Privacy Notice

This Privacy Notice was last modified on 1 October 2026. If we make significant changes to this Privacy Notice, we will inform you about it.

1. Our commitment to privacy

Polarsteps knows that you take your privacy seriously. We do, too. We are committed to being transparent with you about our data practices and want to give you control over the personal data we collect about you: 

• Polarsteps will not sell your personal data to any third party

• Unless you change the app settings, your trips will only be visible to people following you

• You have full control over who can (and cannot) follow you 

• You can choose to hide or show your location while you're traveling, and the start and end points of your trip 

In this Privacy Notice, we outline why and how we process your personal data, and your rights regarding the personal data we hold about you. 

2. About Polarsteps

With Polarsteps you can plan, track and relive your trips (“Trips”). You can use your Polarsteps account via our website (www.polarsteps.com, “Website”) and/or via our mobile app, which is available on iOS and Android (“App”, together “Polarsteps”). 

In order for you to be able to use Polarsteps, we need to process your personal data. This may include your (live) location while you are traveling on your Trips. While location data is not classified as a special category of personal data under the European General Data Protection Regulation (GDPR), it may be treated as sensitive data under the laws of other jurisdictions. We want you to remain in full control of your location data, so regardless of where you are located, we will always ask for your explicit consent before processing, except when you update your location manually as part of your Trip.

All personal data is collected, processed and secured in compliance with the GDPR and applicable US state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We, Polarsteps B.V., are the controller of the personal data we process about you in relation to the use of our Website and App.

Polarsteps has appointed a Data Protection Officer (“DPO”) responsible for overseeing our data protection practices and compliance with applicable privacy laws. You can contact our DPO at dpo@polarsteps.com. 

You are welcome to contact our DPO directly with any questions or concerns about how we process your personal data.

If you have any additional questions about the way we process personal data, you can reach out to privacy@polarsteps.com. For any data subject requests under the GDPR, please see our Help Center.

3. How do we collect and process your personal data?

3.1 Creating an account

You can choose to create an “Account” to plan, track and relive your Trips and to follow your friends and family on their Trips as well. When you register for an Account, we ask you to create a Polarsteps profile with the following information:  

• Name

• E-mail address

• City of residence (not your street address)

• A profile image

• The password to your Account

You can also use your Apple or Google account to register, in which case we won’t process the password to your Polarsteps Account. If you register using your Apple or Google account, we’ll also have access to public profile information such as your name, e-mail address and Apple- or Google ID.

Processing this personal data is necessary for the performance of our agreement with you.

3.2 Using Polarsteps with an Account

After creating an Account, you’re all set to start using Polarsteps. It is up to you how you use Polarsteps. The App offers the following Features:

• Travel Inspiration: Polarsteps’ Explore features allow you to discover countries and destinations trending with real travelers, places your friends and family loved, and trips tailored to the way you like to travel. There is also travel content for hundreds of destinations written by our editorial team to explore. Find something you love? Add it to your plan in a tap.

• Trip Planning: Polarsteps’ Plan features enable you to build and organize your upcoming Trips. You can create an itinerary (either manually or via our AI Trip Planner), set travel dates, and keep flight and accommodation bookings all in one place. You can also save notes and collaborate with fellow travelers by inviting them (as a Travel Buddy) to a joint Trip via our Travel Together feature.

• Trip Tracking: Polarsteps’ Track features map your route for you (even when you’re offline), so you never have to piece your journey together from memory again. It also automatically logs statistics such as countries visited, distances covered, and days traveled. While on the road, you can create steps at key locations (“Steps”), adding photos, videos, and stories as you go. If you choose to share your Trip, friends and family can follow along in real time.

• Relive Options: Polarsteps’ Relive features let you revisit your travel memories. Your tracked route, photos, videos, and step stories are always available to you within the app or on web, compiled into a visual timeline. And with just a tap or click, you can transform your Trip into a beautiful hardcover Travel Book, Travel Poster, or digital Trip Reel or Route Reel.

• Follow Function: Polarsteps’ Follow features allow users to travel virtually alongside friends, family, and other travelers in real time as they track their Trips. Users can find friends and family by connecting to their device contacts or via suggestions based on mutual followers. Users can add and remove followers at will from the Me tab.

Using the Travel Tracker toggle button in your Trip settings, you can choose to automatically track your Trip in Polarsteps or turn off live tracking and add Steps manually. Don’t want to track your travels at all? Feel free to use Polarsteps just to plan your Trips or keep in touch with friends and family who are on the road. You are in control of your data, always. Depending on the way you use Polarsteps (see Account Privacy Settings and Trip Privacy Settings below), we process the following personal data:

• Your personal info: your name, profile image, city of residence, e-mail address and optional biography text.

• Your location (if you’ve given us your consent for this) so that we can provide core Travel Tracking features, such as automatically recording your route on a map and showing your live location if you choose to enable this.

• Your added content, such as Trips, Steps, reviews, photos, videos, spots, likes, comments, tips and more (“Content”), including geolocation tags attached to such photos/videos.

• Who you follow and who follows you on Polarsteps.

• Technical information to allow the App to operate, such as your IP-address, device type, browser type, screen size and preferred language.

Processing this personal data is necessary for the performance of our agreement with you.

3.2.1. Deleting your Account

You can delete all your Polarsteps Content anytime you like. If you do delete your Content, it will no longer be visible to others and will be permanently deleted from our servers as well after the 30 days post-deletion period lapses. It is not possible to retrieve any deleted Content after deletion. 

It’s also possible to delete your entire Account. If you do this, we will permanently delete your data, so please download your data beforehand. Please note that after deleting your Account, it is not possible to retrieve it. We cannot recover any deleted Accounts. Third party data can take up to 90 days to be deleted. 

