Privacy Policy.

01Who we are

Polargate is the brand of POLARGATE, S.L. (CIF B24895005, Madrid Commercial Register, sheet M-870906, 1st entry), a company registered in Spain at Calle Electrónica 6, 28027 Madrid, operating from Madrid and Amsterdam. We are the data controller responsible for the personal data described in this policy, which applies to the PolarGate application (bundle identifier ai.polargate.console), the website at polargate.ai and PolarRabbit (the Mac app and the Chrome and Edge extension).

For any privacy question or to exercise your rights, contact us at privacy@polargate.ai.

02Data we process

PolarGate application

• Account data. Your email address and authentication credentials, handled through Supabase Auth. Passwords are never stored in plain text.
• Content you add to your brain. The documents, text, files and related metadata you choose to upload or create inside the app. This content is stored so the app can provide retrieval and AI-assisted features to you.
• Push notification token. If you enable notifications, a device push token is stored so we can deliver the alerts you have opted into.
• Technical and diagnostic data. Basic device, log and error information used to keep the service secure and reliable.

polargate.ai website

• Contact form and project brief. When you submit our contact form or the brief at /start, we process your name, email, optional company name and role, the track you selected, your message, and the structured answers you gave (scope, sector, stage, timeline, budget range and markets). We also record the page where your visit started and, if you came from one of our apps, which one, so we know what brings people to us. Your IP address and a timestamp are used to prevent abuse and are included in the notification email we receive, so we can recognise repeated abusive submissions.
• Draft saved in your browser. While you fill in the brief at /start, your answers are saved in your browser's local storage so you can leave and come back. That draft stays on your device, is never sent anywhere until you press send, and is deleted once the brief is submitted. Clearing your browser data removes it.
• Analytics. Aggregated, cookieless usage and performance measurements via Vercel Web Analytics and Speed Insights. These do not build advertising profiles or track you across other sites.
• Our own visit counter, no cookies. This website counts page views and conversions (for example, a sent form or a click on a phone link) with a small script of our own, pg.js, served from portal.polargate.ai. It sets no cookies and stores nothing on your device, so it works whether or not you accept cookies. For each visit we keep the page path without its query string, the referring site, the campaign (UTM) tags, device type, browser, operating system, country, language and a daily fingerprint: an HMAC of your IP address, browser and this site with a salt that changes and is deleted every day, so the IP address itself is never stored and the same person on two different days counts twice. We never record what you type into a form. Raw data is kept for 25 months. Google Analytics, which does use cookies, only loads if you accept it: see the cookie policy.

PolarRabbit (Mac app and browser extension)

• No account and no personal data. PolarRabbit keeps you shown as Available in Microsoft Teams. Neither the Mac app nor the Chrome and Edge extension asks you to sign in, and neither reads your messages, your Teams sign-in or any other content. We receive nothing from them.
• Settings stay on your device. Whether it is on, the duration you chose and the hop counters are stored only on your Mac or in your browser's extension storage. Uninstalling removes them.
• Updates. Once a day the Mac app downloads the list of versions from polargate.ai to see whether there is a new one. That request carries the app and macOS version, like any download, and is not linked to you. The browser extension is updated by the Chrome Web Store or Edge Add-ons, under Google's or Microsoft's own policies.

PolarGate portal: Google account connections

• What we read. In the PolarGate portal (portal.polargate.ai) a Polargate administrator can connect a Google account to a client's workspace. The portal then reads, in read only mode, that website's Google Search Console and Google Analytics data and the email address of the connected account. We use this data only to build the monthly website report that the client sees in the portal.
• Polargate's own account. Polargate's own Google account is also connected so the portal can store our invoices in its Google Drive and read email from its own mailbox (read only). We do not ask for Drive or Gmail access to the accounts of clients or visitors.
• How it is stored and who sees it. The access tokens are kept in our database, which only Polargate administrators can read. The finished report is kept in private storage and is visible only to administrators and to the people of that client. Only when a report includes optional screenshots from an SEO tool, those screenshots and the report figures are sent to our AI model provider (Anthropic) to draft the analysis, for that request only.
• Disconnecting. Disconnecting the account in the portal deletes the stored tokens. You can also revoke access at any time at myaccount.google.com/permissions.
• Who we share it with. We do not sell, rent or trade Google user data, and we do not share it with advertisers, data brokers or any other third party for their own purposes. We disclose it only to: (1) the client whose website it is, through the report shown to that client's authorised users in the portal; (2) the service providers that run the portal on our behalf, under their data processing terms: Supabase (database and private storage) and Vercel (hosting); (3) our AI model provider, Anthropic, only when a report includes optional SEO tool screenshots, as described above, without using the data to train models; and (4) a public authority when the law requires it. Polargate staff look at this data only to prepare the report, to give support the client asked for, or for security and legal reasons.
• Limited Use. Polargate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising or use it to train AI models.

PolarGate portal: TikTok account connections

• What it is for. In the PolarGate portal (portal.polargate.ai) the owner of a brand that Polargate runs can connect that brand's TikTok account, with TikTok Login Kit. The portal then posts to that account, with the TikTok Content Posting API, only the videos the owner approved in the portal, at the time and with the settings the owner chose (privacy, comments, duet, stitch, commercial content and AI label).
• What we receive. The account's basic profile (display name, username and avatar) so the portal shows where each video will be posted, the privacy options and interaction settings TikTok returns for that account, and the status of each post. We do not read the account's other videos, messages, followers or analytics through the TikTok API.
• How it is stored. The access tokens are encrypted on our server and never reach the browser. Only Polargate administrators can manage the connection. Disconnecting the account in the portal deletes the stored tokens, and the account owner can also remove access at any time in the TikTok app (Settings and privacy, Security, Manage app permissions).
• Who we share it with. We do not sell or share TikTok user data with third parties, do not use it for advertising and do not use it to train AI models. It is processed only by the service providers that run the portal on our behalf (Supabase and Vercel) and by TikTok itself to publish the video.

03How we use your data and legal basis

Under the EU General Data Protection Regulation (GDPR), we process personal data on the following legal bases:

We do not sell your personal data, and we do not use the content you add to your brain for advertising. Content is transmitted to AI model providers only to the extent necessary to generate the specific output you request within the app.

04Service providers (processors)

We rely on a small set of vetted providers who process data on our behalf under data-processing agreements:

05International transfers

Some of our providers are located outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to ensure your data remains protected.

06Retention

• Account and brain content are kept for as long as your account is active. When you delete your account, this data is deleted or irreversibly anonymised within 30 days, except where we must retain limited records to comply with legal obligations.
• Contact-form submissions are retained only as long as needed to handle your enquiry and any resulting relationship.
• Diagnostic and security logs are kept for a short, limited period and then deleted.

07Deleting your account

You can delete your account and its associated data directly inside the PolarGate app, from your account settings. This removes your account data and the content you added, subject to the retention rules above. If you are unable to access the app, email privacy@polargate.ai and we will process the deletion for you.

08Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, to object to certain processing, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these rights, contact privacy@polargate.ai. You also have the right to lodge a complaint with your local data protection authority: in Spain, the Agencia Española de Protección de Datos (AEPD).

09Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data proportionately to its sensitivity.

10Children

PolarGate is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

11Changes to this policy

We may update this policy from time to time. When we do, we will revise the last updated date above and, where changes are material, provide a more prominent notice.

12Contact

POLARGATE, S.L. · CIF B24895005 · Madrid Commercial Register, sheet M-870906, 1st entry · Calle Electrónica 6, 28027 Madrid, Spain. Privacy enquiries: privacy@polargate.ai. General enquiries: the contact form.