Effective date: April 11th, 2025 Last updated: July 2nd, 2026
Harpier, LLC ("Harpier," "we," "us," or "our") is a New York limited liability company with a registered address at 418 Broadway Ste R, Albany, New York 12207, USA. We provide story gathering, curation, and connection services that help institutions and organizations activate authentic community stories to support high-stakes decisions.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. It applies to everyone whose information we handle, including storytellers who share their experiences, recipients who view or connect through curated stories, visitors to our websites, and individuals whose information is provided to us by an institution.
Please read this policy together with any consent form you sign with us, including the Storyteller Consent and Release, and any agreement between us and the institution that introduced you. If a term is defined in one of those documents, it carries the same meaning here.
1. A note on our role
We handle personal information in two different capacities, and which one applies affects your rights and our obligations.
For some information, we act as a service provider or processor on behalf of an institution. This is the case when an institution gives us contact lists or records so we can invite people to participate, identify them, and report results back to that institution. In this role, the institution decides the purposes of processing and we follow its instructions and any data processing terms we have agreed with it.
For other information, we act as a business or controller in our own right. This is the case for storyteller contributions and the curated profiles we build and maintain. When you contribute a story, when we enrich a profile using public sources, and when we reuse curated content across our collection and outreach, we determine how that information is used, consistent with the consent you provided and this policy.Throughout this policy we try to make clear which role applies. If you are unsure which capacity governs your information, contact us at [privacy@harpier.com] and we will help.
2. Information we collect
We collect personal information from several sources.
Information you provide directly. When you participate as a storyteller, register for an account, complete one of our surveys or intake forms, or contact us, you may provide your name, contact details such as email and phone, demographic information you choose to share, educational history, employment information, the substance of your story and experiences, your thoughts and feedback, and your contribution and interaction preferences. You may also provide your image, likeness, and links to social media or professional profiles.
Information provided by an institution. An institution that works with us, such as a university, school, company, or membership or youth organization, may provide information about you so that we can invite you to participate or identify you within their community. This can include your name, contact details, affiliation, role or status (for example, prospective student, current student, alumnus, parent, staff member, or participant), and, in the case of education clients, education records as described in Section 8.
Information from public sources. To reduce administrative burden and improve the completeness and accuracy of profiles, we may collect, verify, update, or supplement profile information using publicly available sources. These can include professional networking platforms, employer or institutional websites, public biographies, published articles, directories, and publicly accessible social media profiles. We do not knowingly access non-public information or circumvent privacy settings, and we use information from public sources in the same way we use information you provide directly.
Information collected automatically. When you use our websites or platform, we and our service providers may collect technical and usage information such as IP address, device and browser type, pages viewed, referring pages, and interaction data, including through cookies and similar technologies. You can manage cookies through your browser settings and, where we offer one, through our cookie preferences tool.
3. How we use information
We use personal information for the following purposes.
To deliver our services, including capturing, curating, organizing, and maintaining stories and profiles, and surfacing relevant stories to the people who can benefit from them. To make connections between storytellers and recipients based on shared backgrounds, goals, interests, and mutual interaction preferences. To support institutions in recruitment, enrollment, student success, alumni engagement, career navigation, and similar initiatives. To curate authentic content for use in outreach, communications, and the experiences institutions brand as their own. To produce reports and aggregated insights for institutions and for our own analysis and improvement. To communicate with you about participation, including invitations, reminders, follow-ups, and changes to your preferences. To maintain the security and integrity of our services, to comply with law, and to establish, exercise, or defend legal claims.
We curate and may lightly refine contributions for grammatical accuracy, readability, and fit with the intended audience, while preserving the core message and integrity of what you shared.
4. How we share information
We share personal information in the following ways.
With recipients. Where you have consented to participate as a storyteller, we disclose your information and contributions to current and prospective users (recipients) for purposes such as recruitment, education and career decision-making, and making connections based on mutual preferences. Recipients learn about you through the contributions and profile details you have agreed to share.
With institutions. Where an institution introduced you or sponsors your participation, we may share your information and engagement results with that institution so it can prepare an enhanced experience and understand outcomes. When we act as that institution's processor, we share only as the institution instructs.
