Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains how POLIRIS, a French Société par actions simplifiée (SAS), registered with the Paris Trade and Companies Register under SIREN number 130 526 890, with its registered office at 61 rue de Lyon, 75012 Paris, France, operates Poliris and processes personal data when you:

• visit the website poliris.io (the “Website”);
• use the Poliris platform available at app.poliris.io (the “Service”);
• install or use the Poliris WordPress plugin (the “Plugin”);
• use the artificial intelligence features offered by Poliris;
• connect a third-party service, including Google Analytics or Google Search Console;
• contact Poliris or interact with us in a business context.

Company information:

• Company name: POLIRIS
• Legal form: Société par actions simplifiée (SAS)
• SIREN: 130 526 890
• Registered office: 61 rue de Lyon, 75012 Paris, France

Depending on the processing activity concerned, POLIRIS acts either as a data controller, in particular for account management, customer and business relationships, billing and its own prospecting activities, or as a data processor where Poliris processes certain data on behalf of and under the instructions of its business customers, under the conditions set out in Section 5.

Data protection contact: florian.michel@poliris.io

1. Data We Collect

1.1 When You Visit the Website

We may process:

• technical data, such as your IP address, browser type and version, device type, pages viewed, referring website and similar log data, in particular to ensure the operation, security and protection of the Website;
• data that you voluntarily provide to us, such as your name, email address, company name and the content of your message when you use a contact form or request a demonstration.

Data relating to your use of the Website may also be processed by audience measurement tools when they are enabled, under the conditions described in Section 12.

1.2 When You Create and Use a Poliris Account

We may process:

• account data: name, business email address, password in hashed form, company and information associated with your account;
• billing information required to manage your subscription and payments;
• Service usage data: actions performed within the interface, configured projects and websites, settings, operation history and exchanges with support;
• content data: domains, URLs, keywords, prompts and web content that you ask Poliris to audit, analyze or process.

Website audits may involve automated crawling of publicly accessible pages of the domains you configure. This crawling operates independently of the WordPress Plugin.

Public content analyzed may occasionally contain personal data. When you ask us to process data concerning third parties, it is your responsibility to ensure that you have an appropriate legal basis for such processing.

1.3 When You Use the WordPress Plugin

The Plugin acts as a connector between your WordPress website and your Poliris account.

When pairing a WordPress website, the Plugin may securely transmit to Poliris:

• a WordPress application password associated with the account used for pairing;
• the pairing code;
• the website URL;
• the WordPress username of the administrator performing the pairing;
• the WordPress version;
• the Plugin version;
• the name of the active SEO plugin, where applicable.

Once the website has been paired, Poliris may communicate with it through the WordPress REST API.

When you explicitly approve a change in the Poliris dashboard, Poliris may, in particular, transmit to your website the content required to apply that change, for example:

• a title;
• a meta description;
• page content;
• image alternative text;
• a new article created as a draft.

The Plugin may also perform technical communications necessary to maintain the connection with Poliris, including to retrieve approved changes or report the connection status.

These communications may use a website-specific technical identifier and a timestamp.

1.4 When You Use Poli AI

The Service may provide you with a conversational assistant called Poli AI.

When you use Poli AI, we may process:

• the content of your conversations, including your messages, questions, instructions and generated responses;
• contextual information required to provide a response, for example data relating to the project or website concerned by your question;
• technical data, such as the timestamp and session identifier.

Conversations may contain personal data where you choose to provide such information. We recommend that you provide only the information necessary for your request and that you do not provide sensitive or confidential information that is not necessary.

Certain information required to generate a response may be transmitted to our artificial intelligence model providers under the conditions described in Sections 3 and 4.

The Poli AI interface informs users that they are interacting with an artificial intelligence system.

1.5 When You Connect Google Analytics or Google Search Console

You may choose to connect a Google Analytics 4 property and/or Google Search Console property to a website configured in Poliris.

This connection is optional and is initiated by you using the authorization mechanism provided by Google.

Poliris requests only the permissions necessary for the features offered, including:

• https://www.googleapis.com/auth/analytics.readonly;
• https://www.googleapis.com/auth/webmasters.readonly;
• Google account identity information required for the connection, including openid and email.

These permissions are read-only.

