sell it and does not use it to train AI models.

Harp’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Harp’s database runs on Supabase (Postgres) and the app runs on Vercel, both in the United States. If you use Harp from another country, your data is transferred to and processed in the United States. Data is encrypted in transit over HTTPS.

Access tokens for connected mailboxes, calendars, Slack and other connected services, mailbox passwords and API keys you add for other services are encrypted at rest with AES-256-GCM. Tokens for Claude connections and Harp API keys are never stored in readable form: Harp keeps only their SHA-256 hashes. Every workspace is separate, and each person’s access is limited by their role in it.

Harp uses these providers to run the service. Each one gets only what it needs.

• Supabase: the database where workspace data is stored.
• Vercel: hosting for the Harp app, its API and the Claude connector, and its scheduled jobs.
• Upstash: short-lived data such as rate limits, scheduling locks and live inbox updates.
• Resend: Harp’s own account emails, such as email verification and password resets, and the delivery events for them. Outreach is never sent through Resend.
• Sentry: error monitoring for the Harp app and the Harp app for Mac.
• AI model providers (such as OpenAI, Anthropic or Groq): used only if your workspace sets one up with its own API key or points Harp at its own model server. Then some Harp features, whether you use them in the Harp app or Claude calls them through the connector, send the text they work on to that provider. Examples are sorting an incoming reply, researching or scoring an account, and filling in a data column.
• Tavily: web search for those research features, used only if your workspace adds its own Tavily key.

When you connect a service, Harp exchanges data with it on your behalf, and that service’s own terms and privacy policy apply.

• Your mailbox and calendar provider, such as Google Workspace (Gmail and Google Calendar), to send email, read replies and book meetings.
• Slack, to ask for your go-ahead on LinkedIn replies.
• Claude (Anthropic), through the connector or a reply routine you set up. To wake a reply routine, Harp sends only the number of pending replies and your workspace ID.
• LinkedIn, through the Harp app for Mac, which uses your own browser on your own computer.
• Any other service you connect to your workspace, which exchanges with Harp only what that connection needs.

Harp keeps workspace data for as long as the workspace exists.

Some records you delete in the Harp app, including accounts, contacts and sequences, are first marked as deleted and kept so they can be restored if they were deleted by mistake. They stay in the database until the Harp team deletes them on request.

A revoked Claude connection stops working at once. Its record, which holds only token hashes, is kept as a security log.

You can ask Harp to delete your account, your workspace or specific records at any time by emailing tomas@harpgtm.com. On request, the Harp team deletes that data from the database, including records that were marked as deleted. Copies in the database provider’s backups and in error and request logs are not removed on request; they expire on those providers’ own schedules.

You can see and change most of your data in the Harp app. You can disconnect a mailbox, Slack or Claude at any time: revoke a Claude connection in Harp under Settings, Integrations, Developer, Claude Connections, or disconnect Harp in Claude. Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how it is used. Email tomas@harpgtm.com to make a request.

If you received outreach sent through Harp, the company that contacted you decides how your data is used. Reply to that email to stop it, or contact that company. If the email has an unsubscribe link or button, using it adds your address to that company’s suppression list in Harp and stops the emails they send you through Harp. You can also email tomas@harpgtm.com and Harp will pass your request on and help them act on it.

Harp is a service for businesses and is not meant for anyone under 16.

If this policy changes, the new version will be posted on this page with a new date. If a change is significant, Harp will tell customers by email before it takes effect.

Questions about privacy or this policy, and requests about your data, go to tomas@harpgtm.com.