Privacy policy

14 Islands AB (org. nr 556873-2787), Stockholm, Sweden, is the data controller. Contact us at hello@14islands.com.

Only people invited to use Harbor: employees of 14 Islands AB and contractors working with us. There is no public sign-up, and an account only exists because an administrator created it.

Signing in with Google is the only way into Harbor. We request the standard sign-in permissions and receive three things:

• your email address, which identifies your account;
• your name, shown to colleagues alongside your work;
• your profile picture, shown next to your name.

We request no other Google permissions. Harbor cannot access your Gmail, Drive, Calendar or contacts, and it never writes anything to your Google account. This data is used only to authenticate you and to identify you within Harbor. It is never sold, never used for advertising, never used to train AI models, and never shared with anyone beyond the service providers listed below.

• Work you record — hours logged against projects and tasks, the notes you write on them, expenses, and absence such as holiday or sick leave.
• Your role at the studio — your permission level, discipline, contracted weekly hours, whether you are a contractor, and whether your account is active.
• Cost and billing rates — what your time costs and is billed at. Cost rates are visible only to administrators.
• Bookings — which projects you are planned to work on and when.

Harbor sets no advertising or analytics cookies and has no third-party trackers. The only cookie it sets is the one that keeps you signed in.

To run the studio: to cost and plan projects, to invoice clients for work done, to plan capacity, and to meet our accounting obligations. The legal bases are the performance of your employment or engagement contract, our legitimate interest in running the business, and our legal obligations under Swedish accounting law.

Colleagues at 14islands see your name, your bookings and, depending on their role, the hours and budgets of projects they work on or manage. Cost rates are restricted to administrators.

We use two service providers to run Harbor: Supabase, which hosts the database and handles sign-in, and Vercel, which hosts the web app. Both process data on our instructions only. We do not otherwise share your data, and we do not sell it.

Time records are kept while they are needed for project accounting and for as long as Swedish accounting law requires, which is currently seven years. When you leave, your account is deactivated so that you can no longer sign in, and your name stays attached to the work you recorded so that project history remains accurate.

Under the GDPR you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict it. Write to hello@14islands.com and we will answer within one month. Some data we must keep for the accounting period above, and we will tell you if that applies.

You can disconnect Harbor from your Google account at any time in your Google account permissions. That stops the sign-in; to have the data removed as well, write to us.

If you are unhappy with how we handle your data you may complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

The Harbor database and its hosting are within the EU. Where a provider processes data outside the EU, that transfer is covered by the standard contractual clauses issued by the European Commission.

If we change this policy we will update the date at the top. See also our terms of service.