Legal

GDPR Compliance

Last updated: April 2026

Napoleon, operated by Polaris Digital Studio, is committed to protecting personal data in compliance with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA) and United Kingdom.

Data controller

Polaris Digital Studio is the data controller for personal data collected through the Napoleon platform. For data-related requests, contact us at team@polarisdgtl.com.

Legal basis for processing

We process your personal data on the following legal bases under GDPR Article 6:

Contract performance — processing necessary to provide the Napoleon service you have subscribed to
Legitimate interests — processing necessary for fraud prevention, security, and service improvement
Legal obligation — processing required to comply with applicable laws (e.g., financial record-keeping)
Consent — where explicitly obtained, such as for marketing communications

Your GDPR rights

As a data subject under GDPR, you have the following rights:

Right of access

Request a copy of the personal data we hold about you.

Right to rectification

Request correction of inaccurate or incomplete personal data.

Right to erasure

Request deletion of your personal data ("right to be forgotten").

Right to restriction

Request that we limit how we process your personal data.

Right to portability

Receive your personal data in a structured, machine-readable format.

Right to object

Object to processing based on legitimate interests or for direct marketing.

To exercise any of these rights, contact us at our contact page. We will respond within 30 days.

Data we collect

Account information: email address, hashed password, business name
Business profile data: industry, location, target customer description
Usage data: campaigns sent, emails generated, posts published
Payment data: subscription status (processed by Stripe — we do not store card details)
Social media tokens: encrypted OAuth access tokens for connected platforms

Data retention

We retain your personal data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days before deletion, unless a longer period is required by law.

International data transfers

Napoleon operates servers in regions that may be outside the EEA. Where we transfer data internationally, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) in accordance with GDPR requirements.

Third-party processors

We use the following sub-processors who may handle personal data:

Railway — cloud hosting (infrastructure)
Stripe — payment processing
Resend — transactional email delivery
Sentry — error monitoring
Google (Gemini API) — AI content generation (no data is used for model training)

Supervisory authority

If you are in the EEA and believe we are not handling your data in accordance with GDPR, you have the right to lodge a complaint with your local data protection authority.

Contact us

For GDPR-related requests or questions: team@polarisdgtl.com or visit our contact page.