Privacy Policy

1. Who we are

Harbor is built and operated by Harbor Tech Limited, a New Zealand company. Harbor is the platform schools use to run their international student programmes, covering admissions, homestay placement, pastoral care, payments and compliance.

This policy explains how we handle personal information. It is written to be read, not to be survived. If anything here is unclear, ask us.

2. The school holds the information. We hold it for them.

This distinction matters more than anything else in this document.

When a school uses Harbor, the school is the agency that holds the personal information under the Privacy Act 2020. Harbor stores and processes that information on the school's instructions in order to provide the platform. We do not decide what a school collects, who it shares information with, or how long it keeps it. The school does.

In practice that means:

• If you are a student, parent, guardian, host family or education agent and you want to see, correct or remove information held about you, the fastest route is to contact the school directly. They control the record.
• We will always help a school respond to a request like that, and we act on a school's instruction to correct or remove information.
• We do not sell personal information. We never have and we will not.
• We do not use student, family or host information to train third-party AI models.

For information you give us directly through this website, such as a demo enquiry, Harbor Tech Limited is the agency responsible and you can contact us directly.

3. What information is in Harbor

The exact information depends on what each school chooses to collect. Typically it includes:

Some of this is sensitive information about children. We treat it that way. Access is restricted by role, every use of a family's secure link is logged, and every change to a record is recorded along with who made it and when.

4. Why we hold it

To provide the platform to the school. Concretely: processing applications and enrolments, matching and managing homestay placements, running welfare check-ins and pastoral care records, generating offers, invoices and receipts, paying host families, producing the evidence a school needs for its regulatory obligations, and communicating with the people involved.

We also use aggregated information that does not identify anyone to understand how the platform is used and to improve it.

5. Where it is stored

Harbor's database, authentication and file storage run on Amazon Web Services infrastructure in the Sydney region, provided through Supabase. Information is encrypted in transit and at rest, and backed up daily.

Because that region is in Australia, information held in Harbor is stored outside New Zealand. Australia has a privacy regime comparable to New Zealand's, and this arrangement is intended to meet the cross-border disclosure requirements of Information Privacy Principle 12. If your school requires New Zealand-only data residency, tell us before you sign, because that has to be decided up front.

6. Who else can see it

Inside the platform, information is shared according to the school's own decisions. An education agent sees the students they placed with that school. A host family sees the student placed with them. A parent sees their own child. One school can never see another school's information.

We use a small number of service providers to run Harbor. Each has access only to what it needs.

We will also disclose information where the law requires it, or where it is necessary to prevent a serious threat to someone's life, health or safety.

7. How long it is kept

The school decides. Schools have their own retention obligations, including record-keeping requirements attached to the codes of practice they operate under, and Harbor is built so that the audit trail survives staff changes rather than leaving with them.

If a school stops using Harbor we will return its information in a usable format and then delete it on the school's instruction. We do not keep a school's data indefinitely after it leaves.

8. Your rights

Under the Privacy Act 2020 you have the right to ask for the personal information an agency holds about you, and to ask for it to be corrected if it is wrong.

• For information inside the platform, contact the school. They hold it and they can act immediately.
• For information you gave this website, email hello@harbor.co.nz.
• If you are not satisfied with how a request has been handled, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

9. If something goes wrong

We maintain a process for identifying, containing and assessing privacy breaches. If a breach occurs that has caused or is likely to cause serious harm, we will notify the affected school without undue delay so it can meet its own obligations, and we will notify the Office of the Privacy Commissioner where the Privacy Act 2020 requires it.

If you believe information in Harbor has been exposed or is being misused, tell us at hello@harbor.co.nz and we will treat it as urgent.

10. This website

This marketing website does not use advertising cookies and does not track you across other sites. If you submit an enquiry form, the details you provide are sent to us so we can reply.

The Harbor platform itself uses cookies that are strictly necessary to keep you signed in securely.

11. Changes

If we make a material change to this policy we will update the date at the top of this page, and we will tell schools directly rather than relying on them to notice.