Privacy

Privacy policy

Last updated October 28, 2026

WHL Residence keeps a private record of a property: what is installed in it, what has been done to it, who has worked on it, and the documents that prove it. That record is personal information about a home and the people connected to it, and this policy sets out what we hold, who else touches it, and what you can ask us to do with it.

The service is operated by Werner Harmonic Labs LLC, Woodland Hills, California. For anything in this policy, write to wernersantos@wernerharmoniclabs.com.

What we collect

Your account. Your name, your email address, and a password we never see in readable form. If you sign in with Google we receive your email address, name, and profile image from Google, and no password at all.

The property record. The address, and whatever you choose to add: systems and appliances, maintenance history, scheduled work, documents and images you upload, inventory, and the trades you use, which usually includes their business name and phone number. Some of that is personal information about other people, and you should only add it where you are entitled to.

Connected home credentials. If you connect a Home Assistant instance, we store its address and an access token, encrypted with AES-256-GCM. That token can read the state of devices in your home, and depending on your own setup it may be capable of operating them, including locks. We treat it as the most sensitive value in the system: it is never returned to a browser, never exposed to other members of your home, and is readable only by our server. You can remove the connection at any time, which deletes the stored token.

Vessels, for Marine OS and Yacht Passport. Where a marine service company uses the product, we hold the vessel and berth details, the inspections carried out, the findings and notes recorded against them, photographs taken during a visit, and the owner's email address so the owner can reach their own record.

Enquiries. If you contact us through the site we keep your name, email, company and role, any boat details you give on a boat enquiry, and the browser user-agent string that came with the request.

Operational records. An audit trail of significant actions taken on a property record, ordinary server logs needed to run and secure the service, and, in a short-term counter, the network address or email of a request, to limit repeated enquiries and demonstration questions; it is removed when a later request of the same kind arrives two full counting windows after the window it was counted in (a window is an hour or a day).

Who else processes it

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use the following processors today, and we will update this list before we add another:

Artificial intelligence

Astra answers questions about a property from that property's own record. To do that, the relevant entries (systems with their serial numbers and notes, maintenance, vendors including their phone numbers, document titles, summaries and what was read from them, and saved web research), the home's nickname, city, state, year built and size, and the recent questions and answers in that conversation are sent to OpenAI along with your question. The street address and ZIP code are kept out. When a document is uploaded, by you or by WHL while it builds the record, the file itself is sent to OpenAI to be read, so a summary and equipment details can be read from it. This happens for every upload within the size and monthly limits, even if storing the file then fails. If that document names the equipment's manufacturer or model number, those identifiers, and nothing about you or the property's address, are then sent to OpenAI to find the manufacturer's public manual or support page.

When AI features are used, the relevant property information is sent to OpenAI to process the request. We configure API requests not to store application state. OpenAI may retain API content in abuse-monitoring logs under its platform retention policy unless stricter data-retention controls apply to our account. Under OpenAI's API terms as of October 2026, OpenAI does not train its models on API data unless the customer opts in, and we have not opted in. Astra is grounded: it is told to answer only from the supplied record and to say when something is not in it. Even so, it is software, and its output is not inspection, legal, insurance, emergency, or licensed-trade advice.

The portal includes a short spoken welcome from Astra. It is currently disabled: it is not offered in the portal, and nothing from it is sent to OpenAI. If it is enabled in future, its purpose is to learn the name you would like Astra to use and to answer a few questions about the product; it does not read your property record. If you then choose to begin it, your browser connects directly to OpenAI with a short-lived session key and sends the sound from your microphone, including the name you give, and your browser also passes that name back to OpenAI in text so Astra can confirm it. OpenAI turns your speech into text to hold the conversation and, as with any direct connection, sees your device's network address. We keep only the name you give, whether you asked a question, and whether you finished or skipped the welcome. We do not receive or keep the recording or its transcript. If you continue without voice, nothing is sent to OpenAI.

For any pilot involving real residents of Egypt or their personal data, the spoken welcome is excluded unless and until the applicable privacy and data-processing review explicitly clears it.

If you would rather nothing left our systems, do not ask Astra questions or upload documents, and, if the spoken welcome is ever enabled, continue without it. The rest of the product works without them. Documents WHL uploads while it builds your record are read the same way, and reading cannot be switched off for one home.

Who can see a record

A property record is private to its members. Access is enforced in the database itself rather than only in the interface, so a member of one home cannot reach another, and a signed-out visitor cannot reach any. There are two exceptions. First, an owner can create a read-only key that lets another system read, without signing in, the record's address, nickname, year built, size and rooms, its systems with their notes, its maintenance items with who handles them, and its documents' titles, types and summaries. A key never reads files. A key can be made without an expiry date, and a key not limited to one home reads every home its creator owns, including homes they own later. The portal has no control for it, and a key stops working for a home when its creator is no longer the owner. Second, WHL's administrators can reach the production database for operations and support under a written procedure.

In Marine OS, a service company sees its own fleet and nothing else. A boat owner sees their own vessel, and only the visits their service company has chosen to publish, work in progress is not visible to them.

When a home is transferred, the previous owner's access ends and the incoming owner's begins. Additional people are added by WHL during the controlled pilot, on the homeowner's instruction, and each sees the whole record, including its audit trail, except the Connected Home connection and the owner's transfer links. The audit trail notes each transfer and the email address it was sent to.

When a home is transferred, everything in the record passes to the next owner and to the people they add. That includes documents, notes, vendor contacts and the audit trail. The audit trail keeps the name and email address of each earlier owner and the email address of each person invited to the home. An owner cannot remove audit entries.

Retention and deletion

We keep a record until its owner asks us to delete it. You can ask us to export or delete your data by writing to wernersantos@wernerharmoniclabs.com, and we will respond within 45 days. Deleted data leaves our daily database backups within seven days. Some things cannot be deleted: audit entries documenting security or ownership events, decisions on facts read from a document, and any document read through the separate fact-suggesting step WHL uses while building a record, with what was read from it. While such a document exists, its record, and the accounts that created or claimed that record, can be disabled but not deleted. We list what we keep in our reply.

If you are in California

California residents have the right to know what personal information we hold and where it came from, to have it corrected or deleted, to receive a portable copy, and not to be treated worse for exercising any of those rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but you may still ask us to confirm that. Requests go to the address above.

Security, and its limits

Access is controlled at the database level, files are held in private storage, connected home tokens are encrypted before they are stored, transfer links expire, and secrets stay on the server. None of that makes any system perfect. Please do not upload national identity numbers, financial account numbers, or documents unrelated to the property.

Children

The service is for adults managing property and is not directed at children under 13. We do not knowingly collect their information; if you believe we have, tell us and we will remove it.

Changes

If this policy changes in a way that materially affects you, we will update the date at the top and, where we hold your address, tell you directly.