Legal at Harness

Discourse Community Privacy Notice

Version

August 3, 2026

Status

Current

Harness Discourse Community Platform

At Harness, we care about your privacy and are committed to protecting your personal data. This privacy notice explains what information we collect through the Harness Discourse Community platform, how and why we use it, and what rights you have. We aim to be transparent and to use your data fairly, lawfully, and securely.

If you have any questions about how we use your data, please contact us using the details below.

1. Who we are

Harness Inc.
55 Stockton St, San Francisco, CA 9410
USA

We are the data controller for personal data processed through the Harness Discourse Community platform, meaning we decide how and why your personal data is processed.

Contact: privacy@harness.io

→ EU Representative

Harness France SAS
92 Av. des Champs-Élysées, 75008 Paris, France

Can be contacted at privacy@harness.io in English or French during local business hours.

2. What personal data we collect

2.1 Categories of personal data

We collect and use the following types of personal data through the Discourse Community platform:

  • Identification details (e.g. full name, username)
  • Contact details (e.g. email address) - only visible to other community members based on your profile settings in the Discourse Platform
  • Profile information you choose to add (e.g. date of birth, gender, company, short biography, location) - only visible to other community members based on your profile settings in the Discourse Platform
  • Account and activity data (e.g. date you joined, trust level, posts, topics, likes, bookmarks) - accessible to Harness platform administrators only
  • Technical data (e.g. IP address, activity logs) - accessible to Harness platform administrators only

We only collect data that is relevant and necessary for the purposes described below.

For information about cookies and similar tracking technologies used on the platform, please see our Cookie Notice at https://www.harness.io/legal/privacy. More information about the cookies available on this website can be found on the cookies banner.

2.2 Children's data

The Discourse Community platform is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided us with personal data, please contact us at privacy@harness.io and we will take steps to delete that information.

3. Why we use your personal data and our legal basis

3.1 Legal bases for personal data

We only process your personal data in accordance with data protection laws. The main legal bases we rely on are:

Purpose Legal basis
Register you as a community member and let you post, reply, and otherwise participate Performance of a contract (Art. 6(1)(b)) of the GDPR
Identify you and differentiate you from other users with similar usernames Legitimate interests (Art. 6(1)(f)) of the GDPR
Moderate content, prevent spam and abuse, and calculate trust levels Legitimate interests (Art. 6(1)(f)) of the GDPR
Maintain the security of the platform (e.g. IP address logging) Legitimate interests (Art. 6(1)(f)) of the GDPR

Where we rely on legitimate interests, we balance our interests against your rights and freedoms and apply appropriate safeguards.

4. Who we share your data with

To protect your privacy, we restrict data sharing to circumstances where it is strictly necessary and supported by appropriate security safeguards. In particular, your information may be accessed by or shared with the following parties:

  • Internal teams: The Harness Discourse administration and moderation personnel.
  • External partners: Discourse (Civilized Discourse Construction Kit, Inc.), our community platform hosting vendor and data processor.
  • Legal authorities: Public regulators or official agencies, when required by applicable laws.

5. International data transfers

Some of our service providers may be located outside your home country, including in the United States. When we transfer personal data internationally, we ensure appropriate safeguards are in place.

Entity Country Purpose of transfer Transfer mechanism
Discourse (Civilized Discourse Construction Kit, Inc.) United States Hosting and operation of the Discourse Community platform Standard Contractual Clauses (SCCs)

6. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this notice, taking into account legal and business requirements.

Purpose Retention period
Community account and activity data User sessions: currently set to 60 days (default). Are you ok keeping it as is, or do you want to change it?
Account deletion: when a user requests deletion, we'll handle it within 30 days maximum.

Retention periods may be extended where required by law or to defend legal claims.

7. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.

8. Your rights

8.1 General rights under the GDPR

Under the GDPR, you have the following rights in relation to your personal data:

  • Access your personal data and receive a copy of it
  • Correct personal data that is inaccurate or incomplete
  • Request deletion of your personal data in certain situations
  • Restrict how we use your personal data in specific cases
  • Object to processing based on our legitimate interests
  • Receive your data in a portable format, where applicable
  • Withdraw your consent at any time, where we rely on consent

Please note that these rights are not absolute. There may be situations where a right does not apply, for example, if we are legally required to keep certain information or need it for legitimate business purposes.

You can exercise your rights by submitting a request through our privacy portal.

8.2 European Economic Area and United Kingdom

If you are located in the EEA or the UK, in addition to the general GDPR rights above, you can contact our EU Representative, Harness France SAS, at privacy@harness.io in English or French during local business hours. You also have the right to lodge a complaint with your local data protection supervisory authority.

8.3 United States

If you are a resident of a US state with a comprehensive consumer privacy law (such as California, Colorado, Connecticut, Oregon, Utah, Virginia, Texas, or other applicable states), you may have some or all of the following rights depending on which state law applies to you: the right to access your personal data and obtain a copy of it; the right to correct inaccurate personal data; the right to delete your personal data; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. We do not sell your personal information for monetary consideration, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your privacy rights. Not all rights are available in every state. To exercise any of these rights, contact us at privacy@harness.io or through our privacy portal. If your state law provides a right of appeal, you may appeal any decision we make in response to your request by contacting us at the same address. We do not collect or process sensitive personal information (as defined under applicable US state privacy laws) beyond login credentials, which are managed directly by Discourse as described in Section 2.1 above.

8.4 Brazil

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you the right to confirm whether we process your data, to access it, to correct incomplete, inaccurate, or outdated data, to request anonymization, blocking, or deletion of unnecessary or excessive data, to request portability of your data, to obtain information about third parties with whom we have shared your data, to request deletion of data processed with your consent, to revoke your consent, and to request review of decisions made solely by automated means.

Our local Data Protection Officer for Brazil can be contacted at privacy@harness.io.

8.5 Singapore

If you are located in Singapore, the Personal Data Protection Act (PDPA) gives you the right to access and correct your personal data, and to withdraw your consent to its collection, use, or disclosure, subject to legal or contractual restrictions.

Our local Data Protection Officer for Singapore can be contacted at privacy@harness.io.

9. Complaints

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with your local data protection authority - for example, your national supervisory authority in the EEA or UK, the relevant state attorney general or agency in the United States, the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, or the Personal Data Protection Commission (PDPC) in Singapore.

10. Changes to this notice

We may update this privacy notice from time to time.