When you connect Google Search Console, Poliris may, in particular, read performance information associated with the selected property, such as:

• queries;
• pages;
• clicks;
• impressions;
• click-through rate;
• average position;
• device;
• country.

When you connect Google Analytics 4, Poliris may, in particular, read certain reporting data relating to the selected property, such as:

• sessions and acquisition channels;
• users;
• aggregated audience characteristics available within your property;
• device type and country;
• engagement metrics;
• aggregated performance data for audited pages.

Poliris does not use these permissions to modify or delete data in your Google Analytics or Google Search Console property.

The specific use of data received from Google APIs is detailed in Section 7.

1.6 Business Prospect Data

As part of our commercial activities, we may process professional information relating to individuals who may be interested in Poliris.

This information may include:

• first and last name;
• job title;
• company;
• professional contact details;
• the company’s website;
• relevant professional information used to assess the potential relevance of Poliris.

This data may come from:

• publicly accessible professional sources;
• your company’s website;
• professional networks or directories;
• service providers specializing in identifying professional contacts, such as Apollo;
• our previous interactions with you or your company.

Where data has not been collected directly from you, we will inform you of its use no later than at the time of our first communication with you or within the time limits provided for by applicable law.

Each prospecting communication allows you to easily object to any further solicitation.

1.7 What the Plugin Does Not Collect

In its normal operation, the Poliris Plugin is not intended to collect or transmit to Poliris personal data relating to visitors to your own website.

In particular, merely installing the Plugin does not cause it to transmit to Poliris:

• your visitors’ IP addresses;
• their cookies;
• their browsing history;
• their customer or e-commerce data;
• their analytics data.

The Plugin is also not intended to place tracking cookies on your visitors’ browsers.

These statements concern the Poliris Plugin itself and not any other extensions, services or tools that you may use on your WordPress website.

2. Purposes and Legal Bases

We process personal data only where we have a legal basis to do so.

Provision of the Service

Data required to create an account, use the platform, manage billing, perform audits, use Plugin features and use Poli AI is processed in order to perform the contract entered into with you or with the organization on whose behalf you use Poliris.

Legal basis: Article 6(1)(b) of the GDPR.

Demonstration Requests

We process the information you provide to respond to your request and, where applicable, prepare for a contractual relationship.

Legal basis: steps taken prior to entering into a contract, Article 6(1)(b) of the GDPR.

Other Contact Requests

We process your information in order to answer your questions and manage our communications with you.

Legal basis: our legitimate interest in responding to individuals who contact us, Article 6(1)(f) of the GDPR.

B2B Commercial Prospecting

We may use professional contact details to present Poliris to professionals where our offering is reasonably related to their role or professional activity.

Legal basis: our legitimate interest in developing our business, Article 6(1)(f) of the GDPR.

You may object to this processing at any time, easily and free of charge.

Newsletters and Communications Subject to Consent

Where applicable law requires your consent for a marketing communication, newsletter or other optional processing activity, such processing will take place only after your consent has been obtained.

Legal basis: Article 6(1)(a) of the GDPR.

Google Analytics and Google Search Console Connections

When you choose to enable these integrations, we process the relevant data in order to provide the corresponding Service features.

Legal basis: performance of the contract, Article 6(1)(b) of the GDPR.

Connecting to Google remains optional.

Security and Abuse Prevention

We may process technical logs, IP addresses and similar information to protect Poliris, prevent abuse, diagnose incidents and ensure the security of the Service.

Legal basis: our legitimate interest in securing our services, Article 6(1)(f) of the GDPR.

Legal Obligations

Certain information may be retained or processed in order to comply with our tax, accounting, judicial or regulatory obligations.

Legal basis: Article 6(1)(c) of the GDPR.

Where we rely on our legitimate interests, we assess those interests against the rights and freedoms of the individuals concerned and implement appropriate safeguards.

3. Use of Artificial Intelligence

Poliris uses artificial intelligence models and services in particular to:

• analyze websites and their visibility;
• produce recommendations;
• generate or improve certain content;
• respond to Poli AI users.

In this context, Poliris may transmit to an artificial intelligence provider the information strictly necessary to perform the requested functionality.

Model Training

Poliris does not use its customers’ personal data, conversations or Google data to train its own general-purpose artificial intelligence models.

When we use artificial intelligence providers through their professional offerings or APIs, we prioritize and configure, where applicable, services under which data transmitted through API usage is not used to train the provider’s general-purpose models without specific action or authorization on our part.