With service providers and sub-processors. We use trusted vendors to operate our services, and we share the minimum information they need to perform their function. Our current categories of sub-processors include form and survey capture (Tally), website and platform hosting (United States based, [HOSTING PROVIDER]), email and communications ([EMAIL PROVIDER]), and curation tooling that uses artificial intelligence (Anthropic). Please see Section 6 for how we handle artificial intelligence and why personal identifiers are not transmitted to our AI provider. A current list of sub-processors is available on request at [privacy@harpier.com].
For legal and safety reasons. We may disclose information to comply with a court order, subpoena, or other legal obligation, to cooperate with regulators, to protect the rights, property, or safety of Harpier, our users, or others, and to enforce our agreements.
In a business transaction. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy and applicable law.We do not exchange your personal information for money. However, some of our disclosures may be treated as "selling" or "sharing" under certain US state privacy laws. See Section 9 for how we treat this and how you can opt out.
5. Cookies and tracking
We and our service providers use cookies and similar technologies to operate our websites, remember preferences, measure usage, and improve our services. Depending on your location, we will obtain consent or provide opt-out choices as required by law. You can control cookies through your browser and, where available, through our cookie preferences tool. Where we support the Global Privacy Control (GPC) signal, we treat it as a valid opt-out of sharing for the browser that sends it.
6. Artificial intelligence and automated processing
We use artificial intelligence tools to help curate, organize, and surface stories and to support matching between storytellers and recipients.
We practice data minimization with these tools. Before story content is sent to our third-party AI provider for curation, we replace your name and remove direct contact details such as email address and phone number, substituting a coded identifier that only we can link back to you. We re-associate your identity on our own systems after curation. While this significantly reduces identifiability, the content of a story may still include details you have chosen to share, so we do not represent that curated content is fully anonymous.
When we use our AI provider for curation, it acts as our service provider and processor. Under the commercial terms that govern this use, our AI provider does not use the information we send to train its models, retains operational data only for a limited period, and is contractually restricted from using the information for its own purposes. We do not use consumer AI accounts for this processing.
We do not use solely automated decision-making that produces legal or similarly significant effects about you without human involvement. Curation and matching are designed to support human judgment, not replace it. If you have questions about how a particular decision was reached, contact us at [privacy@harpier.com].
7. How long we keep information
We retain personal information for as long as it is needed for the purposes described in this policy.
For storyteller profiles, we retain your information for as long as your profile remains active, or for as long as the institution that introduced you maintains an active agreement with us, whichever is longer. We do this because the value of the curated collection depends on maintaining records associated with an institution's community for the duration of our relationship with that institution, even if a given person is not actively using the service.
When an institution's agreement ends, we return or delete the personal information associated with that institution within [NUMBER] days, unless you have an independent active relationship with us, or applicable law requires us to keep it longer.
Contributions you have made that have already been distributed may remain in our curated archive and historical materials. As described in Section 9 and in the Storyteller Consent and Release, you may ask us to remove your contributions from active and future use. We will take reasonable steps to honor such requests, but we cannot recall copies that have already been distributed.
We may retain limited information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.
8. Education records and FERPA
When we provide services to an educational institution that is subject to the Family Educational Rights and Privacy Act (FERPA), the institution may share education records with us. In that case, we act as the institution's processor and, where applicable, as a "school official" with a legitimate educational interest under FERPA, as defined in our agreement with the institution.
We use education records only to perform the services the institution has engaged us to provide, we do not use them for any other purpose, and we do not re-disclose them except as the institution directs or as permitted by law. We maintain the records under the institution's direct control consistent with FERPA requirements, and we return or delete them as described in our agreement and in Section 7.
FERPA applies only to educational institutions and the records they maintain. It does not apply to information we collect through non-educational organizations, such as youth, membership, or community organizations.
9. Your privacy rights
Depending on where you live and the capacity in which we hold your information, you may have rights regarding your personal information. Where we act as an institution's processor, we will direct your request to that institution or assist it in responding, because the institution controls that information.
