# HARBOUR AI — GDPR Compliance Statement ### Version 2.1 | 25 May 2026 --- ## Summary HARBOUR AI is a fully local AI platform. **No personal data ever leaves your device.** This document explains how HARBOUR AI handles data and why it is compatible with UK GDPR (UK General Data Protection Regulation) as retained by the Data Protection Act 2018. --- ## 1. Data Controller and Processor When your organisation uses HARBOUR AI, **your organisation is the sole data controller and data processor** for all data processed through the application. LOOSEKEY (the developer of HARBOUR AI) is not a data processor for your data. LOOSEKEY receives no data from your use of the application. This means: - No Data Processing Agreement (DPA) with LOOSEKEY is required - No Article 28 GDPR processor obligations arise - Your organisation retains full control and responsibility under UK GDPR --- ## 2. Data Flows — What Goes Where | Data type | Where it goes | Leaves the device? | |---|---|---| | Chat messages and conversations | `~/.harbour-ai/harbour-ai.db` | **Never** | | Uploaded documents (RAG) | `~/.harbour-ai/uploads/` and `~/.harbour-ai/rag/` | **Never** | | User accounts and passwords | `~/.harbour-ai/harbour-ai.db` (PBKDF2-SHA256, 260,000 iterations) | **Never** | | Agent memory (saved facts) | `~/.harbour-ai/harbour-ai.db` | **Never** | | Application logs | `~/.harbour-ai/harbour-ai.log` | **Never** | | AI inference (queries to model) | Local Ollama instance on `localhost:11434` | **Never** | | Web search queries (if enabled) | DuckDuckGo or local SearXNG | Query text only, no personal data in search terms | | Licence activation key | Railway licence server (one-time on first launch) | Licence key and machine ID only — no personal or business data | **No telemetry. No analytics. No crash reporting. No usage data.** The application contains no tracking code of any kind. --- ## 3. UK GDPR Principles — How HARBOUR AI Satisfies Each **Article 5(1)(a) — Lawfulness, fairness and transparency** All data processing occurs on the user's own machine. The user has full visibility and control over all data stored in `~/.harbour-ai/`. **Article 5(1)(b) — Purpose limitation** Data is processed solely for the purpose of providing AI assistant functionality within the application. It is not used for any secondary purpose. **Article 5(1)(c) — Data minimisation** HARBOUR AI stores only what is necessary for functionality. No data is collected for analytics, improvement, or marketing. The optional **PII Auto-Redaction** feature (Admin → PII) intercepts chat messages before they reach any AI model and replaces detected UK PII (NHS numbers, NI numbers, postcodes, phone numbers, email addresses, financial identifiers, dates of birth, passport numbers, driving licence numbers) with `[REDACTED:TYPE]`. When enabled, this provides a technical control enforcing data minimisation at the point of AI inference. **Article 5(1)(d) — Accuracy** Users can view, edit, and delete all stored data at any time through the application interface or by directly accessing `~/.harbour-ai/`. **Article 5(1)(e) — Storage limitation** Users control retention. Data can be deleted at any time. Deleting `~/.harbour-ai/` removes all data completely and permanently. **Article 5(1)(f) — Integrity and confidentiality** All data is stored locally. Passwords are hashed using PBKDF2-SHA256 (260,000 iterations, stdlib only — no external dependencies). The application does not transmit data over any network during normal use. The **Tamper-Proof Audit Trail** (v1.0.97+) provides cryptographic assurance of log integrity: every audit entry is chained to the previous via SHA-256 hash (anchored at GENESIS), making any modification, deletion, or insertion of rows immediately detectable. Admins can verify the full chain at any time from the Admin → Audit panel. **Article 5(2) — Accountability** Because HARBOUR AI processes no data outside the user's device, the organisation deploying it retains full accountability and control. --- ## 4. Data Subject Rights (Articles 15–22) Since all data is stored locally on your organisation's own device or server: - **Right of access (Art. 15):** All data is directly accessible in `~/.harbour-ai/harbour-ai.db` - **Right to rectification (Art. 16):** Data can be edited within the application - **Right to erasure (Art. 17):** Delete individual items in-app, or remove `~/.harbour-ai/` to erase everything - **Right to restriction (Art. 18):** Achieved by disabling the relevant