Trust and data

Privacy Policy

Last updated October 12, 2026

Discovery Marketing operates Discovery Harbor (formerly Discovery Platform), a multi-client system used to host websites, receive customer inquiries, manage CRM records, send transactional messages, and measure advertising performance. You can use it on the web at platform.discoverymarketing.io and in the Harbor iPhone app. This policy explains how Discovery Harbor handles personal information.

Information we process

We process account details supplied by platform users, such as a name, email address, and login; lead information submitted through client websites, such as a name, email address, phone number, and inquiry; content a business adds, such as website text, photos, blog posts, catalog items, and requests to our team; website and campaign attribution data; and limited technical information needed for security, consent, diagnostics, and fraud prevention. In the iPhone app we also process the device token Apple issues for notifications.

How information is used

Information is used to deliver requested services, route inquiries to the relevant client, send approved transactional messages and new-lead alerts, operate CRM workflows, protect the platform, troubleshoot integrations, and measure campaigns when the visitor has provided any consent required by applicable law.

The Harbor iPhone app

The app opens the same Discovery Harbor workspace as the website and adds new-lead notifications, opening a lead from its notification, and calling or texting a lead with one tap.

• Notifications. If you allow notifications, Apple gives the app a device token, which we store with your login so we can alert you about new leads for businesses you have access to. Each notification says only “New lead. Open Harbor to see it.” (in Spanish, “Nuevo prospecto. Abre Harbor para verlo.”) and carries an opaque lead reference. It never contains the lead’s name, phone number, email, message, or reason for contacting the business, or the business name; you see those only after you sign in. Notifications are delivered through the Apple Push Notification service. We remove the device token when you sign out or delete your account, and stop using any token Apple reports as no longer valid. You can turn notifications off at any time in iPhone Settings.
• Sign in with Apple. If you choose “Continue with Apple,” Apple shares an identifier for your Apple ID and its email address (or a private relay address, if you hide your email). We use them only to match you to the login your business invited. An Apple ID whose email has no Discovery Harbor login is not signed in, no account is created, and we revoke the authorization Apple issued right away. For a matched login we keep the token Apple issues so that deleting your account also revokes Harbor’s Apple sign-in. You can also stop using Apple sign-in for Harbor in your Apple Account settings.
• Camera and microphone. The app uses the camera only when you choose to take a photo to upload, and the microphone only when you start a voice conversation with our AI setup guide after allowing AI services (below).
• No tracking. The app contains no advertising or analytics software, does not track you across other companies’ apps or websites, and does not sell your information.

AI services

Some Discovery Harbor features use artificial intelligence from another company. Before any of your information goes to an outside AI provider, Discovery Harbor asks for your permission on an “AI services” screen shown right after you sign in. The two choices, Allow AI services and Don’t allow, are equal and nothing is chosen for you; if you don’t answer, the answer is no. You can change your choice at any time in Settings → AI services. Our servers check your choice before every request to an outside AI provider. Saying no does not affect anything else in Discovery Harbor.

