Privacy Policy
Last updated: November 11, 2026
This Privacy Policy is effective as of November 11, 2026.
Notice at collection for U.S. state residents. See the "State privacy rights notice" section below for information about your rights under applicable U.S. state privacy laws.
Notice to European users. If you are in the European Economic Area or the United Kingdom (which we call "Europe"), please also read the "Notice to European users" section below.
NextGen Software, a Delaware company ("NextGen Software," "we," "us" or "our"), provides Harken, a business-to-business software service that finds public conversations on social networks in which people show a need for a product, scores them, matches the people behind them against a customer's ideal customer profile, and helps the customer's team prepare outreach that a person approves.
This Privacy Policy describes how we process personal information through the Harken website at https://heyharken.com, the Harken web application, the Harken API and MCP server, the Harken apps for Slack, the emails we send, and the other activities described in this policy (together, the "Service").
Who this policy is about
This policy covers three groups of people:
- Visitors to our website.
- Users: people who sign up for Harken or are invited to a Harken workspace, usually on behalf of the business that subscribes to the Service (our "Customer").
- People featured in the Service: people who are not Harken users but whose public posts, comments or reactions on social networks, or whose professional details, are processed through the Service. We call them "Prospects." The section "Information about people who are not Harken users" explains in one place what we do with their data and how they can object.
Personal information we collect
Information you provide to us
Personal information you may provide to us through the Service or otherwise includes:
- Contact data, such as your first and last name, work email address, job title or role, company name and the address of your LinkedIn profile.
- Account data, such as your sign-in email and password, your workspace, your role (owner, admin or member) and your seat, and the settings and notification choices you make.
- Company data, such as your company's website and description, the keywords, competitors and ideal customer profile you set, your smart-filter questions and your writing instructions.
- Communications data, based on our exchanges with you, including when you contact us by email or through the in-app support chat.
- Transactional data, such as your plan, billing interval, subscription status, invoices, seats, and credit grants and spending.
- Marketing data, such as your choice to receive or not receive our marketing emails.
- User content and input data, such as the questions you put to Ask, the drafts, outreach plans and sequence texts you write or approve, notes and statuses you set on posts and leads, the entries on your do-not-contact list, and the searches you run.
- Data about others, such as the work email addresses of teammates you invite, and details of people you add as leads. Please only share another person's details with us if you are allowed to do so.
We do not ask for payment card numbers. Card details you enter at checkout are collected directly by our payment processor, Stripe.
Information from connected accounts and other sources
We may combine personal information you give us with personal information we obtain from other sources, such as:
- Sign-in providers. If you sign in with Google, we receive your name, email address and the basic profile information Google shares under your settings.
- Accounts you connect. When you link a LinkedIn or Gmail account, the sign-in happens on a page run by our messaging partner, Unipile. We never see your password. We keep a reference to the account, its connection status and the actions taken through it. For a linked LinkedIn account, we also copy your LinkedIn conversations into the Messages page so that you can read and answer them in Harken. Those conversations are visible only to you, not to your teammates. Emails sent from a linked Gmail account are sent through Unipile, but Gmail threads are not copied into Harken.
- Slack. If an owner or admin connects Slack for alerts, we receive the workspace and channel details needed to post alerts. If they connect Slack monitoring, see "Slack communities" below.
- Lemlist. If you connect Lemlist, we store the API key you paste, encrypted, and the list of your campaigns, so that you can send leads to a campaign.
- AI assistants and API tools. If you connect an AI assistant through our MCP server or create a personal API token, we keep a record of the assistant or token, the permissions you granted and when it was last used. For personal tokens we keep only a fingerprint, never the token itself.
- Payment processor. Stripe tells us about the status of your payments and subscription.
- Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction, such as a merger, acquisition, financing or sale of assets, or in the context of an insolvency, bankruptcy or receivership.
Automatic data collection
We and our service providers may automatically log information about you, your device and your use of the Service, such as:
- Device data, such as your browser type and version, operating system, IP address and general location derived from it (such as country or city), and language settings.
- Online activity data, such as the pages and features of the app you use, the time and length of your visits, and errors you run into.
For more information, see "Cookies and other technologies" below.
Information about people who are not Harken users
This section is for Prospects: people whose public social-media activity or professional details are processed through Harken, although they have not signed up.