3.2.2 Account Privacy Settings

When you create a Polarsteps Account, you agree with the following information being visible to all Polarsteps users, regardless of your privacy settings:

• Your name, profile image, city- and country of residence.

• Number of followers and how many people you follow (including mutual connections).

• The description of your personal bio (optional).

We have two privacy settings for your Account (‘Who can follow me’):  

• Only followers I accept 

You are in control of who can follow your profile. If someone requests to follow you on Polarsteps, you can accept or reject the request.

• Anyone (‘Public’)

Anyone with a Polarsteps Account can start following you. You do not need to approve any follow requests.

Please note that regardless of whether your Account is set to Only followers I accept (‘Followers only’) or Anyone (‘Public’), you can choose different privacy settings for the Trips in your Account, including a fully private setting (Only me). You can find out more about this under Trip Privacy Settings, below.

Processing this personal data is necessary to perform our agreement with you.

3.3 Finding your friends on Polarsteps

Want to know who of your friends and family uses Polarsteps as well? You can easily find out by giving us access to the contacts list in your phone. This is entirely optional. If you choose to do so, we collect and process the following data:

• Names of your contacts;

• E-mail addresses of your contacts.

We use this information to show you which of your contacts already has a Polarsteps Account, and to let those contacts know that you have joined Polarsteps. We only use the e-mail addresses of your contacts, which are sent to our servers to find matches with our existing users. We do not store this information on our servers beyond what is strictly necessary for matching, and we do not use it for any other purpose (including marketing to your contacts).

We process this data based on your consent. You can withdraw your consent and stop sharing your contacts list with us at any time by revoking the Contacts permission in your device settings. Withdrawing your consent does not affect the lawfulness of any processing that took place before you withdrew it.

3.4 Geolocation data

With Polarsteps you can track your Trips and all the places that you visited. To do so, we need to process your location data. For each Trip, you can decide whether you want to automatically track the Steps of your Trip or whether you want to upload Steps manually. 

• Manually uploading your location data: if you prefer not to automatically track your location, you can manually add Steps and/or locations visited to show your traveled route. You can add photos,videos and your (recommended) spots. You will still have a diary of your travels, but your route will not be tracked in full detail and you will not be able to use some functionalities that require continuous location access. The legal basis is the performance of the agreement with you.

• Automatically uploading your location data: you can also have Polarsteps track your route automatically by enabling the “Travel Tracker” in your Trip Settings. When you do so, you will be able to see every location on your route. When sharing your location with Polarsteps automatically, we can also provide you with tailored recommendations for places to see and things to do near your current location. When you enable the Travel Tracker, we process your location data based on your consent. You can withdraw this consent at any time by disabling the Travel Tracker in your Trip Settings or by revoking location permissions for the App in your device settings.

• Sharing your ‘Live Location’ during your Trip: you also have control over sharing your live location. People who you have granted access to follow your Trip (see “Trip Privacy  Settings”) will be able to see your “Live Location” if you enabled it in your Location Privacy Trip Settings’. If you do not enable your Live Location, your last published Step will be shown as your live location. Sharing your Live Location during a Trip is entirely optional and based on your consent; you can switch this feature off at any time in your Location Privacy Trip Settings. Please note that you can also hide your start locations for Trips (for example, to conceal the exact location of your home) in your Location Privacy Trip Settings. If your trip ends in the same location, it will also be hidden.

Do we also process location data when you’re not on a Trip? Only with your specific and separately given consent. If you have given such consent, we have access to your location data for other purposes than automatically tracking the route of your Trip. We have access to your current location when you open the app or occasionally in the background. This way we can suggest you add a Trip when it looks like you’re away from your city of residence (and therefore possibly traveling). If you have given such consent, we only process your last known location (which is only stored on your device, not on our servers) and we never process your full location history (such as your route).

If you don’t want to share your location data with us anymore, you can withdraw your consent at any time, and deny Polarsteps access in your device’s settings.

Any geolocation data embedded in photos or videos you upload to our app is processed by us to show the location where your photo or video was taken on your (previous) Trip. To learn more about who can see your photos and videos, please see 3.5 Trip Privacy Settings below.

For residents of the U.S., additional information about how we use precise geolocation data, and the choices that may be available to you under U.S. law, is provided in section 8. U.S. Supplemental Privacy Disclosures below. 

3.5 Trip Privacy Settings (Who can see this trip?)

For any Trip, you can set the Trip Privacy Settings. The Trip Privacy Settings you choose for your Trip also impact the Travel Stats that are visible to your follower(s) and everyone using Polarsteps (also those without an Account). 

We have three settings for Trips:

• Only me: This Trip, including your ‘Live Location’ (if enabled) and all Content, is only visible to you, as your personal, private travel diary. If you choose to use our Travel Together feature with one or more Travel Buddies, the Only me option for Trip Settings is replaced with Travel Buddies. This means only you and your Travel Buddies can view your ‘Live Location’ and all Content.

Please note that Polarsteps still has access to your data, even when it’s set to Only me or Travel Buddies and may use it to create aggregated and anonymized datasets to inspire fellow travellers. In no way will this ever be traceable back to you.

• Followers: Only your Followers (even if you have Anyone (‘Public’) set in your Account Privacy Settings) are able to follow your Trip, unless you’ve shared the Secret Link to your Trip (see below). 

• Everyone (‘Public’): Anyone can see your Trip and details. Content is shared with anyone when you set the privacy level of a Trip to ‘Public’.

If you change the privacy setting of a Trip from Everyone (‘Public’) to Only me (or Travel Buddies), or delete your Account, Polarsteps will cease featuring your Content in editorial sections of the Platform within a reasonable period. Please note that content already incorporated into published travel content or similar materials may remain accessible.