Poliris does not intentionally enable any mechanism allowing customer content to be used for the general training of its providers’ models.

The fact that such data is not used for training does not exclude any temporary technical retention carried out by a provider for security, abuse prevention or compliance with its legal obligations, in accordance with the terms applicable to its service.

Google Data

Data originating from Google APIs is subject to the additional safeguards described in Section 7.

4. Service Providers and Data Recipients

We use various technical service providers to provide and secure Poliris.

Depending on the service concerned and our contractual relationship with them, these organizations may act as processors, sub-processors or independent data controllers.

4.1 Technical Service Providers for the Service

We may use, in particular, the following providers:

Our primary storage infrastructure is configured within the European Union, including in France for the relevant services.

However, certain providers are established outside the European Economic Area or may perform certain technical operations from countries outside it.

The safeguards applicable to such processing are described in Section 6.

The list of providers may change according to Poliris’s technical requirements. Where we act as a processor for a business customer, changes to sub-processors are managed in accordance with the applicable DPA and Article 28 of the GDPR.

4.2 Services Used to Measure Visibility in AI Search Engines

Poliris may query various artificial intelligence engines or models in order to assess the visibility of a brand, domain, product or topic within their responses.

These services may include:

• OpenAI / ChatGPT;
• Perplexity;
• Mistral AI;
• xAI / Grok;
• DeepSeek.

Measurement queries may contain information necessary for the analysis, such as a brand name, domain, keywords, business sector or search wording.

For the sole purpose of measuring visibility, Poliris does not intentionally transmit to these engines your login credentials, personal contact details, private Google data or other private information that is not necessary for the measurement.

The legal status of each provider depends on the service and the processing actually performed.

4.3 Service Providers Related to Commercial Prospecting

We may use, in particular:

Depending on the processing concerned, these providers may act as processors, data providers or independent data controllers.

Where information concerning you originates from a third party, you may ask us to identify its source under the conditions provided for by the GDPR.

5. When Poliris Acts as a Processor

In certain situations, in particular where a business customer asks Poliris to process information contained on its website or within its systems in order to provide the Service, the customer determines the purposes and essential means of the processing.

In this case:

• the customer acts as the data controller;
• POLIRIS acts as the data processor;
• POLIRIS processes the relevant data on the customer’s documented instructions and in order to provide the Service.

Where required, the parties’ respective obligations are governed by a Data Processing Agreement (“DPA”).

The DPA describes, in particular:

• the subject matter and duration of the processing;
• the categories of data and data subjects concerned;
• security measures;
• the conditions governing the use of sub-processors;
• any international transfers;
• the arrangements for returning or deleting data.

6. International Transfers

Our primary infrastructure for storing account data, application data and files is configured within the European Union.

However, some of the service providers we use are established in the United States or other countries outside the European Economic Area. The use of certain features may therefore result in a transfer of or access to data from a third country.

Where required by applicable law, such transfers are based on a mechanism recognized under Chapter V of the GDPR, including:

• an adequacy decision adopted by the European Commission;
• the EU-U.S. Data Privacy Framework where the recipient is validly certified and that mechanism applies to the transfer concerned;
• the European Commission’s Standard Contractual Clauses;
• and, where necessary, appropriate supplementary measures.

Where a provider is established in the United Kingdom, transfers may, in particular, rely on the applicable adequacy decision, subject to its continued validity and scope.

The fact that Poliris’s main data is stored within the European Union does not mean that no processing or technical access can take place outside the European Union.

You may contact us to obtain further information about the safeguards applicable to a particular transfer.

7. Data Originating from Google APIs

This section specifically concerns information received from Google Analytics and Google Search Console when you choose to connect these services to Poliris.

7.1 Use

We use this data solely to provide the Poliris features associated with the website you have connected.

It may, in particular, be used to:

• display website performance;
• supplement technical audits;
• supplement keyword audits;
• generate metrics;
• answer a question concerning your website in Poli AI when you request this functionality.

7.2 Access and Permissions

We request only the permissions necessary for the operation of enabled features.

The Google Analytics and Google Search Console access used by Poliris is read-only.

7.3 Use in Poli AI

When you ask Poli AI to analyze or explain data originating from a Google integration, the information necessary to provide that response may be transmitted to the artificial intelligence provider used to generate the response.