What we process
- Public posts and activity: the text of a public post, comment or reaction, its link and date, and the network it appeared on. The networks the Service can read are LinkedIn, X, Reddit, YouTube, Instagram, Threads, TikTok, Facebook and Product Hunt; which ones are switched on varies.
- Public profile details: name, headline or job title, employer, seniority, location and the address of the public profile.
- Company details: the employer's name, website, industry, size and location.
- Work email address: only when a Customer asks Harken to look one up for a particular lead.
- People-database results: when a Customer uses the Search feature, the name, title, employer, location and LinkedIn profile address of people who match the Customer's filters.
- Information generated by Harken: summaries of posts, relevance, intent and fit scores, intent tags such as "Buy Intent," and a short explanation of why a person fits the Customer's ideal customer profile.
- Outreach history: the steps a Customer's outreach plan took with a person (such as a profile visit, a reaction, an invitation, a message or an email), and the LinkedIn conversation between the person and the Customer's user who linked the account.
We do not intentionally collect sensitive information such as health data, political opinions or religious beliefs. We ask our Customers not to enter any.
Where it comes from
- Data providers. Public posts and engagement come from data providers that supply publicly available social-media data: Apify, Bright Data, ScrapeCreators and EnsembleData.
- Official network APIs. Some networks are read through their official programming interfaces: X, Reddit, YouTube and Product Hunt.
- Enrichment providers. Company details, work email addresses and Search results come from Icypeas and Prospeo.
- Slack communities. If a Customer switches on Slack monitoring, Harken reads the Slack channels the Customer picks, with the access of the person who connected Slack. See "Slack communities" below.
- A Customer's linked LinkedIn account. Conversations a Prospect has with a Customer's user appear in that user's Messages page.
We do not collect public social-media posts by signing in to the networks with our Customers' personal accounts. The two exceptions are the Slack monitoring and Messages features described above, which a Customer chooses to switch on.
Slack communities
When Slack monitoring is on, Harken reads new messages in the chosen channels and judges whether a thread is a buying signal. The message text is kept only while it is being judged and is not stored. What we keep is a short summary written in our own words, the channel name, and the author's name and job title from their Slack profile. Harken never posts in a monitored channel.
Why we process it
- To show our Customers public conversations in which people look for, compare or complain about products like theirs.
- To identify which people behind those conversations match a Customer's ideal customer profile, and to explain why.
- To let a Customer contact those people about its products, when the Customer decides to do so. By default, a person on the Customer's team approves each outreach plan before anything is sent.
- To honor objections and deletion requests, and to keep people on a do-not-contact list from being added again or contacted.
- To operate, secure and improve the Service.
Who is responsible
Two parties are involved, and the roles differ by activity:
- NextGen Software is the controller of the collection and compilation of public social-media data and enrichment data that Harken performs to provide the Service, and of how the Service itself works.
- The Customer is the controller of its decision to contact a person, the content of its outreach and its follow-up, and of any data it exports from Harken (for example to a spreadsheet or to Lemlist). For that outreach, NextGen Software acts as the Customer's processor, following the Customer's instructions under our agreement with the Customer.
Legal basis
Where European law applies, we rely on legitimate interests: our Customers' interest in finding and contacting businesses and professionals who are publicly discussing a need their product may meet, and our own interest in providing the Service. We limit the data to public, professional content and business contact details, do not keep Slack message text, require human approval of outreach by default, and make objecting simple. A Customer that contacts a person is responsible for its own legal basis for that outreach.
Because we do not usually have contact details for the people whose public posts we process, we provide this information through this policy, which is publicly available on our website.
Your rights and how to object
You can ask us at any time to stop processing your data, to give you a copy of it, to correct it or to delete it. Email hello@heyharken.com and include the address of your public profile (for example your LinkedIn profile URL) and any email address you want covered, so that we can find you.
When we act on a deletion request, we delete the data about you that is stored in Harken and add your LinkedIn profile and email address to a do-not-contact list. The list exists so that a later collection does not add you back and no outreach through Harken reaches you. We keep only the minimum needed for this purpose. Customers can also take the same step themselves from a lead's detail panel.
If a Customer has already copied your data out of Harken, for example into a spreadsheet or another sales tool, that copy is under the Customer's control. Where appropriate, we will pass your request on to the Customer, and you may also contact the Customer directly.
If you are in Europe, the rights listed in "Notice to European users" below also apply to you, including the right to complain to a data protection authority.