Think carefully about what data you want to share and who you want to share it with. By default, when you create a Trip, your Trip is only visible to your followers. By default, your sharing link is set to ‘Followers Only link’, but you can also choose to create a ‘Secret Link’ that can be viewed by anyone (also non-followers or even users without a Polarsteps Account). Please be aware that when you set your Trip Privacy to Everyone (‘Public’), anyone may be able to see your live location (when this is enabled). Share responsibly!

Be extra careful when sharing the Secret Link of your Trip. All people that you’ve shared your Secret Link with (either with or without a Polarsteps Account and regardless of whether you’ve accepted them as a follower or not) can see the Content of that Trip. At this moment, it is not possible for Polarsteps to reset the Secret Link if it is being accessed by someone you don’t wish to see your Trip! When sharing a Secret Link with others, always ask them to not pass it on without your permission. If you want to stop the Secret Link from working, you need to change (and keep) the Privacy Settings of your Trip to Only me (or to Travel Buddies if it’s a Travel Together Trip) This will mean  your Trip is no longer visible to Followers or anyone else who previously had access. 

You can change the Privacy Settings of each Trip anytime you want. 

3.5.1 User Generated Content

At Polarsteps, we love to inspire (and get inspired by) fellow travelers. If you’d like to inspire other travelers with your Trip, you can set your Trip’s Privacy Settings to Everyone (‘Public’) By doing so, it’s also possible to publicly share individual Steps of your Trip or the top spots & activities (‘Tips’) within a Step you’ve discovered during your Trip (such as restaurants, activities or other hidden gems). This means that your publicly available “User Generated Content” may contribute to Polarsteps and inspire fellow travelers around the globe. 

By setting a Trip’s Privacy Setting to Everyone (‘Public’), you make this Content available to other users and, where applicable, to users without a Polarsteps Account. Photos and videos you upload may contain geolocation data (such as GPS coordinates embedded in the file's metadata). We process this personal data as necessary to perform our agreement with you and, where we use public Content to inspire other travelers or improve Polarsteps, based on our legitimate interests in operating, improving and further developing our services in accordance with this Privacy Notice. Where we rely on legitimate interests, we always balance our interests against your rights and freedoms and apply safeguards such as aggregation and anonymization where possible.

Any public User Generated Content (either being a Trip in full, or separate Tips) can be selected by our Explore and/or Editorial Team for use in in-App travel content (about countries, destinations, cities or spots). Your User Generated Content may also be used for internal user research purposes, such as to better understand how our users travel and interact with our platform. If your User Generated Content is selected by our Explore- and/or Editorial Team for tips and full Trips, your first name and Account profile will also be visible (this does not apply to the sole use of an image by our Explore and/or Editorial Team). This Account information is already publicly available on Polarsteps for other users when they visit your profile (even if your profile is set to Only followers I accept). 

We create aggregated and anonymized statistical datasets of User Generated Content about traveling experiences based on our and our users’ legitimate interests to further improve Polarsteps. 

3.6 Using Polarsteps without an Account

It is possible to use Polarsteps without an Account to view public Trips and Trips for which you have received a Secret Link. It is not possible to engage with Polarsteps users or plan, track or relive any Trips without an Account. 

To facilitate limited use of Polarsteps without an Account, we process only the technical information that is necessary to provide the Website to you, such as your IP address, device type, browser type and preferred language. We process this data based on our legitimate interest in operating and securing Polarsteps and providing you with basic access to public Trips. Where we use cookies or similar technologies that are not strictly necessary, we will ask for your consent through our cookie banner (see 3.14 Cookies below).

3.7 Ordering Polarsteps Travel Products

To relive your Trips, you can order personalized products of your tracked Trip(s), such as a Travel Book and a Travel Poster (“Travel Products”). Visit our Travel Products pages (such as Travel Books and Travel Posters) to see our current offering of Travel Products. 

In order to create your personalized Travel Product, we need to process the following data:  

• Your Polarsteps Account details (name, e-mail address, profile image, country- and city of residence);

• The Content you have included in the Travel Product

• Shipping information, such as your shipping address

• Payment- and billing information

• If applicable, your Gift Card code and value (see Gift Cards below)

Our agreement with you is the legal basis for the processing of this personal data. We need to share your personal data with certain third parties (for processing of the payment and printing and delivering the products) and they retain your shipping and payment information, so that if you order another Travel Product in the future, you don’t need to re-enter your details again.

3.8 Gift Cards

You can order a “Gift Card” to give a Travel Product to a Polarsteps user you follow on Polarsteps. You can order a Gift Card in two ways: either visit the Gift Cards page of our website and enter the e-mail address of the person you want the Gift Card to be sent to, or go to the Trip of the person you follow in the App or on the Web and click on 'Buy a Gift Card'. Please note you need to fill in the (correct) e-mail address of the recipient either way. Following your purchase, we send the recipient a unique code as their Gift Card. The recipient can use the Gift Card to (partially) pay for any Travel Product. 

When you purchase a Gift Card and we deliver the unique Gift Card code to the recipient, we process the following data:

• If you have a Polarsteps Account: Your Polarsteps Account details (name, e-mail address, profile image, country- and city of residence);

• The name and e-mail address of the recipient 

• The Gift Card code and value

• Payment and billing information

This is necessary for the performance of the agreement with you, to generate your Gift Card code, facilitate the payment and to provide the recipient with the unique code needed to use the Gift Card. We retain payment information related to Gift Cards for as long as necessary to comply with our legal and tax obligations and to handle any questions about your purchase, typically for up to 7 years, after which it is securely deleted or anonymized.