Such processing takes place solely in connection with the Poliris functionality you are using and following your action.

Poliris does not transmit data originating from Google APIs to an AI provider for the purpose of training or improving a general-purpose artificial intelligence model.

7.4 Storage

The Google refresh token used to maintain the connection is protected at rest within our infrastructure.

Temporary access tokens are used to communicate with Google in accordance with its authorization protocol.

Imported reporting data may be stored with the project or audit to which it relates.

7.5 Sharing and Prohibited Uses

Poliris:

• does not sell data originating from Google APIs;
• does not use such data to serve targeted or personalized advertising;
• does not use such data for advertising retargeting;
• does not use such data to determine creditworthiness or make lending decisions;
• does not use such data to develop or train a general-purpose artificial intelligence model;
• does not provide such data to data brokers or information resellers.

Such data may only be disclosed to service providers necessary to provide the requested functionality, ensure the security of the Service, comply with the law or carry out an authorized legal transaction, within the limits permitted by applicable rules.

Poliris's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.6 Human Access

Our personnel access data originating from your Google integrations only where necessary and authorized, including:

• at your request in order to assist you;
• to resolve a technical issue;
• to ensure the security of the Service or investigate abuse;
• to comply with a legal obligation;
• where the data has been aggregated or anonymized so that an individual can no longer be identified.

Individuals with access are subject to confidentiality obligations and access restrictions.

7.7 Disconnection and Deletion

You may disconnect Google Analytics or Google Search Console using the settings available within Poliris.

Disconnecting the integration results in the deletion of the token that allows Poliris to maintain access to the relevant property, in accordance with the operation of the Service.

You may also revoke the authorization granted to Poliris directly through the security settings of your Google account.

Data already imported into an audit or project may be retained with that audit or project until it is deleted or for the retention period applicable to your account.

You may request earlier deletion by emailing florian.michel@poliris.io, subject to any applicable legal retention obligations.

8. Connectors to Third-Party AI Assistants

Where Poliris allows you to connect your account to a third-party AI assistant, including through a protocol such as the Model Context Protocol (“MCP”), this connection is optional and must be expressly initiated or authorized by you.

Poliris limits the permissions granted to the connector to those required for the relevant service.

Where applicable:

• the requested permissions are displayed at the time of connection;
• access tokens have a limited duration or scope;
• you may revoke access;
• revocation prevents further access using the revoked authorization.

A third-party assistant or service to which you choose to transmit data may process that data in accordance with its own terms and privacy policy.

We therefore recommend reviewing the relevant provider’s terms before authorizing a connection.

9. Retention Periods

We retain personal data only for as long as necessary for the purpose for which it is processed, subject to applicable legal obligations.

Accounts and Service Data

Active account data is retained for the duration of the contractual relationship.

After an account is closed, this data is deleted or anonymized within a maximum period of 90 days, unless longer retention is necessary to comply with a legal obligation, resolve a dispute or defend our rights.

Copies contained in backups may remain for an additional limited period before being purged in accordance with the normal backup cycle.

WordPress Plugin Data

Authentication information retained by Poliris to access a WordPress website is deleted when the website’s connection to Poliris is removed in accordance with the conditions provided by the Service.

You may also revoke the application password directly from WordPress. Once revoked in WordPress, it can no longer be used by Poliris.

Simply deactivating the Plugin should not be considered a substitute for revoking the application password where you wish to permanently remove authorization.

Google Integrations

Authorizations retained by Poliris are deleted when you disconnect the corresponding integration.

Reporting data already imported follows the retention period of the project or audit to which it is attached.

Billing and Accounting

Documents that must be retained to comply with accounting, tax or commercial obligations are retained for the period required by applicable law, which may in particular be up to 10 years.

Technical and Security Logs

Technical and security logs are retained for a period proportionate to their purpose and, unless there is a specific need, for a maximum period of 12 months.

Contact Requests

Data relating to a contact request that does not result in a contractual relationship is retained for a maximum period of 24 months from the last meaningful exchange, unless circumstances justify a shorter or longer period.

Business Prospects

Data used for prospecting purposes relating to an individual who is not a customer is retained for a maximum period of 3 years from its collection or from the prospect’s most recent contact.

