Privacy Policy

Information we handle

• Account information, including your name, email address, credentials used for authentication and email verification status.
• Authentication, session and security information, which may include IP addresses and related technical information.
• Site and account metadata, including website names, addresses, selected designs, ownership and provisioning or deletion records.
• Support messages and information you provide when asking for help.
• Billing and subscription information received from FastSpring, including provider account or subscription references, lifecycle information, paid-through dates and billing-event receipt records.
• Technical and security logs where needed to operate the service, investigate failures and prevent abuse.

We receive information from you, from your use of the service and from providers involved in authentication, infrastructure or billing. DashHarbor does not store payment-card details or full raw FastSpring webhook bodies. Payment information may be processed directly by FastSpring.

Why we use it

We use relevant information to provide accounts and managed websites, authenticate you, administer subscriptions, answer support requests, operate and improve reliability, prevent fraud and abuse, and meet legal obligations.

Our lawful basis depends on the activity. Contract necessity supports providing a service you request as an individual. Legitimate interests support administration for business contacts, service reliability, security and abuse prevention, balanced against people's rights. Legal obligations may require accounting or other records. Where consent is needed, including for applicable optional marketing, we must obtain it and you can withdraw it.

Billing eligibility is calculated from subscription records received from FastSpring. If you believe a billing record or resulting restriction is wrong, ask for it to be reviewed through your service support channel.

Providers and sharing

Cloudflare provides infrastructure used to host and operate DashHarbor and customer websites, including storage, routing, secure access and email delivery infrastructure. It may process information as part of providing those services. FastSpring processes payments and subscriptions and provides information needed for billing administration. Its role for payment information is governed by the applicable provider notices and arrangements, not assumed to be the same as website hosting.

The free EmDash guide uses an embedded Auripath player and email form. Loading that guide connects your browser to Auripath. Information you choose to submit through its form is processed through that service; review the notices and choices presented with the form.

We may disclose relevant information where required by law or reasonably necessary to investigate abuse, protect rights or address a security incident. Disclosure should be limited to what is appropriate for its purpose. We do not describe every provider as a processor for every activity.

Where information is processed

Infrastructure and payment providers may process information in more than one country. We do not promise that all information stays in the UK. Where a restricted international transfer takes place, applicable data-protection safeguards are required. You can request information about relevant arrangements through your service correspondence.

Retention and website deletion

Different records are kept for different periods according to the purpose for which they are needed, the duration of the service relationship, security and dispute needs, and applicable legal or accounting obligations. We do not set a single retention period for all information in this policy. Records should not be kept longer than necessary for their lawful purposes.

Website deletion removes the website and associated customer-specific content and infrastructure as the deletion workflow completes. Limited site tombstones, provisioning and request history, resource identity, and deletion or audit history remain. Billing, security and other necessary administrative records may also remain. Deleting a website does not itself delete your account or cancel a subscription.

For personal data held on your behalf within a website, the DPA's return and deletion provisions apply. Retaining limited controller-side administrative records does not give us a general right to retain the website's personal data indefinitely.

Security and browser storage

Authentication uses secure, HTTP-only cookies. The DashHarbor application does not share its authentication cookies across customer-site subdomains. Access controls and other technical measures help protect service information, but no service can promise absolute security.

The marketing site also uses browser session storage to avoid repeatedly showing the EmDash guide promotion. See the Cookie Policy for cookies, similar storage and external embedded services.

Your rights

Depending on the information and lawful basis, UK data-protection law gives you rights to access your information, correct it, request erasure, restrict processing, object to processing and request portability. You can withdraw consent where processing relies on it. These rights have conditions and exceptions; a deletion request does not always require removal of a record that must lawfully be retained.

Use the support contact supplied with your service or existing DashHarbor correspondence to make a request or raise a concern. We may need to verify identity without collecting unnecessary information. You can also complain to the Information Commissioner's Office. Your rights do not depend on having a paid subscription.

If your request concerns information collected by a customer's website, contact that website's operator as controller. DashHarbor will assist the controller where required by the DPA and applicable law.

Updates

We will update this policy when information handling changes and identify the updated version. Material changes should be explained through appropriate service communications. The linked policies provide additional detail about service scope and website-data processing.