Cookies and other technologies
Public pages. Our public website pages do not use analytics, advertising or marketing cookies.
Essential cookies. We use cookies that are strictly necessary to sign you in and keep your session secure. Our sign-up, sign-in and password-reset forms use Cloudflare Turnstile to tell people from bots; Turnstile processes technical information about your browser and device for that purpose.
In the signed-in app. When they are switched on, two further tools run only for signed-in users:
- PostHog for product analytics, hosted in the European Union. We set it up to record the product events we choose, without session recordings, and we identify you to it by an internal user ID only, not by your name or email address.
- Intercom for the in-app support chat. To recognize you, Intercom receives your user ID and your confirmed email address, and the content of the conversations you have with us. Intercom uses its own cookies to run the chat.
Device preferences. Some display preferences, such as sound effects and animations, are saved in your browser's local storage on that device.
Your choices. Most browsers let you block or delete cookies. If you block essential cookies, you will not be able to sign in.
AI technologies. Harken uses AI models provided by Anthropic to score and summarize posts, explain why a person fits your ideal customer profile, write reply and outreach drafts, answer questions in Ask and turn search sentences into filters. To do this, the relevant content (such as the text of a post and your company description) is sent to Anthropic. We do not use your data, or data about Prospects, to train AI models, and we use Anthropic under commercial terms that do not allow it to train its models on the data we send.
How we use your personal information
We may use your personal information for the following purposes or as otherwise described at the time of collection.
Service delivery and operations
We may use your personal information to:
- provide the Service, including running your agents, scoring posts, finding leads, looking up work emails, running approved outreach plans and answering questions in Ask;
- set up and maintain your account and workspace, including invitations, roles and seats;
- process payments and manage your subscription and credits;
- enable security features of the Service;
- communicate with you about the Service, including digests, alerts, security notices, and support and administrative messages; and
- provide support and respond to your requests, questions and feedback.
Service improvement and analytics
We may use your personal information to understand how the Service is used, fix problems, improve the Service and develop new features. See "Cookies and other technologies" above.
Marketing
We may send you occasional emails about new features. You can switch them off at any time under Settings, Notifications, Marketing emails, or by contacting us. We do not use interest-based advertising, and we do not share personal information with advertising partners.
Compliance and protection
We may use your personal information to:
- comply with applicable laws, lawful requests and legal process, such as subpoenas or requests from government authorities;
- protect our, your or others' rights, privacy, safety or property, including by making and defending legal claims;
- audit our internal processes for compliance with legal and contractual requirements and our internal policies;
- enforce the terms that govern the Service; and
- prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.
Corporate events
We may share certain personal information in the context of actual or prospective corporate events. See "How we share your personal information" below.
Aggregated, de-identified and anonymized data
We may create aggregated, de-identified or anonymized data by removing the information that makes the data identifiable to you, and we will not attempt to re-identify it. We may use this data for our lawful business purposes, such as analyzing and improving the Service. We do not use it to train AI models.
Further uses
If we want to use your personal information for a new purpose that is not compatible with the purpose for which it was collected, we will ask for your consent first.
Retention
We keep personal information for as long as we need it for the purposes for which we collected it, including to meet legal, accounting or reporting requirements, to establish or defend legal claims, and to prevent fraud. To decide how long to keep it, we consider the amount, nature and sensitivity of the information, the risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve them by other means, and legal requirements.
In practice:
- Account and workspace data is kept while the Customer's account is open. If a trial ends without a subscription, the workspace is kept so that it can resume when a plan starts. You can delete your account yourself under Settings, Account. It is deleted at once: your sign-in, profile, linked accounts, API tokens and Ask history go, and a workspace you own alone is deleted with its data. If you belong to a workspace someone else owns, you leave it; the work you shared there stays with that workspace, and approvals you gave stay on record without your name. When a Customer instead asks us by email to close its account, we delete or anonymize its workspace data within a reasonable period, unless we must keep some of it by law.
- Deleted accounts. So that a deleted account does not get a second free trial, we keep a keyed hash of its sign-in email (the email cannot be read back from it), together with the account's internal identifier and the date it was deleted. We keep them until you ask us to remove them.
- Billing records. Invoices and payment records held by our payment processor, Stripe, are kept for as long as tax and accounting law requires, also after an account is deleted.
- Prospect data stays in the Customer's workspace until the Customer deletes it, the account is closed, or the person asks us to delete it. Slack message text is never stored.