3.9 Polarsteps AI Trip Planner

Not sure where your next Trip is headed? By using the Polarsteps AI Trip Planner, we can curate your next Trip and personalize your itinerary for you. 

To generate your personalized itinerary, we analyze your previous tracked Trips on Polarsteps and any other prompts you add to the AI Trip Planner. Using the AI Trip Planner is completely optional.

Our AI Trip Planner runs on Claude built by Anthropic PBC. Anthropic processes personal data used for the AI Trip Planner on our behalf as a processor, subject to contractual restrictions designed to prohibit use of your personal data to train generalized AI models, except as necessary to provide the service to us. If you decide to use our AI Trip Planner, we’ll always request your consent to process the following data for this purpose: 

• Your Polarsteps Account details (name, e-mail address, profile image, country- and city of residence);

• Your Content on your profile; 

The legal basis for this processing is your consent. You can withdraw your consent at any time by contacting us at privacy@polarsteps.com. Simply not using the AI Trip Planner also stops new processing, but does not constitute formal withdrawal. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.

3.10 Polarsteps Plus

We offer a paid subscription called Polarsteps Plus, which gives you access to certain premium features (you can find out more at polarsteps.com/plus). You can purchase and manage your Polarsteps Plus subscription through the Apple App Store or the Google Play Store.

To process your subscription and give you access to Polarsteps Plus features, we process the following data:

• Your Polarsteps Account details (name, e-mail address, profile image, country- and city of residence);

• Type of subscription

• Transaction- and/or subscription identifiers provided by Apple or Google

We use RevenueCat to manage your subscription and verify your entitlements. RevenueCat receives your unique profile ID and your purchase history from Apple and Google on our behalf. We do not receive your full payment details, as payments are processed directly by Apple or Google under their own terms and privacy policies.

We retain your subscription data for as long as your subscription is active and for 3 years thereafter, to handle any disputes or queries related to your subscription.

The legal basis for this processing is the performance of the agreement with you.

3.11  Improving, securing and optimizing Polarsteps

We’re constantly working on improving Polarsteps for our users. We want our users to have the best possible experience using Polarsteps. This is why we need certain performance data to optimize your experience and to further improve our services. This concerns, for example, the following data:

• How you interact with our App and/or Website, including your search terms and history, pageviews and engagement with other Polarsteps users

• Device information, such as hardware model, OS version, unique ID, browser type, language and Wi-Fi information

• Location data (on a city level)

• Information collected by cookies and similar technologies

• Crash data

Where we use cookies or similar tracking technologies for analytics, attribution, or measurement of the effectiveness of our own marketing, we do so only in accordance with applicable law and your preferences. We do not sell your personal data, and we do not share your personal data with third parties for cross-context behavioural advertising or targeted advertising. U.S. residents can find more information in Section 8. U.S. Supplemental Privacy Disclosures.

For full details of the cookies we use and how to manage your preferences, please refer to 3.14 Cookies and similar tracking technologies below.

Through our cookies consent tools, you have full control over which cookies are placed on your device. Where your consent is required for non-essential cookies, we will only place those cookies after you have given your consent. You can change or withdraw your cookie preferences at any time.

We also run experiments, such as A/B tests, to understand how changes to the App and/or Website affect your experience and to decide which version of a feature works best. As part of these experiments, you may be placed in a test group and shown a different version of a feature or experience than other users. Where we process personal data as part of an experiment, we limit this processing as much as possible, for instance by aggregating the data or using pseudonyms.

The legal basis for analytics and optimization processing is our legitimate interest in improving the App and/or Website, understanding how they are used, and resolving problems. Where non-essential cookies or similar technologies are involved, the legal basis is your consent, as provided through the relevant cookie tool described above.

3.12 Email forwarding (Travel Planner)

Want to easily add your bookings for accommodations, activities and transportations such as flights into your planned Trip in Polarsteps? You can forward your booking confirmation emails to plan@polarsteps.app where we will automatically import the relevant booking details into your planned Trip. With the help of AI (as described in section 3.9 AI Trip Planner above), the relevant fields (such as the accommodation name, activity name, flight number, departure- and arrival destination, booking code and relevant dates and times) will be extracted and will be matched with your planned Trip (through matching email address, or if you decide to use a secondary email address: email addresses, and dates).

The original emails are deleted within 30 days of receipt. The extracted booking details are stored as part of your Trip for as long as your account is active or until you delete them.

The legal basis for this processing is your consent. You can withdraw your consent at any time by contacting us at privacy@polarsteps.com. Simply not forwarding further emails also stops new processing, but does not constitute formal withdrawal. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.

3.13 Browser Extension (Travel Planner)

The Polarsteps browser extension (the "Extension") lets you save destinations, import travel ideas and start building your next Trip directly from your browser, without opening the App.

When you install the Extension and connect it to your Polarsteps Account, we process the following data to make the Extension work:

• Your Polarsteps Account details (name, e-mail address, Account ID), to link what you save in the Extension to your Account;

• URLs and page titles of travel-related pages you actively interact with through the Extension (for example, when you click the Polarsteps icon to save a destination or import a booking)

• Technical information such as your browser type, Extension version and device operating system, to ensure the Extension functions correctly

The Extension only processes data about pages you actively interact with by clicking the Polarsteps button. We do not monitor your general browsing history in the background.

For processing your Account details, the legal basis is the performance of our agreement with you. For processing your browsing interaction data, we rely on your consent, which we ask for when you first install the Extension and activate its trip-planning features. You can withdraw your consent at any time by uninstalling the Extension or turning off its permissions in your browser settings.

Browsing interaction data processed through the Extension is deleted within 90 days, unless you have saved it to a Trip, in which case it is kept as part of your User Generated Content and subject to the retention periods in Section 6. Technical and log data is kept for 90 days in line with our standard log retention policy.

