Data Processing Agreement

How Polaris processes personal data on behalf of Organizations that use it for work.

Effective 1 November 2026. Version: Beta.

This Data Processing Addendum (“DPA”) forms part of the Polaris Terms of Service between Andreas Asprou LTD, trading as Polaris (“Polaris”, “we”), and the customer (“you”). It applies whenever we process personal data in your content on your behalf, under the GDPR, the UK GDPR or similar laws. That covers any use of Polaris for work, including on a Personal Organization. You accept it when you accept the Terms, and no signature is needed. If you need a signed copy, email andreas@plrs.sh.

1. Definitions and roles

• Customer Content: code, files, prompts, transcripts, outputs and other content you or your users put into Polaris.
• Customer Personal Data: personal data in Customer Content.
• You’re the controller of Customer Personal Data, or a processor acting for your own controller. We’re your processor.
• For account, billing, security and analytics data about you and your users, we’re a separate controller under our Privacy Policy.
• Annex 1 describes the processing.

2. Our obligations

We will:

1. Follow your instructions.
   • We process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we’ll tell you first, unless the law forbids that.
   • Your instructions are the Terms, your settings, and how you use Polaris, including what you tell your agents to do.
   • We’ll tell you if we think an instruction breaks data protection law.
2. Keep it confidential.
   • Everyone we authorize to process Customer Personal Data is bound by confidentiality.
   • Our staff open customer content only for the reasons in section 11 of the Terms, and record each time.
3. Keep it secure, with the measures in Annex 2.
4. Use only authorized subprocessors, under section 3. Each is bound by written data protection terms that protect your data at least as well as this DPA, and we stay responsible for them.
5. Help with rights requests. We help you respond when people exercise their data protection rights, as far as the nature of the processing allows.
6. Help with your other obligations. That covers security, breach notification, data protection impact assessments and consultations with regulators, as far as our processing and the information available to us allow.
7. Tell you about breaches. We tell you without undue delay, and within 72 hours of confirming a personal data breach affecting Customer Personal Data. We share what we know and update you as we learn more.
8. Return or delete it, at your choice.
   • When the Terms end, or when you ask, we either return Customer Content as a download of your Session transcripts and files, or delete it from our active systems within 30 days. Backups clear within 14 days after that.
   • We keep a copy only where the law requires it, and keep it confidential.
   • Self-serve export and deletion aren’t built yet; email andreas@plrs.sh.
9. Show compliance.
   • We make available the information needed to show we comply with this DPA, and allow and contribute to audits by you or an auditor you appoint.
   • We start by answering written questions and sharing documents.
   • Audits can happen once a year, or more often if a regulator requires it or after a breach. They’re on site only if written answers don’t settle the question, with reasonable notice and respect for other customers’ confidentiality.
   • You cover your own audit costs.

3. Subprocessors

You authorize the subprocessors on our Subprocessors page when you accept this DPA.

We email your Organization’s Owners at least 7 days before adding or replacing a subprocessor that will handle Customer Personal Data.

• You can object on reasonable data protection grounds before it starts processing your data, and we’ll work with you to resolve it.
• If we can’t, you can end the affected service, and we’ll refund your unused prepaid fees and unused extra usage.

If an emergency forces a change faster, we use only subprocessors you’ve already authorized, or we pause the affected processing until the notice period ends.

4. International transfers

Polaris is established in Cyprus. We process Customer Personal Data mainly in the United States, and our subprocessors may process it in the countries on the Subprocessors page.

When Customer Personal Data leaves the European Economic Area or the UK, we rely on:

• for our subprocessors: the European Commission’s Standard Contractual Clauses, Module 3 (processor to processor), with the UK Addendum where needed; or the EU–US Data Privacy Framework and its UK Extension, where the subprocessor is certified;
• for you, if you’re outside the EEA and the law requires it when we return data to you: the Standard Contractual Clauses, Module 4 (processor to controller) if you’re a controller, or Module 3 if you’re a processor. They form part of this DPA, are completed with the details in Annex 1, are governed by the law of Cyprus, with disputes before the courts of Cyprus, and are supplemented by the UK Addendum where UK law applies.

5. Your obligations

You confirm you have a lawful basis for the personal data you put into Polaris, and that your instructions comply with data protection law.

You choose and connect your own model providers and other services. They process data under your own agreements with them, not as our subprocessors.

6. Liability and priority

• Liability. This DPA is subject to the liability terms in the Terms. Those limits apply only between you and us, as far as the law allows. They don’t limit the rights of the people whose data it is, the powers of regulators, or any liability that the Standard Contractual Clauses require to stay unlimited.
• Priority. If this DPA and the Terms conflict about personal data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.

Annex 1: Description of the processing

Annex 2: Security measures

• Encryption.
  • TLS 1.2 or newer between browsers and Polaris; database connections verify certificates.
  • Database encrypted with AWS KMS; file storage encrypted.
  • Agent sign-ins, API keys and Secrets sealed with KMS envelope encryption; GitHub sign-in tokens encrypted with a separate application key.
• Isolation. Each Workspace runs on its own virtual machine. Previews are served from a separate domain.
• Access control. GitHub sign-in, Organization roles (Owner, Admin, Member), per-Session sharing, and public links that expire and can be revoked.
• Secrets. We don’t put brokered keys on the Machine, and our main API can’t decrypt them; a service can still return a key in its response. Secret values are write-only, and we mask them in Session output, except very short ones.
• Staff access. Staff open content only for the reasons in section 11 of the Terms. Each access is recorded.
• Change control. Automated tests and AI code review in a merge queue; short-lived deploy credentials.
• Resilience. 14 days of database backups, with point-in-time recovery.
• Incidents. Production alerting, and breach notification under section 2.7.
• Known limits. Those listed under “What we haven’t done yet” on our Security page on the effective date of this DPA.