- Do-not-contact entries are kept for as long as they are needed to honor the request.
When we no longer need personal information, we delete it, anonymize it or, where that is not yet possible (for example, because it is held in backups), isolate it from further processing until it can be deleted.
How we share your personal information
We may share personal information with the following parties, or as otherwise described in this policy or at the time of collection.
Your workspace. Posts, leads, outreach plans and other workspace data are visible to the members of the Customer's workspace, according to their roles. Your LinkedIn conversations in Messages are visible only to you.
Service providers. Companies that process personal information on our behalf to help us run the Service. They are listed below with what they do.
| Provider | What it does |
|---|---|
| Supabase | Database and user sign-in |
| Render | Application hosting, in Frankfurt, Germany (EU) |
| Stripe | Payments and subscription billing |
| Resend | Sending emails, such as digests and team invitations |
| Cloudflare (Turnstile) | Bot protection on sign-up and sign-in forms |
| Anthropic | AI models for scoring, summaries, drafts, Ask and search |
| Unipile | Connecting LinkedIn and Gmail accounts, and sending and syncing messages |
| PostHog | Product analytics for signed-in users, when enabled |
| Intercom | In-app support chat, when enabled |
| Slack | Alerts and community monitoring, only when a Customer connects it |
| Lemlist | Receiving leads a Customer sends to a campaign, only when a Customer connects it |
| Apify, Bright Data, ScrapeCreators, EnsembleData | Supplying public social-media posts and engagement |
| Icypeas, Prospeo | Company enrichment, work email lookup and people search |
Our database and application are hosted in the European Union (Frankfurt, Germany). Other providers may process data in the United States or elsewhere; see "International data transfer" below.
Payment processors. Payment card information you use to subscribe is collected and processed directly by Stripe. Stripe may use your payment data in accordance with its privacy policy, at https://stripe.com/privacy.
Third parties you designate. We share personal information with third parties when you instruct us to, for example when you send leads to Lemlist, post alerts to Slack, send a message from a linked LinkedIn or Gmail account, or connect an AI assistant or tool to your workspace through our MCP server or API. What those third parties do with the data is governed by their own terms and privacy policies.
Linked third-party services. If you sign in with Google or link a LinkedIn, Gmail or Slack account, information passes between us and that service as needed to provide the feature. The third party's use of the information is governed by its own privacy policy and your settings with it.
Professional advisors. Lawyers, auditors, bankers and insurers, in the course of the professional services they provide to us.
Authorities and others. Law enforcement, government authorities and private parties, where we believe in good faith that it is necessary or appropriate for the compliance and protection purposes described above.
Business transferees. We may disclose personal information in the context of actual or prospective business transactions, such as an investment in or financing of NextGen Software, or the sale, transfer or merger of all or part of our business, assets or shares. We may also disclose it to an acquirer, successor or assignee as part of a merger, acquisition, sale of assets or similar transaction, or in the event of an insolvency, bankruptcy or receivership.
We do not sell personal information, and we do not share it for targeted advertising.
Your choices
These choices are available to everyone. People in certain U.S. states and in Europe have additional rights, described further below.
Access or update your information. You can review and update your account information under Settings, Account.
Opt out of marketing emails. You can switch off marketing emails under Settings, Notifications, or by contacting us. You will still receive service-related emails, such as security and billing notices.
Cookies. See "Cookies and other technologies" above.
Do Not Track. Some browsers send "Do Not Track" signals. We currently do not respond to them. Our public pages do not use tracking cookies in any case.
Declining to provide information. We need certain information to provide the Service. If you do not provide information we identify as required, we may not be able to provide the Service.
Linked third-party accounts. You can disconnect a linked LinkedIn, Gmail, Slack or Lemlist account, revoke an API token or disconnect an AI assistant in Settings at any time. Disconnecting does not delete information we received before you disconnected.
Close your account. Delete your account yourself under Settings, Account, or email hello@heyharken.com to close it or to ask us to delete your data.
Other sites and services
The Service contains links to, and integrations with, websites and services run by third parties, such as the social networks where posts appear. These links are not an endorsement of, or a statement that we are affiliated with, those third parties. We do not control them and are not responsible for their actions. Please read their privacy policies.
Security
We use technical, organizational and physical safeguards designed to protect personal information. For example, we never see the passwords of the LinkedIn or Gmail accounts you link, we encrypt integration keys such as your Lemlist API key before storing them, and we store only a fingerprint of personal API tokens. No internet service is perfectly secure, however, and we cannot guarantee the security of your personal information.