The Extension uses the same infrastructure and Processors as described in Section 3.9. We do not share Extension data with any additional third parties. Where data is transferred outside the EEA, the safeguards described in Section 4 apply.

If we add new features to the Extension that require us to process additional data, we will ask for your consent again before these changes take effect.

3.14 Cookies and similar tracking technologies

When you visit our App and/or Website, small text files are stored on your computer, smartphone or other device. These files are called “Cookies”. Cookies help us to function, analyze and personalize the App and Website.

Similarly, when you open an e-mail from Polarsteps, a small, invisible image embedded in the e-mail body may load. These are called “Pixels” (also known as tracking pixels or web beacons). Pixels allow us to understand whether and when our e-mails are opened or clicked, so we can measure and improve our communications. We do not use Pixels where applicable law requires prior consent or restricts their use.

Polarsteps does not place third‑party tracking cookies on your device to personalize content or show advertisements from third parties, and we do not sell your data to advertisers. Where we use cookies, pixels, or similar technologies for our own analytics and limited Polarsteps‑related marketing (for example, app-install attribution), we do so in line with applicable law and your preferences. For residents of the U.S., additional information about browser-based opt-out signals, including Global Privacy Control where legally required, is provided in section 8. U.S. Supplemental Privacy Disclosures. 

For full details on the cookies we use and how to manage your preferences, please refer to:

• our Cookie Banner in the app, accessible via your in-app ‘Cookies and tracking’ settings; and

• our Cookie Banner on web, accessible via the 'Cookies' link in the footer of our Website.

3.15 Social media

If you follow us on social media or communicate with us (or about us) on social media, we may have access to a part of your public profile data of such social media (depending on the privacy setting you have chosen for these social media accounts). Polarsteps may also follow social media channels and may have access to your public profile information by doing so.

We do this to increase our social-media activity, respond to queries, and analyze customer satisfaction. The legal basis for this is our legitimate interest to improve our services.

3.16 General customer satisfaction surveys

Polarsteps conducts customer surveys in several ways. If you contact our Community & Support Team or purchase a Travel Product, you may receive an invitation to participate in a general customer satisfaction survey. For this purpose, we process information such as your e-mail address to be able to send you a link to participate in the survey and subsequently, the results of the survey (if you wish to receive them). Participation in these surveys is always voluntary.

We use the survey results to improve the quality of our services and Travel Products. The legal basis is our legitimate interest to improve our services.

For more information on how we may process your personal data for the Polarsteps Research Community or specific Research Projects, please see paragraph 3.20 below. 

3.17 Push-notifications, in-app messages and e-mails

Polarsteps can send you push notifications about updates, new features and travel-related content. Push notifications are opt-in based. You can enable or disable push notifications at any time in your device settings. Please note that notification preferences are set per device, so changes you make on one device do not apply to other devices on which you have the app installed. The legal basis for sending push notifications is your consent. You give this consent when you enable push notifications on your device. You can withdraw your consent at any time by disabling push notifications in your device settings.

We can also show you in-app messages such as notifications, banners and pop-ups as part of your Polarsteps experience. These are a core part of the product and do not require your consent. The legal basis for sending these in-app messages is the performance of the agreement with you.

The communications we send you may be personalised based on information we hold about you, such as your travel activity, usage patterns and Account details (for example your upcoming Trips, number of Trips or country of residence). We do this to make sure the communications you receive are relevant and useful to you. The legal basis for this is our legitimate interest to provide you with a personalised product experience.

You may also receive e-mails which are necessary for the performance of the agreement with you, such as Account confirmations, password reset requests, order confirmations or changes to our legal documentation. You will continue to receive these e-mails even if you have previously unsubscribed from other communications.

You can subscribe to our marketing e-mails for travel tips, inspiration and product news. The legal basis for this is your consent. You can unsubscribe at any time by clicking on the 'Unsubscribe' button in each e-mail.

3.18 AI tools in our day-to-day business operations

We use various AI tools to support our internal business operations, including customer support, software development, internal communications, data analysis and content creation.

As a rule, we design our use of these tools so that personal data is not used as input. However, in certain situations personal data may be processed, for example, where a customer support query contains personal details or where code or documents shared internally include personal data. That is why we only work with AI providers that offer appropriate technical and organisational safeguards and we enter into data processing agreements with each provider to ensure your data is handled in accordance with the GDPR. Where providers are located outside the European Economic Area, we ensure appropriate transfer safeguards are in place, such as standard contractual clauses.

Your personal data is not used to train AI models. Where a provider carries out any incidental processing that could be characterised as model improvement, we contractually restrict this and ensure it does not go beyond what is strictly necessary to deliver the service to us.

The legal basis for this processing is our legitimate interest in operating our business efficiently and maintaining the quality of our services. We have assessed that this interest is not overridden by your interests, given the limited and incidental nature of the personal data involved, the contractual safeguards we require from providers and the fact that data is not used for AI training purposes. 

3.19 Support from our Polarsteps Community & Support Team

You can contact our Community & Support Team for help with any issues related to our services. Depending on how you reach us, we may process the following personal data: your name, e-mail address, Account information, and the content of your communications with us, including any attachments or screenshots you provide.

We offer support through direct contact channels (such as e-mail) and through the chatbot in our Help Center. When you use the Help Center chatbot, your conversation is recorded and processed via a third-party cloud service. By initiating a chat, you will be informed of this in the chatbot interface itself; this Privacy Notice governs how we handle that data.

We process this data to handle and respond to your support request, based on the performance of our contract with you. Where we use support communications (in anonymized or aggregated form) for product improvement and research purposes, we do so on the basis of our legitimate interest in improving our services. No support communication is used in identifiable form for these purposes.

