Harper Co., Ltd. processes only the personal data needed to provide its AI career agent and recruiting connection services. This policy describes Harper's actual career-service data practices.
1. Controller and contact
| Item | Details |
|---|---|
| Controller | Harper Co., Ltd. (Representative: HEO HONGBEOM) |
| Privacy contact | Harper Operations Team |
| chris@matchharper.com |
You may also use these contact details to request access, correction, deletion, suspension of processing, or withdrawal of consent.
2. Data we process, purposes, and retention
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Account and authentication | Name, email, login identifier, authentication provider, profile image received from that provider, and a phone number if you enter one | Registration, login, account management, identity checks, and support | Until account deletion |
| Career profile | Introduction, location, work and education history, skills, projects, publications, awards, qualifications, resume, and professional links you add, such as LinkedIn, GitHub, Scholar, or a personal website | Building your profile, understanding your experience, and finding and recommending opportunities | Until you delete the item or your account |
| Preferences and conversations | Role, location, work arrangement, compensation and other preferences or constraints; chats, AI responses, call transcripts, and session information | AI career support, preference discovery, profile completion, and personalized recommendations | Until you delete the conversation or information, or delete your account |
| Recommendations and progress | Opportunities shown to you, recommendation reasons, feedback, interest and connection choices, and recruiting status. When Harper directly connects a company and talent, this may also include follow-up communications such as email and information about how far the process has progressed | Opportunity recommendations, company connections you request, follow-up communication support, and recruiting-progress management | Until account deletion or completion of the purpose |
| Usage and security | IP address, browser and device data, access time, page and feature events, error logs, language, cookie and localStorage identifiers, and acquisition source | Session continuity, security, troubleshooting, and service analytics | Until account deletion or completion of the purpose; provider logs follow the configured periods below |
| Legal-document records | Document type, version, language, acknowledgement or consent type, server-recorded time, document hash, and applicable context | Recording what you chose and the document presented at that time | Until account deletion |
Harper receives data when you register, complete a profile, upload a file, have a conversation, or choose an opportunity. When Harper directly connects a company and talent, Harper may store follow-up communications and progress information exchanged through an email path disclosed to the participants in order to support the connection and understand its stage. Access and security data may be created automatically when you use the service. Live audio is transmitted and processed to provide the call feature. Harper does not separately store the original audio file, but may store the transcript.
3. Grounds for processing and the registration checkbox
Harper processes data needed to create and perform the service contract, including account operation, profile management, AI support, and recommendations you request. Security and troubleshooting data is processed only as necessary for Harper's and users' legitimate interests. Where the law requires separate consent, Harper presents the specific details and obtains that consent at the relevant time.
The required registration checkbox records that you reviewed this Privacy Policy. It does not by itself mean that you consented to sharing your profile with a particular company, receiving marketing messages, or processing sensitive data.
4. AI features
Harper may send your profile, resume, preferences, conversations, and transcripts to AI providers to generate summaries, responses, profile suggestions, and recommendation reasons. During a live call, audio is processed to generate responses and transcripts. Harper does not create voiceprints or use audio for biometric authentication.
AI output is supporting information and does not make a final hiring decision. You may ask Harper to correct or delete inaccurate profile or recommendation information or to have it reviewed by a person.
5. Disclosure to recruiting companies and others
Harper does not disclose personal data to a recruiting company without your separate consent or another legal basis. If you choose to connect with a specific company, Harper first identifies that company, the purpose, data fields, retention period, and effect of refusal, and then asks for separate consent on a company-specific screen. If you refuse, only that connection is unavailable; Harper's other core features remain available.
If disclosure is required by law to a court, regulator, or law-enforcement authority, Harper discloses only the data required.
6. Service providers and international processing
Harper uses the following providers only as needed to operate the service. Data is transferred over encrypted networks when the relevant function is used.
| Provider | Function and data | Processing country | Timing and method | Retention and contact |
|---|---|---|---|---|
| Supabase, Inc. | Authentication, database, and file storage: account, profile, conversation, and service data | India (Mumbai region) | Encrypted transfer when data is registered, stored, or retrieved | Until account or item deletion, or termination of the service arrangement |
| Vercel Inc. | Web hosting, deployment, security, and analytics: IP, request, device, and page-event data | United States and transmission points near the user | Encrypted transfer when you access the site | Configured log-retention period or termination of the service arrangement |
| Anthropic PBC, xAI Corp., OpenAI, L.L.C. | AI responses, summaries, analysis, and voice processing: necessary profile, resume, preference, conversation, transcript, and in-call audio data | United States | Encrypted transfer when an AI feature is used | API processing period and limited security or operational retention under the applicable contract |
| Resend, Inc., Slack Technologies, LLC | Authentication and service email, and minimal internal operational notices: name, email, user identifier, and event details needed for the notice | United States | Encrypted transfer when an email or operational event occurs | Configured delivery or operational-log period, or termination of the service arrangement |
| Google LLC, Vercel Analytics | Service analytics: cookie identifier, IP, device, page, and event data | United States | Encrypted transfer when the site is used | Configured analytics-retention period |
You may contact Harper under Section 1 to ask about international processing or request suspension. Suspending processing that is essential to authentication, data storage, or AI features will make the relevant feature unavailable.
7. Cookies and analytics
Harper uses cookies and localStorage for session continuity, language settings, security, and service analytics. Google Analytics and Vercel Analytics may process page and feature events. Harper does not use this data for personalized advertising or sell personal data.
You can delete or block cookies in your browser settings. Blocking essential storage may prevent login or other features from working.
8. Your rights, children, and sensitive data
You may request access, correction, deletion, suspension of processing, or withdrawal of consent. Harper verifies the requester and responds under applicable law, and explains any lawful restriction. You may also use the account-deletion feature.
Harper is not directed to children under 14 and does not request sensitive data such as health, disability, religion, political views, or biometric identifiers. Please do not add unnecessary sensitive data to a resume or conversation. Harper will obtain separate consent if a future feature requires sensitive-data processing.
9. Safeguards and deletion
Harper applies access restrictions, authentication and authorization controls, encryption in transit, log review, backups, and service-provider management. When a retention period ends or a purpose is completed, the responsible team verifies the data and deletes it without undue delay. Electronic data is deleted so that recovery is impracticable, and backup copies are removed according to the backup cycle.
10. Changes to this policy
Harper will provide advance notice through the service, email, or another appropriate method before a material change takes effect. Each version is retained with its effective date.
- Version: 1.1.0
- Effective date: August 3, 2026