International data transfer
NextGen Software is a U.S. company, and some of our service providers operate in the United States and other countries. Your personal information may be transferred to and processed in countries whose privacy laws may not be as protective as those where you live.
Users in Europe should read "Data processing outside Europe" in the Notice to European users below.
Children
The Service is meant for businesses and is not intended for anyone under 18 years of age. If you are a parent or guardian and believe we have collected personal information from a child in a way the law does not allow, please contact us. If we learn that we have, we will delete it as the law requires.
Changes to this Privacy Policy
We may change this Privacy Policy at any time. If we make material changes, we will update the date at the top and post the new version on our website, and we may also tell you by email or in the app. Changes take effect when we post them, unless we say otherwise. If you keep using the Service after a change takes effect, the updated policy applies to your use of the Service.
How to contact us
If you have questions about this policy or want to exercise a privacy right, contact us:
- Privacy questions and requests: hello@heyharken.com
- Legal notices to NextGen Software: advertising@nextgensoftlab.com
State privacy rights notice
This section applies to residents of U.S. states whose privacy laws apply to us and give their residents the rights below (the "State Privacy Laws").
Business context. Harken is a business service. Some State Privacy Laws do not apply to information about people acting in a business or employment context, and these rights apply only to the extent those laws apply to us. Where we process information as a service provider or processor for a Customer, such as data used in that Customer's outreach, we will pass your request to the Customer or ask you to contact the Customer directly.
For this section, "Personal Information" has the meaning of "personal data," "personal information" or a similar term in the State Privacy Laws, and "Sensitive Personal Information" has the meaning of "sensitive personal information," "sensitive data" or a similar term, but neither includes information exempt from those laws.
Your privacy rights
Depending on your state, you may have some or all of these rights. They are not absolute, and we may decline a request where the law allows.
- Information. You can ask what categories of Personal Information we collected about you, the categories of sources, our business purposes for collecting it, and the categories of third parties to which we disclosed it.
- Access. You can ask for a copy of the Personal Information we hold about you.
- Correction. You can ask us to correct inaccurate Personal Information about you.
- Deletion. You can ask us to delete Personal Information about you.
- Appeal. You can appeal our refusal of a request.
Opt-outs. We do not sell Personal Information. We do not process Personal Information for targeted advertising. We do not use Personal Information for profiling or automated decision-making that produces legal or similarly significant effects, such as decisions about financial services, housing, education, employment, health care or criminal justice.
Consumers under 16. We do not have actual knowledge that we collect, sell or share the Personal Information of consumers under 16 years of age.
Sensitive Personal Information. We process a limited amount of Sensitive Personal Information: your sign-in credentials, and, if you link a LinkedIn account, the content of your LinkedIn conversations so that you can read and answer them in Harken. We do not use Sensitive Personal Information to infer characteristics about you.
Nondiscrimination. We will not discriminate against you for exercising these rights.
How to exercise your rights
Email hello@heyharken.com with your request. Tell us which right you want to use and give enough detail for us to find your data, such as your account email or, if you are not a Harken user, the address of your public profile.
Verification and authorized agents. We may need to verify your identity before acting on a request, usually by asking you to confirm control of the email address or account involved, and we may confirm your state of residence. Where the State Privacy Laws allow, you may use an authorized agent. We may ask the agent for proof of their authority, such as a power of attorney or your signed permission, and may ask you to confirm your identity with us directly.
Information practices
The following describes our practices now and during the past 12 months.
Sources and purposes. We collect Personal Information from the sources, and use it for the purposes, described earlier in this Privacy Policy.
Retention. How long we keep Personal Information depends on whether it is still needed for the purposes for which we collected it, including meeting our legal obligations. See "Retention" above.
De-identification. We do not attempt to re-identify de-identified information derived from Personal Information, except to test whether our de-identification processes comply with the law.