3.20 Polarsteps Research Community and Feedback Projects

Polarsteps organizes various research projects to collect feedback from our users in order to improve our services, including our Travel Products. We do this by asking for your feedback via e-mail, in-app surveys, or by conducting video interviews. Participation in any research activity is always entirely voluntary.

Polarsteps Research Community

You can sign up to the Polarsteps Research Community via the registration form. Upon registration, we process the personal data you provide in the registration form, which includes your name, e-mail address, date of birth, and country of residence (and, optionally, your home address). We may complement this information with functional data about how you use our App and/or Website, but only if you have given us your consent for this, such as via our cookie banner. Based on this information, we may invite you to take part in a specific research project.

We process your registration data based on your consent. You can withdraw from the Research Community at any time, without any consequences for your use of Polarsteps.

Participating in a specific Feedback Project

We may also invite you to take part in a specific Feedback Project based on how you interact with the App and/or Website. Participation is always voluntary, and you can decline or withdraw at any time.

We process your data for Feedback Projects based on your consent, both to analyze your app activity for the purpose of selecting you as a potential participant (for which we process your name, e-mail address, date of birth, country of residence and optionally your address if you decide to share this with us for a specific Feedback Project), and to process the responses you provide during the project.

When you take part in a Feedback Project through audiovisual means (i.e. a video interview), we process your audio and video recordings and the information in your answers. Given the personal nature of audiovisual recordings, we rely on your explicit consent for this processing. You may withdraw this consent at any time, in which case we will stop processing your recordings going forward. Recordings already processed prior to withdrawal cannot be retroactively deleted if they have already been incorporated into anonymized research outputs.

All data related to the Polarsteps Research Community and specific Feedback Projects is stored for a maximum of five (5) years and will be deleted thereafter.

3.21 Third-party service providers

Polarsteps works with a range of third-party service providers ("Processors") to develop, maintain, operate and improve the App and/or Website. We have entered into data processing agreements with all Processors, contractually binding them to process your personal data solely on our instructions and in accordance with the GDPR.

The categories of Processors we work with include:

• Cloud infrastructure and hosting providers, who store and process data on our behalf in secure data centres;

• Analytics and performance monitoring providers, who help us understand how the App and/or Website are used and identify technical issues;

• Payment Processors, who handle payments for Travel Products, Gift Cards, and Polarsteps Plus subscriptions;

• Printing and delivery partners, who fulfil orders for physical Travel Products;

• Customer support platform providers, who power our Help Center and Support tooling;

• AI and machine learning providers, who support features such as the AI Trip Planner and booking e-mail extraction;

• Subscription management providers, who manage entitlements for Polarsteps Plus;

• Marketing and attribution providers, who help us measure the effectiveness of our own marketing campaigns, subject to your consent where required; and

• Research and survey platform providers, who facilitate feedback collection via our Research Community and Feedback Projects.

Where Processors are located outside the EEA, we ensure appropriate safeguards are in place as described in Section 4. We review our Processors regularly and will update this section if material changes to our processor landscape occur.

3.22 User Research with Public Trips

If you set your Trip to public, we may also use your User Generated Content for internal research purposes to improve our services and develop new features. This includes analysing travel patterns, user preferences, and content quality to enhance the Polarsteps experience available through our Apps and/or Website. We base this processing on our legitimate interest in improving our services. Where possible, we anonymize data or use pseudonyms for such internal research purposes.

3.23 Mergers and protection of rights

We may need to process your personal data to protect our rights or the rights of third parties, and to enforce our Terms of Use or other policies, for example to respond to a legal claim or to protect our intellectual property rights.

The legal basis for this processing is our legitimate interest in protecting our rights and those of our users.

Business transfers

In the event of a business sale, merger, acquisition, investment, change of control, or transfer of all or part of Polarsteps, your personal data may be shared with or transferred to the relevant third party as part of that transaction. Your data is transferred as part of the business itself and is not sold separately as a commercial product.

In such circumstances, we will take reasonable steps to ensure that:

• the receiving party is bound by contractual obligations to process your personal data in a manner consistent with this Privacy Notice;

• your personal data is used only for the purposes for which it was originally collected; and

• where required by applicable law, you are informed of the transfer and given the opportunity to exercise your rights.

If any such transaction results in a material change to how your personal data is processed, we will notify you in advance in accordance with the introduction of this Privacy Notice.

The legal basis for processing personal data in connection with a business transfer is our legitimate interest in conducting, completing, and integrating such a transaction. Where required by law, we will obtain your consent or fulfil any additional legal requirements before transferring your data.

4. How do we share your personal data?

We do not sell your personal data to third parties for commercial purposes, and we have no intentions to do so in the future. 

We only share your personal data with third parties insofar as this is necessary to provide you with our services as explained in section 3.21.

We provide personal data to third parties who process personal data on our behalf. We enter into an agreement with all our Processors in which we legally bind them to process your personal data in accordance with the GDPR.

Your personal data will only be stored or processed outside the European Economic Area (EEA) by us or by third parties if this is in accordance with the applicable laws and regulations on the transfer of personal data to countries outside the EEA. This means that we will only transfer your personal data to countries outside the EEA if the European Commission has decided that the third country in question ensures an adequate level of protection (has taken an adequacy decision), or if other appropriate safeguards are put in place, such as the use of unmodified Standard Contractual Clauses that have been approved by the European Commission. You can find the adequacy decisions and more information on the Standard Contractual Clauses on the website of the European Commission, using the links provided.

