Privacy Policy

Last updated: May 14, 2026 · Effective: May 14, 2026

This policy is a v2 draft using industry-standard frameworks. It is scheduled for legal review. Please direct urgent privacy questions to privacy@polarisdgtl.com.

Napoleon is operated by Polaris Digital Studio ("Polaris," "we," "us," or "our"). This Privacy Policy describes how we collect, use, share, and protect personal information when you use the Napoleon platform at napoleon.polarisdgtl.com.

1. Who We Are (Data Controller)

Polaris Digital Studio is the data controller for personal information collected through Napoleon. We are based in the United States. For privacy inquiries: privacy@polarisdgtl.com.

2. Information We Collect

Account information you provide

Name, email address, phone number, and business name
Business profile details: niche, target customer, voice preferences, service area
Connected social media account credentials (LinkedIn, Facebook, Instagram, Google Business — via OAuth, we never store passwords)
Payment information processed by Stripe (we never store full card numbers)

Usage data

Emails sent, posts published, leads contacted
Approval and rejection decisions
Activity feed events
IP address, browser type, device type, session timestamps

Lead data (third-party business contacts)

Publicly available business contact information collected from Google Places API and similar B2B directories: business name, address, phone, website, generic business email
Email reply content received in response to outreach you authorize

3. How We Use Your Information and Lawful Basis

To provide the Napoleon service: performance of contract
To process payments: performance of contract
To send transactional emails (receipts, alerts, hot lead notifications, password resets): performance of contract
To generate AI marketing content personalized to your business: performance of contract
To send service announcements: legitimate interest
To improve the platform: legitimate interest
To comply with legal obligations: legal obligation

4. Lead Data — How We Collect and Use B2B Contact Information

Napoleon collects publicly available B2B business contact information (business name, address, phone, generic business email, website) from public sources including Google Places API and similar directories. This data is used solely to:

Generate B2B outreach drafts on your behalf, which you must approve before sending
Score lead quality based on public business signals

We do not sell or share lead data with third parties. We do not target individual consumers. We do not collect or process personal information about EU/UK residents in the lead-scraping flow without legitimate-interest justification under GDPR Article 6(1)(f).

Recipients of outreach emails sent through Napoleon may exercise their rights to access, correct, or delete their data by contacting privacy@polarisdgtl.com. Every outreach email includes a one-click unsubscribe link in compliance with the U.S. CAN-SPAM Act, the EU GDPR, the Canadian CASL, and other applicable laws. Unsubscribed addresses are added to a permanent suppression list.

5. Data Sharing

We do not sell your personal information. We share it with the third-party service providers required to operate the platform:

Stripe Inc. — payment processing
Resend Inc. — outbound email delivery
Brevo — system / transactional email and bounce processing
Google LLC — Gemini AI content generation, Places API for lead lookup
Zernio — social media publishing
Railway Corp. — application hosting and PostgreSQL database
Vercel Inc. — frontend hosting
Cloudflare Inc. — DNS, CDN, DDoS protection
Sentry — error monitoring (no personal information sent in error reports beyond user IDs)

We may also disclose information when legally required (subpoena, court order, regulatory request) or to protect our rights, our customers, or the public.

6. International Data Transfers

Napoleon is hosted in the United States. If you access the service from outside the U.S., your personal information will be transferred to and processed in the U.S. The U.S. may not provide the same level of data protection as your home jurisdiction. By using Napoleon, you consent to this transfer. For transfers from the EU/UK, we rely on Standard Contractual Clauses or other appropriate safeguards through our service providers.

7. Data Retention

Account data: retained for the duration of your subscription
Account data after cancellation: retained for 90 days, then deleted unless you request earlier deletion
Lead data and outreach history: retained for 90 days after subscription cancellation
Email outreach suppression list: retained indefinitely to honor unsubscribe requests
Billing records (invoices, transaction logs): retained for 7 years to comply with U.S. tax law

8. Your Rights

All users

Right to access your personal information
Right to correct inaccurate information
Right to request deletion (subject to legal retention exceptions)
Right to opt out of marketing communications

EU/UK residents (GDPR)

Right to data portability
Right to restrict processing
Right to object to processing based on legitimate interest
Right to withdraw consent at any time
Right to lodge a complaint with your supervisory authority

California residents (CCPA / CPRA)

Right to know what personal information we collect, use, and share
Right to delete personal information
Right to correct inaccurate information
Right to opt out of "sale" or "sharing" — we do not sell or share for cross-context behavioral advertising
Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA
Right to non-discrimination

Other U.S. state residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA) have substantially similar rights as defined by applicable state law.

To exercise any right, contact privacy@polarisdgtl.com. We will respond within 30 days (or 45 days for complex requests, with notice of extension).

9. Cookies

We use only essential cookies required for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party retargeting.

10. Security

We implement reasonable technical and organizational security measures including: TLS encryption for all data in transit, encrypted database storage at rest, scoped access controls, secret rotation, signed webhook verification, rate limiting, and continuous error monitoring. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.

11. Data Breach Notification

If we discover a breach affecting your personal information, we will notify you and the appropriate regulatory authorities within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33 and applicable U.S. state laws.

12. AI-Generated Content

Napoleon uses Google Gemini to generate marketing content drafts. AI-generated content is provided "as is" — we do not guarantee its accuracy, originality, or fitness for any purpose. You are responsible for reviewing all AI-generated content before approving it for sending or publication.

13. Children's Privacy

Napoleon is a B2B service not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active subscribers via email at least 14 days before they take effect.

15. Contact

Privacy questions, deletion requests, rights exercise: privacy@polarisdgtl.com