Privacy policy · PolarPuffin

Version 2026-10-11.3.

Controller

POLARGATE S.L. is the controller of your data. For any privacy matter, write to hello@polargate.ai. There is no data protection officer; if one is appointed, they will be named here.

Company name: POLARGATE S.L.
Tax ID: B24895005
Registered address: Calle Electrónica 6, 28027 Madrid (Spain)
Email: hello@polargate.ai
Website: polarpuffin.com · polargate.ai

What data we process and why

If you ask for your hotel's free report

Data: The hotel's name, its Google, TripAdvisor or Booking address if you give it to us, your email, your name if you add it and the fact that you ticked the box for this policy.
Purpose: Preparing your hotel's sample report, emailing it to you and replying if you write back.
Legal basis: Pre-contractual steps at your request (art. 6.1.b GDPR).
How long: If you sign up, it moves to the service contract. If not, it is deleted 12 months after the request or the last email.

If you ask for the 30-day trial

Data: The same as for the free report, plus the plan you want to try.
Purpose: Setting up the trial, sending you the reports while it runs and asking you at the end whether you want to carry on.
Legal basis: Pre-contractual steps at your request (art. 6.1.b).
How long: If you sign up, it moves to the service contract. If not, it is deleted 12 months after the trial ends.

If you email us

Data: Whatever you put in the email: your name, your email address, the hotel and what you tell us.
Purpose: Replying to you and talking to you about the service.
Legal basis: Pre-contractual steps at your request (art. 6.1.b) and the legitimate interest in answering whoever writes to us (art. 6.1.f).
How long: If you sign up, it moves to the service contract. If not, it is deleted 12 months after the last email.

If you pay

Data: The email address and the company or hotel name you type on the payment page, plus whatever Stripe asks for to take the payment and work out the tax. Card details go straight to Stripe and never reach us.
Purpose: Charging the subscription, issuing invoices (Stripe generates them on behalf of POLARGATE S.L.), sending you the receipt for each charge (we send it) and preventing payment fraud.
Legal basis: Performance of the contract (art. 6.1.b), the legal obligation to invoice and keep invoices (art. 6.1.c) and the legitimate interest in preventing fraud (art. 6.1.f).
How long: For as long as the subscription lasts. Invoices and billing data, 6 years (article 30 of the Spanish Commercial Code).

If you sign in to your account

Data: What Google gives us when you sign in (your name, your verified email and an identifier of your Google account), the date you accept the terms and this policy, the emails of the people you invite to the hotel and what you mark in the account (changes done, replies published, drafts edited).
Purpose: Opening your session, showing you your hotel's report and subscription, and letting in the people you invite.
Legal basis: Performance of the contract (art. 6.1.b).
How long: For as long as you keep the account. You can download your data or delete the account from the account itself.

If you are a customer

Data: The email address and name of the people at the hotel who receive the reports and alerts, and whatever you write to us about the service.
Purpose: Sending the weekly report every Monday and the email alerts, and looking after the hotel.
Legal basis: Performance of the contract (art. 6.1.b).
How long: For as long as the subscription lasts. Afterwards, only what the law requires us to keep.

When you visit the website

Data: The technical data the server logs for each visit: the IP address, the browser and the page requested.
Purpose: Serving the website and protecting it from abuse, for example by limiting how many requests come from the same address.
Legal basis: The legitimate interest in a working, secure website (art. 6.1.f).
How long: The period the hosting provider sets for its logs. We do not use them for anything else.

What happens when you send a form

Each request reaches us as an email notification to hello@polargate.ai, sent through Resend, and is copied into Polargate's customer records (the Polargate portal, hosted on Supabase in the European Union, in Ireland). You get a confirmation email. No account is created and no password is asked for when you ask.

What we do not do

We do not sell data.
We do not use it for advertising.
We do not build profiles or make automated decisions with effects on people.
We do not send you marketing emails you did not ask for.

Reviews from a hotel's guests

When a hotel signs up for PolarPuffin, POLARGATE S.L. processes the personal data in its reviews on the hotel's behalf, as a processor, under the data processing agreement, which is part of the terms of service. The hotel is the controller of that data.

For the free report requested before signing up, POLARGATE S.L. processes the hotel's reviews as a controller, on the legitimate interest of preparing the report the hotel asked for (art. 6.1.f).

Before reading the reviews we remove the reviewer's name and the link to their profile. If the text names someone, the report replaces it with "[name]". Claude, from Anthropic, reads them through Anthropic's commercial API.

Providers that process data

These are the providers that process data on our behalf. We only list the ones in use; if one is added, it appears here before we use it. When a provider is outside the European Economic Area, the transfer relies on the safeguards in chapter V of the GDPR (standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework).

Vercel: Website hosting (Vercel Inc., United States, under standard contractual clauses).
Google: The hello@polargate.ai mailbox and sending the reports (Google Workspace, Google Ireland Limited).
Resend: Form notifications and confirmation emails (Resend, Inc., United States, under standard contractual clauses).
Supabase: Polargate's customer records, where form requests are copied, and the PolarPuffin accounts with each hotel's report (Supabase, Inc., USA, with the data stored in the European Union, in Ireland; standard contractual clauses for any access from outside).
Google (sign-in): Signing in to the PolarPuffin account with Google: Google confirms your name and email to us (Google Ireland Limited).
Stripe: Payments and invoices (Stripe Payments Europe, Ltd., Ireland). Stripe also processes some data as a controller in its own right to prevent fraud, under its privacy policy.
Anthropic: Reading the reviews with Claude (Anthropic, PBC, United States, under standard contractual clauses and the EU-US Data Privacy Framework). Anthropic does not train its models on data it receives through its commercial API.

Cookies on the payment page

The website sets no cookies. The payment page (and the account, only when you change your card) loads Stripe.js, Stripe's payment code, and Stripe may set its own cookies there to prevent fraud. More in the cookie policy.

Your rights

You can ask for access, rectification, erasure, objection, restriction of processing and portability by writing to hello@polargate.ai. We reply within 1 month at most. If you are not satisfied with the answer, you can complain to the Spanish Data Protection Agency (aepd.es).

If you wrote a review of a client hotel, the hotel is the controller of that data: you can contact the hotel, or write to us and we will pass your request on.

Minors

PolarPuffin is a service for businesses and is not aimed at anyone under 18.

Changes

If anything changes that affects what we do with your data, this page changes first. The date of the last review is shown above.

Other legal texts

For any question about this page, write to hello@polargate.ai.