Where an individual objects to prospecting, the information strictly necessary to comply with that objection may be retained on a suppression list for an appropriate period, in particular to prevent that individual from being contacted again following a new collection of their contact details.

10. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure or destruction.

Depending on the systems concerned, these measures include:

• encryption of communications using HTTPS/TLS;
• protection of sensitive credentials and secrets at rest;
• hashing of user passwords;
• access restrictions on production systems;
• application of the principle of least privilege;
• logging of certain technical and security events;
• logical isolation of different customers’ data;
• appropriate backup and restoration mechanisms.

As no computer system can guarantee absolute security, we regularly reassess the measures implemented based on risks and changes to the Service.

Data Breaches

Where a personal data breach is likely to result in a risk to the rights and freedoms of the individuals concerned, we notify the competent supervisory authority in accordance with Article 33 of the GDPR and, where feasible, within 72 hours after becoming aware of it.

Where the conditions of Article 34 of the GDPR are met, we also inform the individuals concerned without undue delay.

Where Poliris acts as a processor, we inform the relevant data controller in accordance with applicable obligations.

11. Your Rights

Subject to the conditions provided for by applicable law, you may have the following rights regarding your personal data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability, where applicable;
• right to object to processing based on legitimate interests;
• right to withdraw your consent at any time for processing based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

In particular, you may object at any time and free of charge to the use of your contact details for commercial prospecting purposes.

Where French law applies, you also have the right to define instructions regarding the handling of your personal data after your death, in accordance with applicable French legislation.

To exercise your rights or ask a question relating to the protection of your data, you may contact us at:

florian.michel@poliris.io

We may ask you to provide information reasonably necessary to verify your identity where required to prevent data from being disclosed to an unauthorized person.

We respond to requests within the time limits provided for by applicable law, in principle within one month under the GDPR. This period may be extended where a request is complex or numerous, under the conditions provided for by the GDPR.

You also have the right to lodge a complaint with a supervisory authority.

In France, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).

12. Cookies and Other Trackers

The Website and the Service may use cookies or similar technologies.

Strictly Necessary Cookies

Certain cookies or storage mechanisms are necessary for the technical operation of the Website or Service.

They may, in particular, be used to:

• maintain a secure session;
• authenticate a user;
• prevent certain attacks;
• protect forms;
• remember a user’s privacy choices.

Where these trackers are strictly necessary for the operation of the requested service, their use does not require prior consent under the conditions provided for by applicable law.

Audience Measurement and Product Analytics

Poliris may use audience measurement or product analytics solutions, including Google Analytics or PostHog, depending on the configuration in effect.

Where these tools use cookies or other trackers requiring consent, they are enabled only after that consent has been obtained.

Certain audience measurement systems may, in specific configurations, qualify for an exemption from consent where they satisfy all conditions imposed by applicable law.

We consider a tool to be exempt from consent only where its configuration actually makes it possible to satisfy all such conditions.

Where trackers subject to consent are used, you may accept or refuse their use and change your choices at any time using the cookie management tool provided on the Website.

The information displayed in this tool specifies the categories of trackers actually used, their purposes, their providers and, where applicable, their duration.

The Poliris WordPress Plugin is not intended to place tracking cookies on visitors to WordPress websites on which it is installed.

13. Automated Decision-Making

The recommendations, analyses or content produced by Poliris and its artificial intelligence systems are intended to assist the user.

Poliris is not intended to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect that individual within the meaning of Article 22 of the GDPR.

14. Minors

Poliris is a service intended for professional use.

The Service is not intended for persons under the age of 18, and we do not knowingly seek to collect their personal data.

If you believe that a minor has improperly provided us with personal data, you may contact us so that we can investigate the situation.

15. Changes to This Policy

We may amend this Privacy Policy in order to take account, in particular, of:

• changes to Poliris;
• the addition or modification of a feature;
• a change in our service providers;
• a legal or regulatory development.

The date shown at the top of this policy indicates when it was last updated.

Where changes are substantial, we may inform account holders by email or directly through the Service.

Where applicable law or a provider’s rules require renewed consent before a change in the use of data, we will obtain such consent before implementing the new use concerned.

16. Contact

POLIRIS
Simplified joint-stock company (SAS)
SIREN: 130 526 890
61 rue de Lyon
75012 Paris
France

Data protection and legal matters:
florian.michel@poliris.io