• Our AI setup guide (shown in Harbor with its name and an AI badge) uses OpenAI. When you use the guide, OpenAI receives your voice while the microphone is on, the questions you type, and which setup guide you have open, so it can answer you out loud or in writing. Discovery does not record or store your conversations with the guide, except a reply you choose to report: Report this response sends that reply to our team as a request so we can review it. OpenAI processes conversations under its terms for business customers. If you don’t allow AI services, the guide stays off and its written guides remain available.
• Your web team (AI) and the photo check in Website use Anthropic. When you ask your web team for a change, Anthropic’s Claude receives what you ask, the recent conversation with your web team, your page’s address, words and photo descriptions, so it can answer and suggest one change for you to approve. In Setup help, only after you press Send, local text detection hides suspected keys, card numbers, emails and uncertain text before storage or AI access. With AI services allowed, Anthropic receives that checked screenshot, your checked note and the current setup step. The private copy and replies are accessible only to the business owner and Discovery operators, through short-lived signed links. Owners can delete screenshots; they expire after 30 days and an hourly cleanup removes them. Detection can miss information, so remove all private information before sending. When you choose a face check for a photo, that photo is sent to Anthropic so we can keep faces in the frame. Your conversations with the web team, its suggestions and your decisions are saved in Discovery Harbor so you and our team can see them later. Anthropic processes them under its terms for business customers. If you don’t allow AI services, the web team and the face check stay off, and you can still edit your page yourself.
• Talking to your web team in Website uses OpenAI. When you hold the button to ask for a change out loud, OpenAI receives your voice for that message (up to two minutes) and turns it into words. Discovery does not store the recording: the words come back to you in the message box to read and fix, and only the words you then send to your web team are kept, as your message.
• The second look in Practice (for healthcare practices) uses Anthropic. When a clinician asks for a second look on a read they wrote themselves, Anthropic’s Claude receives that read, the clinician’s question, and the patient’s age group and stage, never the patient’s name, so it can suggest things to consider; it may search the web for general clinical research with queries that contain no patient details. Practice is in demo mode: it holds only made-up sample patients, and Harbor refuses real patient information until the practice and every service involved have HIPAA business associate agreements in place. The clinician reviews every suggestion and makes every decision; the AI never contacts patients. If you don’t allow AI services, the second look stays off and the rest of Practice works.
• The scribe in Practice (for healthcare practices) uses AssemblyAI or OpenAI for transcription and Anthropic for drafting. A clinician may record a visit (only with the patient’s recording consent on file and the recording notice said at the start), upload a recording or paste a transcript, then dictate or write their own take. The audio goes to a transcription service (AssemblyAI under a HIPAA business associate agreement for a live practice; in demo mode, role-plays may use OpenAI). Anthropic’s Claude receives the transcript, the clinician’s take and the patient’s earlier signed notes, never the patient’s name and never the clinician’s private notes, so it can draft a prep summary and a visit note for the clinician to edit and sign. Audio and transcripts are deleted when the note is signed and after 30 days at the latest. Practice is in demo mode: it holds only made-up sample patients and role-plays. If you don’t allow AI services, the scribe stays off and you can still write notes yourself.

We do not use information shared with AI providers for advertising or tracking, and we never sell it.

AI on client websites

Some client websites offer a website application interview that a visitor can answer by voice. When a visitor chooses to start it, the visitor’s voice and answers are sent to OpenAI in real time so it can ask the next question, and the business name and ZIP code the visitor enters are sent to Google Places to find the business. The visitor can type their answers instead. The finished application is stored as a lead for that client.

For participating businesses, the Discovery Local Services connector publishes approved business profiles and available appointment times for AI assistants that book on a person’s behalf, such as Meta’s Muse. It publishes business facts and open times only; no Discovery Harbor user’s personal information is sent through it. It receives only the contact and booking details a person authorizes for the selected business.

Advertising and analytics providers

A client may authorize integrations with Meta, Google and the other ad platforms below, and may add the OpenAI Ads pixel to its website. Discovery Harbor requests only the permissions needed for the selected service. Provider credentials are stored in a dedicated secret manager, not in the browser or ordinary application database. Browser and server advertising events are withheld when recorded consent or client policy does not permit them.

Google user data

A business can connect its own Google accounts to Discovery Harbor. Each Google service is connected separately, and Google shows exactly what is being requested before anything is allowed. This section explains what we access from each Google service and what we use it for.

Discovery Harbor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google sign-in. If you choose “Continue with Google,” Google shares your name, email address, and profile picture with us. We use them only to sign you in and to match you to the login your business invited. Signing in with Google gives Discovery Harbor no access to anything else in your Google account.
• Google Ads. We list the Google Ads accounts you can access so you can choose the one for your business. For that account we read its name, currency, time zone, campaigns, and performance (spend, clicks, impressions, and conversions) to show your reports, and we list its conversion actions so you can choose one, or create Discovery’s website-lead and qualified-lead conversion actions if you ask. Any campaign we create in your account is always created paused, as a draft for review; turning one on is a separate step that requires typing the exact account and daily budget, and is done only with the business’s approval. Through Google’s Data Manager API, when a lead is marked qualified we send that conversion to your Google Ads account, only for leads who gave marketing consent, using Google’s ad click identifiers and the lead’s email address and phone number, which are hashed (scrambled) before they leave our servers.
• Google Analytics. We list the Analytics accounts, properties, and web streams you can access so you can choose one, or, if you ask, create a GA4 property and web stream for your website, mark website leads as a key event, and set the property to keep event data for 14 months. We then read daily sessions, page views, and key events from the chosen property to show your reports, and a real-time count of lead events to confirm tracking works.
• Google Tag Manager. We list the Tag Manager accounts and containers you can access so you can choose one, or create a container for your website. We then prepare a new container version in a separate workspace that adds only Discovery’s standard tags (the Google tag, the Conversion Linker, a Google Analytics lead event, and, when Google Ads is connected, a Google Ads lead conversion) and show the planned changes for review. Nothing is published until the reviewer ticks “I reviewed this GTM version and approve publishing it.” We also read which version is live to confirm the publish worked.
• Google Calendar. We list the calendars you can edit so you can choose one for bookings, check that calendar’s free/busy times so visitors are offered only open times, and create, read, and cancel the appointments booked through Discovery Harbor. We don’t read the details of your other events. Calendar and appointment integrations below explains what a booking shares.

