Privacy Policy

This policy explains what Harbor Senior Benefits (Harbor Senior Benefits) collects, why, and the choices you have. It applies to harborsenior.myprofitclinic.com, the operator console, and the agent portal.

What we collect

• Account data: name, email, password hash, company, phone, licensed states, and the plan you chose.
• Operational data: campaigns, per-call prices, bids, call metadata (caller state, last four digits of the caller number, timestamps, duration, outcome), wallet ledger entries, disputes and their resolutions.
• Payment data: handled by Stripe or Whop. We store provider identifiers and amounts, never full card numbers.
• Recordings: stored by the Operator’s telephony provider; we store the reference.
• Technical data: IP address, browser, and request logs, kept for a limited period (typically under 30 days) for security. When you submit a lead form or accept an agreement we also keep the text you agreed to, the time and your IP address as evidence of consent. Our public marketing pages use the Meta pixel to measure advertising; it is never loaded inside the console or agent portal, which carry no third-party advertising trackers.

How we use it

To run the marketplace (route calls, bill connected calls, keep the ledger accurate), to resolve disputes, to send transactional email (verification, receipts, dispute outcomes), to prevent fraud, and to comply with law. We do not sell personal data.

Who sees it

Operators see the data of Agents enrolled in their workspace. Agents see their own data. Our service providers (sub-processors): our software platform provider, DigitalOcean (hosting, US), Stripe and Whop (payments), Telnyx (telephony), Amazon Web Services (email delivery and encrypted backups, US), Groq (call transcription and scoring, only for Operators who turn on call intelligence). Each is bound by a data-processing agreement. Text-message consent and opt-in data are never shared with them for their own use (see Text messages below).

Text messages (SMS)

Agents and Operators use the Platform to text consumers who gave their phone number and agreed to be contacted, for example on a quote form or during a call they placed. We use the phone number, the messages and their delivery status only to send those texts, to honor opt-outs and to keep records of consent. Texts are sent through Telnyx, our messaging carrier, which processes them only to deliver them.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from all of the sharing described in this policy and will not be shared with any third party, except the carrier and service providers that deliver the messages for us.

Reply STOP to any text to opt out; reply HELP for help. Message frequency varies. Message and data rates may apply. Full program terms are in our Terms of Service.

Google accounts and Google Calendar

Sign in with Google. If you choose “Continue with Google”, we receive only your Google account email address and whether Google has verified it. We use it once, to find the account that already has that email and sign you in. We do not create accounts from it, and we do not store your Google password or any Google token for sign-in.

Connecting Google Calendar. A demo host can connect their own Google Calendar so prospects can book a demo with them. We ask for two calendar permissions:

• See your free/busy times (calendar.freebusy): we read only the busy time ranges on the connected calendar, so the booking page does not offer a time you are already busy. We never read event titles, descriptions, attendees or locations. Busy ranges are held in memory for under a minute and are not saved.
• Create and change events (calendar.events): when a prospect books, reschedules or cancels a demo, we create, move or delete that one demo event on the host’s calendar, with a Google Meet link and the prospect as the invitee. We only change events that we created. We store the event ID so we can update it later.

We store the connected Google email, an encrypted refresh token and a short-lived encrypted access token. The host can disconnect at any time from the console, which deletes those tokens and revokes our access with Google. They can also remove access in their Google Account settings.

Limited Use. Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the sign-in and demo-booking features described above. It is never sold, never used for advertising, never used to train AI or machine-learning models, and never shared with third parties except as needed to provide those features, to comply with law, or with the user’s permission. People do not read it, except with the user’s permission, for security investigations, or to comply with law.

Caller data

Callers are the Operator’s customers. We process caller phone numbers and state to route and bill calls, to enforce duplicate-call and do-not-call rules, and to resolve disputes. Full caller numbers are kept for 13 months, after which only the last four digits are retained.

Your rights

You can access, export, correct or delete your account data from the console or by emailing the support address in your portal. Ledger entries are retained for seven years as financial records. California and Virginia residents have the rights described in their state laws; we honor them for everyone.

Security

Tenant data is isolated at the database level with row-level security. Passwords are hashed with scrypt. Secrets are encrypted at rest. Sessions expire after 12 hours, or 30 days if you choose to stay signed in.

Contact

Harbor Senior Benefits · the support address in your portal.