Polarsteps strives to always store your personal data within the EEA. In some cases, we or the third parties used by us may transfer your personal data to the following non-EEA countries:

• Australia, based on Standard Contractual Clauses   

• India, based on Standard Contractual Clauses   

• Israel, based on the adequacy decision for Israel and Standard Contractual Clauses   

• United Kingdom, based on the adequacy decision for the United Kingdom

• United States, if the company participates in the Data Privacy Framework, based on the adequacy decision for the United States, and Standard Contractual Clauses.

5. How do we secure your data?

Polarsteps takes the protection of your personal data seriously. We have implemented appropriate technical and organizational measures to safeguard your information against misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification.

These measures include:

• All personal data transmitted between your device and our systems is encrypted using industry-standard protocols (TLS/HTTPS). Data stored on our servers (including your Account details and Content) is encrypted at rest. This applies to our cloud infrastructure (AWS Europe), our media storage (videos are stored on Wasabi; images are stored on AWS), and our data warehouse (ClickHouse);

• Access to your personal data within Polarsteps is restricted on a need-to-know basis. Internally, we use role-based access controls to ensure that only authorised employees and contractors can access personal data relevant to their role. Our systems require authentication, and sensitive operations are subject to additional controls;

• We only collect data that is necessary for the services we provide. Where possible, we pseudonymize or anonymize data, for example, analytics data is processed on a pseudonymized basis (see paragraph 3.11). Deleted Content and Accounts are removed from our servers promptly, with third-party deletion taking up to 90 days.

• We only share your data with third-party processors who provide adequate safeguards. All processors are bound by data processing agreements. Where processors are located outside the EEA, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses or adequacy decisions. Processors include cloud, analytics, payment, and support providers.

• We have internal procedures in place to report and respond to personal data breaches. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required under the GDPR. Where the breach poses a high risk to you, we will also notify you directly.

• Polarsteps employees and contractors who handle personal data are bound by confidentiality obligations and receive training on data protection.

We regularly review and update our security practices to respond to evolving threats and to ensure the ongoing protection of your data. While no system can guarantee absolute security, we are committed to protecting your information to the best of our ability.

If you have questions about how we secure your data, please contact us at privacy@polarsteps.com or via our Help Center.

6. How long do we keep your data?

At Polarsteps, we want you to be in control of your data. You can delete your content or your entire Account at any time via the app settings. Once deleted, your Content will no longer be visible to other users and will be scheduled for deletion in accordance with our retention practices set out below. Please note that Account deletion is irreversible, so we recommend downloading your data before proceeding (for more info, click here). For residents of the U.S., additional retention information is provided in section 8. U.S. Supplemental Privacy Disclosures below.

When you use Polarsteps with an Account, we generally keep your data for as long as your Account is active, unless a shorter or longer retention period applies based on the type of data, the purpose for which it was collected, or our legal obligations. After you delete your Content or Account, we will delete or anonymise your data where full deletion is not technically feasible or required in accordance with the retention periods set out below. Anonymized data is no longer personal data and falls outside the scope of this Privacy Notice. Where we rely on anonymization rather than deletion, we apply a standard that ensures the data can no longer be linked back to you, directly or indirectly.

We retain certain data beyond the point of deletion only where we have a legal basis to do so. For instance, where a longer retention is necessary to determine, defend or exercise our legal position or rights, or we are required to do so subject to a binding order or legal obligation. The applicable legal basis for each category is identified in the table below.

* During the 30-day post-deletion period, your personal data is retained internally but is no longer visible to other users. No new processing for marketing or analytics purposes takes place during this period. At the end of the 30-day period, your data is permanently deleted or anonymised, except where another retention period in this table applies.

** Any User Generated Content selected by our Editorial Team as part of Polarsteps' Explore content, and that was set to public by you, may be retained after Account deletion in fully anonymized form. Anonymized content can no longer be traced back to you.

Third-Party processors

We instruct our third-party processors to delete your data in accordance with the retention periods above. Due to processor-side backup and deletion cycles, full deletion across all processor systems may take up to 90 days from the date we issue the deletion instruction. During this period, your data remains subject to the same confidentiality and security obligations under our processor agreements and is not used for any active processing.

Deletion of Inactive Accounts

If your Account has been inactive for 3 years on our Platform (meaning you did not have any interaction through your account with our app or website), we will send you three reminders (six-, three and one months before you’ve been inactive for 3 years). Each notification gives you the option to keep your Account active. If we receive no response and you take no action within 30 days of the third reminder, your Account and all associated data (including all of your tracked Trips) will be permanently deleted in accordance with the retention periods set out above.

Booking Information

If you choose to add booking information to a Trip by forwarding a booking confirmation e-mail, Polarsteps uses an AI model to identify and extract the relevant travel details from that e-mail. The e-mail itself is deleted within 30 days of receipt. The extracted travel details are treated as User Generated Content for retention purposes. Your data is not used to train the AI model. The legal basis for this processing is your consent.

If you have questions about how long we retain specific data, please contact us at privacy@polarsteps.com or via our Help Center.

7. What rights do you have?

As we have explained above, you are in control of the information we hold about you, and you can change your Privacy Settings at any time. You can see, edit, or delete individual Trips by going to the settings of each Trip. You can also download a copy of all your data or delete your Account through your Account settings. Furthermore, if you have given us consent for certain processing activities, you can withdraw this consent at any time.

You have the right to access, correct, or erase your data. You can also ask us to restrict the processing or transfer of your personal data and you have the right to object to the processing of your personal data based on our legitimate interests. For residents of the U.S., please see section 8. U.S. Supplemental Privacy Disclosures for important additional information about rights that may apply to you. 

To exercise your rights, contact us at support.polarsteps.com/contact. You can also submit a complaint to the Data Protection Authority.

We love to see you use Polarsteps to plan, track, and relive your Trips, and we thank you for trusting us with your personal data. We hope our Privacy Notice clarifies how we handle your data and empowers you to share your data responsibly.