feature in `harbour-config.json` - **Right to portability (Art. 20):** Chat histories exportable as JSON from the Sessions panel - **Right to object (Art. 21):** Achieved by disabling specific agents, memory, or features Your organisation fulfils these rights directly — no request to LOOSEKEY is needed. --- ## 5. Third-Party Services HARBOUR AI uses the following third-party services in limited, specific circumstances: | Service | When used | Data sent | Basis | |---|---|---|---| | Railway licence server | First launch only (activation) | Licence key + machine ID | Performance of contract | | DuckDuckGo | When web search is enabled and SearXNG unavailable | Search query text | Legitimate interests | | Ollama (local) | Every AI query | Messages stay on localhost | N/A — fully local | **Web search** can be fully privatised by running a local SearXNG instance (`docker run -d -p 8080:8080 searxng/searxng`). When SearXNG is running, DuckDuckGo is never contacted. **Web search can be disabled entirely** via `harbour-config.json`: ```json "features": { "web_search_enabled": false } ``` --- ## 6. ICO Guidance Alignment The UK Information Commissioner's Office (ICO) has issued guidance on the use of generative AI tools in organisations (published 2024). Key ICO requirements for AI tools processing personal data include: - **Lawful basis for processing** — HARBOUR AI requires no lawful basis from ICO perspective because personal data never leaves your organisation's device - **International transfers** — No international transfers occur - **Processor agreements** — Not required (LOOSEKEY is not a processor) - **DPIA requirement** — A DPIA may still be required by your organisation under UK GDPR Article 35 if processing is likely to result in high risk. A template is provided below to assist with this. --- ## 7. Data Protection Impact Assessment (DPIA) Template For organisations that need to conduct a DPIA before deploying HARBOUR AI: **Name of processing activity:** Use of HARBOUR AI local AI platform **Nature of processing:** Local AI inference, document analysis (RAG), conversation storage — all on-premise **Purpose of processing:** Productivity, document summarisation, internal knowledge management **Necessity and proportionality:** Processing is limited to what users actively submit. No background collection. All processing is on-device. **Risks identified:** - Unauthorised physical or network access to the device running HARBOUR AI - Users inputting personal data of third parties into chat sessions **Mitigations:** - Standard device security (full-disk encryption, access controls) addresses physical/network risk - User training: advise staff not to input identifiable personal data of third parties unless necessary - Application-level: user accounts with password authentication protect multi-user deployments - **PII Auto-Redaction** (Admin → PII → ON): automatically detects and redacts 11 UK PII types from all chat messages before AI inference — a technical control reducing the risk of sensitive data exposure to the model - **Tamper-Proof Audit Trail**: cryptographic chain hash on every audit log entry provides evidence of access and integrity for ICO or DPO review **Residual risk:** Low — equivalent to any locally-stored business application **DPO sign-off:** [Your DPO name and date] --- ## 8. Suitability for Regulated Sectors | Sector | Relevant framework | HARBOUR AI status | |---|---|---| | Legal (solicitors) | SRA guidance on client confidentiality; ICO AI guidance | Compatible — client data never leaves firm's device | | Finance / accountancy | FCA Handbook, GDPR | Compatible — financial data processed locally | | Healthcare / NHS-adjacent | DSPT, UK GDPR | Compatible — patient data never transmitted | | Education | UK GDPR, FERPA (for international) | Compatible — student data stays on school infrastructure | | HR / recruitment | UK GDPR special categories | Compatible — CV and personal data processed locally | | Public sector | UK GDPR, FOIA considerations | Compatible — no third-party transmission | --- ## 9. Contact For any compliance queries regarding HARBOUR AI: **LOOSEKEY** Email: Gregorymoores@proton.me GitHub: https://github.com/LOOSEKEY/harbour-ai-releases --- *This document is provided for information and should not be construed as legal advice. Organisations should consult their Data Protection Officer or legal counsel when conducting their own GDPR assessments.* HARBOUR AI GDPR Compliance Statement v2.1 — 25 May 2026