Rights that may be available to you include the right to know and access the personal information we hold about you, the right to correct inaccurate information, the right to request deletion, the right to opt out of the selling or sharing of personal information and of targeted advertising, the right to limit the use of sensitive personal information, the right to data portability, and the right not to receive discriminatory treatment for exercising your rights.
California residents (CCPA and CPRA). If you are a California resident, you have the rights described above, including the right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it, as well as the right to request deletion and correction. You also have the right to opt out of the "sale" or "sharing" of your personal information and to limit the use of sensitive personal information.
We treat our disclosures of storyteller information to recipients and institutions, and our enrichment of profiles from third-party sources, as potentially constituting "sharing" under California law. You can opt out using the "Do Not Sell or Share My Personal Information" link on our website or by contacting us at [privacy@harpier.com]. We also honor the Global Privacy Control signal as a valid opt-out.
Residents of other US states. A number of US states have enacted comprehensive privacy laws that provide similar rights, including the right to access, correct, delete, and obtain a copy of personal information, and the right to opt out of certain processing. We extend these rights to residents of states whose laws provide them. If you are unsure whether your state's law applies, contact us and we will help.
How to exercise your rights. You can submit a request by emailing [privacy@harpier.com] or by using the request form on our website at [URL]. We will verify your identity before responding, which may require you to confirm certain information we already hold. You may use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the timeframes required by applicable law. If we deny your request, you may appeal by contacting [privacy@harpier.com], and we will respond to your appeal as required by law.
We will not discriminate against you for exercising any of these rights.
10. Children's and minors' data
We sometimes collect stories and information from minors aged 13 to 17, for example in connection with youth and educational organizations. We treat minors' information with heightened care and apply the following safeguards.
We do not collect information from children under 13. Our story collection is limited to individuals 13 years of age and older. We do not knowingly collect personal information from a child under 13. If we learn that we have collected information from a child under 13, we delete it. If you believe a child under 13 has provided us information, contact us at [privacy@harpier.com].
Minors aged 13 to 17. For contributions from minors aged 13 to 17, we obtain parental or guardian consent before placing a contribution into active use. We collect a parent or guardian name and email for the purpose of obtaining and recording that consent, and we hold the contribution in a restricted state until consent is confirmed. Parents and guardians may review, correct, or request deletion of their minor's information, and may withdraw consent at any time. We do not sell or share the personal information of a minor we know to be under 16 without the authorization required by applicable law.
Educational settings. When we collect information from a minor through a K-12 educational institution, the institution's FERPA obligations and any required parental consent apply, and we handle the information as the institution's processor as described in Section 8.
Non-educational youth organizations. When we collect stories from minors through a youth organization such as a scouting program, FERPA does not apply, and we rely on parental or guardian consent obtained as described above.
The specific consent mechanics, including how parental consent is captured at events and through our intake forms, are described in our Storyteller Consent and Release for ages 13 to 17 and any parental consent materials provided at the point of collection.
11. Security
We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. We review and update our safeguards as technology and threats evolve. No method of transmission or storage is completely secure, so while we work to protect your information, we cannot guarantee absolute security. We host data in the United States.
12. International users and cross-border transfers
We are based in the United States and we store and process personal information in the United States. If you are located outside the United States and provide information to us, you understand that it will be transferred to and processed in the United States, where data protection laws may differ from those in your location.
Where we provide services involving individuals or institutions in other jurisdictions, including the United Arab Emirates, we will handle personal information in accordance with applicable local data protection requirements and the terms agreed with the relevant institution. If you have questions about how the law of your jurisdiction applies to our handling of your information, contact us at [privacy@harpier.com].
13. Third-party links and platforms
Our websites and curated experiences may contain links to third-party sites and services that we do not control, including the platforms institutions use to reach their communities. This policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party site or service you visit.
14. Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date above and post the new version here. If we make material changes, we will provide additional notice as required by law. Your continued participation after an update takes effect means you accept the revised policy.
15. How to contact us
If you have questions, concerns, or requests regarding this policy or your personal information, contact us at: Harpier, LLC 418 Broadway Ste R Albany, New York 12207, USA, Email: [privacy@harpier.com]
This Privacy Policy is governed by the laws of the State of New York, without regard to its conflict of laws principles, except where the law of your jurisdiction requires otherwise.