polara labs

Privacy Policy

Last updated: November 10, 2026 · This policy explains how Polara Labs handles your data.

1. The short version

We collect what we need to get your company through a SOC 2 examination and nothing else. We do not sell your data, show you ads, or train AI models on it. When you connect a tool such as Google, we only read settings and records that count as SOC 2 evidence, and we never change anything in your account.

2. Who we are

Polara Labs Inc. ("Polara Labs", "we", "us") runs the platform at polaralabs.com. For any privacy question or request, email help@polaralabs.com.

3. What we collect

  • Account details: your name, work email, company name and the teammates you invite.
  • Assessment answers: what you tell us about your company, systems and controls.
  • Evidence and documents: files you upload, policies we draft with you, and audit records.
  • Payment details: handled by Stripe. We never see or store your full card number.
  • Data from tools you connect: described in sections 4 and 5.
  • Operational logs: sign-in times, errors and security events. No page content.
  • Product analytics: the pages you visit on our website, the buttons you press, how far you get through signup and the readiness assessment, and recordings of those pages so we can see where the product is confusing. Everything you type is hidden from recordings, and your workspace (results, gaps, evidence, policies and reports) is never recorded. Collected with PostHog, and only after you allow analytics and advertising cookies in the prompt on our website; nothing loads before that. If you decline, or withdraw later with Cookie preferences, it stays off.
  • Account events: once you have an account, our servers tell PostHog when account milestones happen, such as signup, sign-in, a scored assessment, a payment or work on a gap. These carry your account ID, the event name and a few fields such as a status, a plan or an amount, never your answers, files, policies or email content. They are part of running the product and do not depend on the cookie prompt.
  • Optional advertising measurement: if you allow analytics and advertising cookies, the LinkedIn Insight Tag measures visits and interactions on our public marketing pages for campaign reporting and retargeting on LinkedIn. LinkedIn receives the public page URL, referrer, public links and button labels, browser and device information, IP address and cookie identifiers. The tag is excluded from sign-in, signup, customer workspaces, assessments, payments, admin and auditor pages. We do not enable enhanced email matching or send account details, assessment answers, evidence or documents to LinkedIn. You can decline or withdraw permission using Cookie preferences on our public website or on your account page. The same prompt covers product analytics. See LinkedIn's Privacy Policy.
  • Google ad clicks: if you arrive from one of our Google ads, we record the click identifier Google adds to the link. We may report back to Google Ads that the click led to a signup or a purchase, with its time and, for a purchase, its amount, so we can measure our ads; no other personal data is sent to Google.

4. Data we access from Google

Connecting Google is optional. If you connect Google Workspace or Google Cloud, you choose the account and approve each permission on Google's own screen. We request read-only access only:

  • Your Google account identity (openid, email): the email address and account ID of the person who connects, so we know which Google account the connection belongs to.
  • Workspace users and groups (admin.directory.user.readonly, admin.directory.group.readonly): who has an account, whether 2-Step Verification is on, who is an administrator, and which groups exist. Used to show access control and MFA for SOC 2.
  • Workspace audit reports (admin.reports.audit.readonly): login and admin activity events. Used to show that access is logged and monitored.
  • Google Cloud settings (cloud-platform.read-only): IAM members, organization policies, audit logging configuration, log export sinks and storage bucket encryption settings. Used to show access control, encryption and logging for SOC 2.

We do not access Gmail, Drive, Calendar, Docs or any file or message content, and we cannot change anything in your Google account.

How we use it. Google data is used only to show SOC 2 evidence inside your Polara Labs workspace, where you, your invited teammates and your assigned independent auditor can see it. It is not used for advertising, not sold, not used to train or improve AI models, and not sent to our AI provider. People at Polara Labs do not read it unless you ask us to for support, it is needed for security, or the law requires it.

Limited Use. Polara Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stopping access. Click Disconnect on the Integrations page, or remove Polara Labs at myaccount.google.com/permissions. Disconnecting revokes our access at Google and deletes the stored token right away.

5. Other tools you connect

Every connector is optional and only reads. The ones you can connect today are Amazon Web Services, GitHub, Google Cloud and Google Workspace. Google is described in section 4.

AWS: you create a read-only role in your AWS account using Amazon's SecurityAudit and ViewOnlyAccess policies. We read account settings such as IAM users, password policy, logging, encryption and backups. We cannot read the contents of your databases or files. Delete the role at any time to end access. GitHub: our GitHub App reads organization members, two-factor settings, teams, branch protection, repository settings and each repository's CODEOWNERS file. It does not read or copy any other source code. Uninstall the app to end access.

6. How we use your data

To run the service: score your readiness, find gaps, draft policies, collect evidence, assemble your report package and hand it to your auditor. To bill you, keep the platform secure, and email you about your account. AI drafting runs on Anthropic Claude models hosted on Amazon Bedrock inside Polara Labs’ own AWS account, in the United States. Our commercial agreement with AWS forbids using your data to train any model, and Bedrock does not store your prompts or outputs. Readiness scoring and gap finding never use AI; the same answers always give the same result. Your answers are sent to the model only when a policy or a gap guide is being written for you, and a file only when it is being checked. Your evidence files and generated documents are stored in Polara Labs’ own AWS account.

7. Who we share it with

We share data only with the services that run Polara Labs, and only what each one needs:

  • Amazon Web Services: file storage, email delivery and AI drafting, all inside our own AWS account.
  • Supabase: our database.
  • Netlify: website and server hosting.
  • Stripe: payments.
  • Sentry: error reports, with secrets and personal content removed.
  • PostHog: product analytics. In your browser only after you allow it in the cookie prompt, sent through our own address (/ingest) to PostHog's United States servers; from our servers, the account events described in section 3, sent to us.i.posthog.com.
  • Google Fonts: the typefaces the site uses. Your browser loads them from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address and browser details with that request.
  • LinkedIn: public advertising measurement and retargeting, only after you allow its cookies.
  • Google Ads: whether a click on one of our ads led to a signup or a purchase.
  • Your assigned independent auditor: your report package and evidence.

We do not sell or rent personal data, and we share it with authorities only when the law requires it.

8. How we protect it

Data is encrypted in transit and at rest. Access tokens for connected tools are encrypted in our database with a separate key, and evidence files sit in private storage that opens only through short-lived signed links. Staff access is limited to what is needed to support you.

9. How long we keep it and how to delete it

We keep your data while your account is open. Email us to export it (within 30 days) or delete it (within 60 days), subject to records we must keep by law. Evidence already delivered to your auditor may be kept by the auditor under their own professional rules.

10. Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it. Email us and we will answer within 30 days. Polara Labs is for businesses and is not meant for anyone under 16.

11. Changes

If we change this policy in a way that matters, we will email active customers at least 14 days before it takes effect and update the date at the top.