Personal Information we collect, use and disclose. The table below summarizes our practices by reference to the categories in "Personal information we collect" above and the categories in the California Consumer Privacy Act (Cal. Civ. Code § 1798.140). Information you choose to give us in free-form fields may include other categories.
| Personal Information we collect | CCPA category | Purposes | Third parties to which we disclose it for a business purpose | Third parties to which we sell or share it |
|---|---|---|---|---|
| Contact data, account data and company data | Identifiers; customer records information; professional or employment-related information | Service delivery and operations; marketing; compliance and protection | Service providers (hosting, database, email, support chat, AI); professional advisors; authorities; business transferees | None |
| Transactional data | Commercial information; customer records information | Service delivery and operations (billing); compliance and protection | Payment processor; professional advisors; authorities | None |
| Sign-in credentials and LinkedIn conversation content | Sensitive Personal Information | Providing your account and the Messages feature; security | Service providers (sign-in provider, messaging partner, hosting) | None |
| Communications, user content and input data | Identifiers; customer records information | Service delivery and operations; support | Service providers (support chat, AI, hosting); third parties you designate | None |
| Device data and online activity data | Identifiers; internet or other electronic network activity information | Security; service improvement and analytics | Service providers (hosting, bot protection, product analytics) | None |
| Prospect data (public posts and profile details, company details, work emails, scores and fit explanations) | Identifiers; professional or employment-related information; internet or other electronic network activity information; inferences | Providing the Service to Customers; honoring objections and deletion requests; compliance and protection | The Customer whose workspace holds the data; service providers (AI, hosting, enrichment); third parties a Customer designates; professional advisors; authorities | None |
Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
Contact us. If you have questions about this section, use the contact details in "How to contact us" above.
Notice to European users
General
Where this notice applies. This section applies only to individuals in the European Economic Area and the United Kingdom ("Europe").
Personal information. In this Privacy Policy, "personal information" includes "personal data" as defined in the GDPR: information about a person who is identified, or can be identified, directly or indirectly.
Controller. NextGen Software is the controller of the personal information covered by this Privacy Policy for the purposes of the EU General Data Protection Regulation and the UK General Data Protection Regulation together with the UK Data Protection Act 2018 (each, as applicable, the "GDPR"), with one exception: where we process Prospects' personal information for a Customer's outreach, the Customer is the controller and we act as its processor, as described in "Who is responsible" above. See "How to contact us" for our contact details.
Our legal bases for processing
The GDPR requires us to have a legal basis for each purpose for which we use your personal information. We rely on the following:
- Contractual Necessity: where we need to perform a contract we have with you, or take steps at your request before entering into one.
- Legitimate Interests: where the processing is necessary for our legitimate interests, or those of a third party such as our Customers, and your interests and fundamental rights do not override them. The table below describes the interests involved.
- Compliance with Law: where we need to comply with a legal or regulatory obligation.
- Consent: where we have your specific consent to process your personal information for the purpose in question.
| Purpose | Categories of personal information involved | Legal basis |
|---|---|---|
| Service delivery and operations for Users | Contact data; account data; company data; communications data; transactional data; user content and input data; data from connected accounts; device data | Contractual Necessity, where you contract with us. Legitimate Interests, where you use Harken as a member of a Customer's team: we have a legitimate interest in providing the Service our Customer has contracted for. |
| Security and fraud prevention | Contact data; account data; device data; online activity data | Legitimate Interests: we have a legitimate interest in keeping the Service and our systems and networks secure and working properly. Compliance with Law. |
| Support | Contact data; communications data; account data | Contractual Necessity. Legitimate Interests: we have a legitimate interest in answering questions and solving problems. |
| Service improvement and analytics | Account data; device data; online activity data | Legitimate Interests: we have a legitimate interest in understanding how the Service is used so we can improve it. Consent, where the law requires it for the cookies or similar technologies used. |
| Marketing emails to Users | Contact data; marketing data | Legitimate Interests: we have a legitimate interest in telling our users about our Service. Consent, where the law requires it for a given message. |
| Finding public buying signals and matching Prospects to a Customer's ideal customer profile | Prospect data | Legitimate Interests: our Customers' interest in finding businesses and professionals who are publicly discussing a need their product may meet, and our interest in providing the Service. |
| Company enrichment and work email lookup for a Customer | Prospect data | Legitimate Interests, as in the row above. |
| Outreach a Customer sends through Harken | Prospect data; LinkedIn conversations | We act as the Customer's processor. The Customer, as controller, is responsible for its own legal basis. |
| Honoring objections, deletion requests and the do-not-contact list | Prospect data (limited to the profile address and email address) | Compliance with Law. Legitimate Interests: we have a legitimate interest in making sure that people who objected are not added again or contacted. |
| Compliance and protection | Any and all data types relevant in the circumstances | Compliance with Law. Legitimate Interests: where Compliance with Law does not apply, we and relevant third parties have a legitimate interest in taking part in, supporting and following legal process and requests, including by cooperating with authorities, and in protecting, maintaining and enforcing our and their rights, property and safety. |
| Corporate events | Any and all data types relevant in the circumstances | Legitimate Interests: we and relevant third parties have a legitimate interest in providing information to parties involved in an actual or prospective corporate event, so that they can investigate and, where relevant, continue to operate all or part of our business. We take steps to limit the amount and sensitivity of the personal information shared where possible. |
| Creating aggregated, de-identified or anonymized data | Any and all data types relevant in the circumstances | Legitimate Interests: we have a legitimate interest in making sure the Service works as intended and in improving it. |
| Further uses | Any and all data types relevant in the circumstances | The original legal basis, if the further use is compatible with the original purpose. Consent, if it is not. |
Retention
We keep personal information for as long as necessary for the purposes for which we collected it, including to meet legal, accounting or reporting requirements, to establish or defend legal claims, or for compliance and protection purposes.