We use Google user data only to provide the features the business turned on in Discovery Harbor, and we share it only with the service providers that run Discovery Harbor, only to provide those features, or when required by law. We never sell it. We don’t use it for advertising (other than running the business’s own Google Ads account at its request), to build profiles of people, or to develop, improve, or train AI or machine-learning models, ours or anyone else’s. No person reads it unless the business asks us to (for example, to manage its ads or help with setup), it is needed for security, such as investigating abuse, or the law requires it.

How we protect Google user data

• Encryption in transit. Every connection to Discovery Harbor, and every request Discovery Harbor makes to Google, is encrypted with HTTPS (TLS).
• Encryption at rest. Google authorizations (the OAuth tokens Google issues when a service is connected) are kept in Google Cloud Secret Manager, which encrypts them at rest. Our application database stores only a reference to each authorization, never the token itself, and short-lived access tokens are requested only when needed and are not saved. The application database, which holds each business’s Google settings, reports, and bookings, and its backups are encrypted at rest with AES-256.
• Server-side only. Google authorizations are used only by Discovery Harbor’s servers and are never sent to your browser or the Harbor iPhone app. Our servers reach Secret Manager with short-lived credentials (workload identity federation), so there is no long-lived key that could be copied and reused.
• Access limited to the business. Each business’s data is kept separate by database row-level security and by permission checks on every request, so people see only the businesses they belong to. Connecting, changing, or disconnecting a Google service requires a recent sign-in, and Discovery staff must use multi-factor authentication to change a business’s integrations.
• Less personal data sent. When Discovery Harbor sends a conversion to Google Ads, the customer’s email address and phone number are hashed with SHA-256 on our servers before they are sent, and only for customers who gave marketing consent. Our record of each upload keeps the conversion action, time, value, and Google’s request ID, not the email address or phone number.
• Audit trail. Every connect, reconnect, and disconnect is recorded in an audit log with who did it and when. The log never contains tokens.
• If something goes wrong. If we learn that Google user data was accessed without authorization, we revoke the affected authorizations, notify the affected businesses without undue delay, and notify Google and the authorities where the law requires it.

How long we keep Google user data, and deleting it

We keep a Google authorization only while that service is connected. Daily Google Ads totals (spend, clicks, impressions, and conversions), records of the changes Discovery Harbor made in Google at the business’s request, records of conversions sent to Google Ads (without email addresses or phone numbers), and appointments booked through Discovery Harbor are kept while the business has a Discovery Harbor account, so its reports and history stay complete. When a business closes its account or asks us to delete its Google user data, we delete it within 30 days. Deleted data can remain in our encrypted daily database backups for up to 7 days, until those backups expire.

A business can disconnect any Google service at any time on Get connected or Integrations in Discovery Harbor (Google Calendar also on Scheduling). We stop using that service right away, and its stored authorization is deleted or permanently disabled so it can never be used again; when the last of Google Ads, Google Analytics, and Google Tag Manager is disconnected, we also revoke Discovery Harbor’s access at Google. You can also remove Discovery Harbor’s access yourself in your Google Account at myaccount.google.com/permissions. Disconnecting does not change anything already in your Google accounts, such as campaigns, properties, containers, or calendar events. To have Google data we already hold deleted, email andy@discoverymarketing.io or follow the data deletion instructions.

Calendar and appointment integrations

When a business connects Google Calendar, we process its calendar list, selected calendar identifier and timezone, authorization credentials, and free/busy information to offer appointments. We create, read, and cancel appointments made through this integration. A confirmed booking sends the attendee's name and email address and the appointment time to Google and the selected business. Google may send calendar invitations and cancellation updates. Optional Google Meet links are generated by Google. Private busy-event details are not published in the directory. Marketing consent is separate. This general appointment service is not intended for medical histories, symptoms, diagnoses, or other clinical records.

