Privacy Policy

Harbourline is the controller of the personal information described in this policy. Our legal entity name is TO CONFIRM: full registered legal entity name, our registration number is TO CONFIRM: company registration number, and our registered address is TO CONFIRM: registered legal address.

Privacy questions and requests can be sent to hello@harbourlineconsult.com.

Data Protection Officer: TO CONFIRM: name and contact details, or confirmation that no DPO is appointed.

• Enquiries: name, email address, company, phone number, service interest and message.
• Account registration and profile: name, email address, company, phone number, country, password credentials and any initial enquiry. Passwords are handled by the authentication provider and are not visible to us in plain text.
• Social sign-in: basic account information supplied by Google when you choose that option.
• Regulatory readiness assessments: business model, business stage, target jurisdictions, business description, generated checklists and checklist progress.
• Documents: files you upload, their names, categories, file types, sizes and upload dates.
• Service and administration records: enquiry status, account administration and correspondence.
• Website usage: the analytics information described in section 7.

Please avoid sending special-category personal data or other people’s confidential information unless it is necessary and you are authorised to share it.

Depending on the circumstances, we rely on the following lawful bases under GDPR:

• Steps at your request before a contract and performing a contract: responding to enquiries, creating and administering accounts, providing consulting services, generating requested readiness checklists and handling documents.
• Legitimate interests: securing and improving the website, preventing misuse, managing our business and keeping appropriate records, where those interests are not overridden by your rights.
• Legal obligations: maintaining records and responding to lawful requests where applicable.
• Consent: optional analytics where consent is required, and any other processing for which we specifically ask for consent. You may withdraw consent at any time.

When you request a readiness checklist, your business model, stage, target jurisdictions and business description are processed through Lovable AI Gateway and its model providers to generate the checklist. The request, checklist and your progress are saved to your account.

The document-upload feature does not send your uploaded files to this AI feature. Checklists are general information, not legal advice, and should be reviewed by a qualified professional.

We do not sell personal information. We share only what is needed with:

• Lovable Cloud: website hosting, application infrastructure, database, authentication and private document storage.
• Lovable AI Gateway and its model providers: generating readiness checklists when requested.
• Google: social authentication when you choose that sign-in option.
• Google Fonts: delivering website fonts, which may involve technical connection information such as an IP address.
• Lovable: visitor analytics as described in section 7.
• Professional advisers, service providers or authorities: where necessary for our operations, legal obligations or protection of rights.

TO CONFIRM: final processor list and any additional business service providers

Some service providers may process information outside the European Economic Area. Where required, transfers should use an adequacy decision or appropriate safeguards such as European Commission Standard Contractual Clauses, with additional measures where necessary. TO CONFIRM: processing locations and transfer safeguards for each provider

Lovable’s analytics uses no cookies, stores nothing on the visitor’s device, doesn’t keep IP addresses and doesn’t identify visitors. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

It records:

• Pages visited, where visitors came from, and their country, browser, operating system and device type.
• How long visitors stay, how fast pages load, and errors.
• Button and link clicks.
• Our own action events: starting an enquiry form, enquiry validation failures, successful enquiries, readiness checklist requests and document uploads. These events record action categories, not the contents of messages or files.

For visitors in the EU/EEA, the UK, Switzerland and Canada, and visitors whose country cannot be determined, clicks and our own action events are recorded only after they accept analytics. For everyone else, they are recorded unless the visitor rejects analytics. They are never recorded for visitors whose browser sends Global Privacy Control, even after acceptance.

Page visits, time on page, page speed and errors are recorded for every visitor, without cookies and without identifying anyone. Detailed analytics data is kept for 90 days and daily summaries for one year.

• Enquiries: TO CONFIRM: retention period after the last contact or closure.
• Accounts and profiles: kept while the account is active and for TO CONFIRM: period after account closure.
• Readiness assessments: kept while the account is active and for TO CONFIRM: period after account closure.
• Uploaded documents: you can delete files through your account. Otherwise they remain in private storage while the account is active and for TO CONFIRM: period after account closure. Deletion removes the file from live storage; TO CONFIRM: backup retention and deletion period.
• Analytics: detailed data is kept for 90 days and daily summaries for one year.
• Privacy preferences: your choice is saved in your browser for up to 12 months.

We may retain information longer where reasonably necessary for legal claims, disputes or applicable legal obligations.

Measures used by the client portal include:

• Private file storage rather than public document URLs.
• Access rules that separate each client’s documents and records from other clients.
• Short-lived download links that expire after 60 seconds.
• File type restrictions and a 20 MB per-file limit.
• Authenticated accounts and server-checked administrator roles.

No online system can be guaranteed completely secure. You are responsible for keeping your sign-in credentials confidential and telling us promptly about suspected unauthorised access.

Subject to legal conditions and exceptions, you may ask to:

• Access your personal information and receive a copy.
• Correct inaccurate or incomplete information.
• Delete information or restrict how it is used.
• Receive information you provided in a portable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, without affecting earlier lawful processing.

Email hello@harbourlineconsult.com with enough detail for us to identify your request. We may need to verify your identity before acting. We aim to respond within one month, subject to any extension permitted by law for complex requests.

You can complain to the Cyprus Office of the Commissioner for Personal Data Protection at dataprotection.gov.cy, or to the data protection authority where you live or work. We would appreciate the chance to address your concern first.

We may update this policy as our services or legal obligations change. The latest version will always appear on this page.