Privacy Policy
Last updated: 14 August 2026
This policy explains how Polaris Profile ("Polaris", "we", "us") collects, uses, and protects your personal data when you use polarisprofile.com and purchase a Polaris Profile. Polaris Profile, operating from the United Kingdom, is the data controller for the purposes of the UK GDPR and EU GDPR. Contact: info@polarisprofile.com.
1. What we collect
Account and purchase data: name, email address, region, and transaction records. Payment card details are collected and processed directly by our payment provider Stripe — we never see or store your full card number.
Questionnaire responses: your answers to the Polaris questionnaire. These describe your self-reported behavioural preferences. We treat this data with heightened care, but it is not medical or health data and we do not ask for, and you should not include, any information about health, religion, politics, sexuality, or other special categories of data.
Your profile: the written profile and type code generated from your responses.
Corporate invitations: if your organization invites you to complete a profile, we receive your name and work email from that organization.
Technical data: IP address, device and browser information, and site usage data (see our Cookie Policy).
2. How we use your data, and our legal bases
| Purpose | Data | Legal basis (UK/EU GDPR) |
|---|---|---|
| Generating and delivering your profile | Questionnaire responses, account data | Performance of a contract |
| Payment and fraud prevention | Purchase data | Contract; legitimate interests |
| Customer support | Account data, profile | Contract; legitimate interests |
| Service improvement and analytics | Technical data, aggregated/de-identified response data | Legitimate interests |
| Marketing emails | Email address | Consent (you can withdraw at any time) |
| Legal compliance | Any of the above | Legal obligation |
3. AI processing and automated generation
Your profile is generated automatically using artificial intelligence. Your questionnaire responses are sent to our AI infrastructure provider, currently Anthropic, acting as our processor, solely to generate your profile. Anthropic does not use data submitted via its API to train its models.
Profile generation is automated processing, but it is not used to make any decision with legal or similarly significant effects about you. Your profile is a development tool for you; our Terms prohibit anyone from using it as the basis for employment or similar decisions. If you have questions about how your profile was generated, or wish to contest its content, contact us and a human will review your query.
4. Who we share data with
We share personal data only with: our payment provider; our AI infrastructure provider; our hosting, email, and analytics providers; the organization that invited you (limited to your completion status and, where the invitation terms say so and you are told at the point of completion, your profile); and authorities where legally required. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
Current sub-processors: Stripe (payments), Anthropic (profile generation), GoDaddy (domain), Microsoft (email), and our website hosting provider [add once hosting is chosen].
5. International transfers
We are based in the UK. Where your data is transferred outside the UK, EEA, Australia, or Canada (for example, to US-based service providers), we rely on UK International Data Transfer Agreements / Addendum, EU Standard Contractual Clauses, or an adequacy decision, as applicable. If you are in Quebec, this means your personal information may be communicated outside Quebec, including to service providers in the UK and US.
6. How long we keep data
- Account and profile data: for as long as your account is active, then deleted within 5 years of your purchase, or sooner on your request.
- Questionnaire responses: retained alongside your profile so it can be regenerated, and deleted on the same schedule.
- Transaction records: 7 years (tax and accounting law).
- You can request earlier deletion at any time (see section 8).
7. Security
Data is encrypted in transit and at rest. Access is limited to those who need it. No system is perfectly secure; if a breach occurs that risks your rights, we will notify you and the relevant regulator as the law requires.
8. Your rights
UK and EU: you have the right to access, correct, delete, and receive a copy of your personal data; to restrict or object to processing; and to withdraw consent. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.
Australia: we handle personal information in accordance with the Australian Privacy Principles. You may access and correct your information and complain to us; if unresolved, you may complain to the OAIC ( oaic.gov.au ).
Canada: we handle personal information in accordance with PIPEDA and applicable provincial privacy laws (including Quebec's Law 25). You may access and correct your personal information and withdraw consent. You may complain to us and, if unresolved, to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information.
United States: depending on your state (including California, Colorado, Connecticut, Texas, Utah, and Virginia), you may have the right to know, access, correct, and delete your personal information, and to opt out of sale, sharing, or targeted advertising. We do not sell or share your personal information for targeted advertising. We will not discriminate against you for exercising your rights. California residents: the categories of information collected and purposes are described in sections 1–4; we have not sold or shared personal information in the preceding 12 months.
To exercise any right, email info@polarisprofile.com. We respond within one month (UK/EU), 45 days (US states), 30 days (Canada), or a reasonable period (Australia), and may need to verify your identity first.
9. Children
Polaris Profile is for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
10. Changes
We will post any changes here and, for material changes, notify account holders by email.