CRM integrations (HubSpot and Salesforce)

When a business connects its own HubSpot account, Discovery Harbor sends each new lead for that business to that HubSpot account: the lead's name, email address, phone number, message, the answers they gave, and where they came from (page, referrer, campaign, and whether they arrived from an ad click). Existing HubSpot contacts are matched by email or phone and are only filled in where a field is blank. We request only contact read and write permissions, store the HubSpot authorization in our secret manager, and stop sending when the business disconnects HubSpot or uninstalls the app. Records already in HubSpot are controlled by that business under HubSpot's terms.

When a business connects its own Salesforce org, Discovery Harbor sends each new lead for that business to that org: the lead's name, email address, phone number, message, the answers they gave, and where they came from (page, referrer, campaign, and whether they arrived from an ad click). A new lead becomes a Salesforce Lead; when an open Lead or a Contact already has the same email address (or phone number, when there is no email), we add a task to that record and only fill in fields that are blank. We request only the Salesforce api and refresh_token permissions, which act with the access of the Salesforce user who connected; we use them only to look up, create and update those Leads, Contacts and tasks. We store the Salesforce authorization and the org's address in our secret manager, never in the browser, and we stop sending and revoke our access when the business disconnects Salesforce. A Salesforce administrator can also remove Discovery Harbor's access in Salesforce Setup at any time. Records already in Salesforce are controlled by that business under Salesforce's terms.

Other ad platforms

A business can also connect its own accounts on other ad platforms. Each one is connected separately, through that platform's own sign-in page, and we never see the business's password there. The authorization is stored in our secret manager, not in the browser or our ordinary application database. We use it only to provide the features the business turned on, we never sell it, and we don't use it to build profiles of people or to train AI models. A business can disconnect at any time on Get connected or Integrations; we then delete the stored authorization and stop reading the account. Disconnecting changes nothing already in the business's ad account.

• Microsoft Advertising. We list the Microsoft Advertising accounts the signed-in person can access (name, number, currency and time zone) so the business can choose one. For that account we read campaign performance (spend, clicks, impressions and conversions) when a report is opened, without storing it, and list its conversion goals and UET tags so the business can choose the goal its ads count. Any campaign we create there starts paused, and nothing spends until the business approves a budget in Discovery Harbor.
• TikTok Ads. We list the TikTok ad accounts the business chose to share on TikTok's screen (name, ID, currency, time zone and status) so it can choose one. For that account we read campaign performance (spend, clicks, impressions and conversions) when a report is opened, without storing it, and list its TikTok Pixels and the events they see so the business can choose whether its ads count purchases or leads. Any campaign we create there starts paused, and nothing spends until the business approves a budget in Discovery Harbor. When the business disconnects, we also ask TikTok to revoke our access.

Sharing and service providers

Information may be shared with the client responsible for the website inquiry and with service providers that support the service: Supabase (database, file storage, and sign-in), Vercel (hosting), Google Cloud (secret storage), Resend (email delivery), Cloudflare Turnstile (spam and bot checks on website forms), Apple (iPhone notifications), Stripe (payments a client takes on its own website), OpenAI, Anthropic and Google Places (as described above), and Meta, Google, HubSpot, Microsoft, TikTok, and Salesforce when a business connects them. We do not sell platform account credentials or customer lead information.

Retention and security

Information is retained only as long as needed for the service, legal obligations, dispute resolution, and security. Controls include tenant isolation, role-based access, recent-session checks for sensitive changes, encrypted transport, external secret storage, audit records, rate limiting, and provider revocation workflows. Google user data has its own protections and retention rules, described above.

Deleting your account

You can delete your own login at any time, on the web or in the iPhone app: open Settings → Delete account and type DELETE (ELIMINAR in Spanish) to confirm. This permanently deletes your login, your access to any additional businesses, your notification device tokens, and your AI services choice, and signs you out everywhere. If a record your business must keep, such as a signed agreement, refers to your login, we instead remove your email address and profile details from the login and block it permanently, so it can never be used again. The business’s own records (its website, leads, signed agreements, and payments) belong to the business and stay with it; to close a business account and delete its records, contact us. Deleted information can remain in encrypted routine backups until those backups expire.

Your choices and requests

Visitors can use the website consent controls where available. Platform users can change their AI services choice in Settings → AI services, turn off iPhone notifications in iPhone Settings, delete their account in Settings, and disconnect provider integrations from Settings. To request access, correction, or deletion, email andy@discoverymarketing.io or use the contact channel on discoverymarketing.io, and identify the client website involved. Meta users can also follow the data deletion instructions.

Changes

We may update this policy as services or legal requirements change. The current version and update date will remain available at this URL.