To decide the right period, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve them by other means, and the applicable legal requirements.
When we no longer need personal information, we delete or anonymize it. If that is not possible, for example because it is stored in backups, we securely store it and isolate it from any further processing until deletion is possible. If we anonymize personal information so that it can no longer be associated with you, we may use it without further notice to you.
Other information
No sensitive personal information. Please do not provide us with sensitive personal information, such as information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, genetic or biometric data, or criminal convictions, on or through the Service.
No automated decision-making with legal or similar effects. Harken uses AI to score posts and to assess how well a person fits a Customer's ideal customer profile. These scores help a Customer decide whom to approach about its product. They do not produce legal effects or similarly significant effects for the people concerned. By default, a person on the Customer's team approves each outreach plan before it starts.
Your rights
General. European data protection law gives you certain rights over your personal information. If you are in Europe, you may ask us to:
- Access: tell you about our processing of your personal information and give you access to it.
- Correct: update or correct inaccurate personal information.
- Delete: delete your personal information where there is no good reason for us to keep processing it, including where you have objected to its processing.
- Transfer: give you, or a third party you choose, a machine-readable copy of personal information you provided to us.
- Restrict: restrict the processing of your personal information, for example while we check its accuracy or our reason for processing it.
- Object: stop processing your personal information where we rely on Legitimate Interests. You can always object to processing for direct marketing purposes. For Prospects, an objection or deletion request also adds your LinkedIn profile and email address to the do-not-contact list described in "Your rights and how to object" above.
- Withdraw consent: where we rely on your consent, withdraw it at any time, without affecting processing that took place before.
Exercising these rights. Email hello@heyharken.com. We may ask for information to confirm your identity and to find your data. Whether we must fulfill a request depends on factors such as why and how we process your personal information. If we refuse a request in whole or in part, we will tell you why, subject to legal restrictions. Where we process your data as a Customer's processor, we will pass your request on to the Customer and help it respond.
Your right to lodge a complaint with a supervisory authority. If you are not satisfied with our response to a request, or with how we process your personal information, you can complain to the data protection authority where you live, work or believe an infringement took place.
- In the European Economic Area, you can find the contact details of your data protection authority at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
- In the United Kingdom, the data protection authority is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone +44 303 123 1113, website https://ico.org.uk.
Data processing outside Europe
NextGen Software is a U.S. company, and some of our service providers are based in the United States or other countries outside Europe. Our database and application are hosted in the European Union, but your personal information may be accessed from, or processed by service providers in, countries outside Europe.
The United States is covered by an adequacy decision only for companies certified under the EU-U.S. Data Privacy Framework and its UK extension. When we transfer personal information to a recipient outside Europe, we make sure that one of the following safeguards applies:
- Transfers to countries or recipients covered by an adequacy decision. The European Commission or the UK Government has decided that the country, or the framework under which the recipient is certified, provides an adequate level of protection.
- Transfers to countries without an adequacy decision. We use the Standard Contractual Clauses approved by the European Commission and, for transfers from the UK, the UK International Data Transfer Addendum, which are designed to give personal information essentially the same protection it has in Europe. In limited circumstances, we may rely on an exception permitted by law, such as your explicit consent to the transfer.
You may contact us at hello@heyharken.com for more information on the safeguards we use and to request a copy of them.