8. U.S. Supplemental Privacy Disclosures

This U.S. Supplemental Privacy Disclosures (“Disclosures”) applies to personal information of residents located in the United States and supplements our Privacy Notice. We designed this to comply with all currently effective U.S. state consumer privacy laws and to be interpreted in a way that incorporates any additional rights or obligations that may apply to you under the law of your state of residence.

Where a U.S. state privacy law applies to our processing of your personal information, we will honor the rights and obligations described in this section to the extent required by that law. In the event of any conflict between this section and the rest of the Privacy Notice, this section controls with respect to U.S. residents. Where state law provides greater protection than the disclosures below, the applicable state provision governs.

For purposes of these Disclosures, the term “personal information” means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  This includes identifiers, commercial information, internet or device activity, geolocation data, inferences about preferences or characteristics, and other data that can be reasonably connected to an individual or household.

We may update this section from time to time to reflect new or amended U.S. state privacy laws and regulations.

8.1 What personal information do we collect and disclose? 

The table below describes the categories of personal information we collect, the purposes for which we use each category, and the categories of third parties to whom we disclose each category for a business purpose. This description reflects our data handling practices over approximately the last twelve (12) months and will be updated from time to time as our practices evolve. 

Some of the personal information described below may be classified as ‘sensitive’ under certain U.S. state laws (for example, precise geolocation or Account log-in credentials). Where applicable law treats information as sensitive, we handle it in accordance with the additional rights and protections described in 8.2. How do we handle your sensitive personal information.

We do not sell your personal information or share it with third parties for cross-context behavioral advertising or targeted advertising as those terms may be defined under applicable U.S. state privacy laws. If this changes, we will update this notice and provide required opt-out mechanisms. 

For more information on how we collect and share your personal data, please see Section 3. How do we collect and process your personal data? and Section 4. How do we share your personal data? of our Privacy Notice.

For more information about how we use cookies, please see Section 3.14 of our Privacy Notice. 

To update how we handle your Cookies, please see here.

8.2 How do we handle your personal information 

We do not sell personal information for money or share data with third parties that qualifies as a “sale” or “sharing” under applicable state law.  If our practices change such that our use of personal information would be considered a sale, sharing, or targeted advertising under applicable law, we will update this notice, honor your applicable opt-out rights, and, where required, obtain your consent before engaging in those activities.

8.3 How do we treat your sensitive personal information 

Some U.S. state laws treat certain types of personal information as “sensitive” and give you additional rights over how that information is used, including in states such as California, Colorado, Connecticut, Oregon, Indiana, Kentucky, and Rhode Island. This may include information such as government‑issued identifiers, Account log‑in credentials, precise geolocation, health information, biometric identifiers, information about your race or ethnicity, religious or philosophical beliefs, or information about your sex life or sexual orientation.

Where required by applicable law, we will only collect or use sensitive personal information with your consent or as otherwise permitted by law, and we will limit our use and disclosure of sensitive personal information to the purposes described when it was collected or to other purposes allowed under applicable law. You may withdraw your consent at any time using your device settings or by toggling off the ‘Travel Tracker’ in the app. 

Except for Account log‑in credentials that are collected solely to create and secure your Polarsteps’s Account and precise geolocation where you enable automatic route tracking, we do not intentionally collect other categories of sensitive personal information such as health information, biometric identifiers, or information about your race, ethnicity, religious or philosophical beliefs, or sex life/sexual orientation.

8.3.1. Precise Geolocation

Precise geolocation data (i.e., your real-time or route-tracked location) is classified as “sensitive personal information” under the California Privacy Rights Act and as “sensitive data” under the requirements of other applicable U.S. state privacy laws. We use precise location data only to provide you with our core Trip-tracking services.  We do not use geolocation data to create geofences around healthcare, religious, or other sensitive facilities for the purpose of targeting advertising or inferring sensitive characteristics nor do we infer such characteristics from location patterns.

California Residents: You have the right to direct us to limit our use of your precise geolocation data to what is necessary to provide the services you requested, consistent with California law governing sensitive personal information.  We do not use precise geolocation data for advertising purposes or disclose it to third parties for their own commercial purposes.

To limit our use of your precise geolocation data, go to your Polarsteps Account settings and adjust your location tracking preferences.

For residents of states where applicable law requires opt-in consent for processing sensitive data such as precise geolocation, we obtain your explicit consent before activating precise location tracking (for example, via in-app permission prompts). You may withdraw consent at any time through your app settings. We will honor that choice to the extent required by the law of your state. We do not share or sell precise geolocation data with third parties. 

For more information on how we collect and share your personal data, please see 8.1 What personal information do we collect and disclose? of the U.S. Supplemental Privacy Disclosures and Section 3 of the main Privacy Notice.

8.4 What are your consumer rights? 

Depending on the state in which you reside, you may have the following rights in the U.S. regarding your personal information. Some of the rights described below apply only to residents of certain states. We will honor your rights to the extent required by the laws of your state of residence.

You can exercise these rights by submitting a request to us using the contact information found in 8.13. How to contact us below. 

8.4.1. Your right to know

You have the right to request that we disclose to you: (a) the categories and specific pieces of personal information we have collected about you; (b) the categories of sources from which we collected it; (c) our business or commercial purpose for collecting, selling, or sharing your information; and (d) the categories of third parties with whom we disclose your information. If you are an Oregon resident, you also have a right to request a list of specific third parties to which we have disclosed personal information.

8.4.2. Your right to access

In certain states, you have the right to receive a copy of the personal information we hold about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity.

8.4.3. Your right to correct

If you believe personal information we maintain about you is inaccurate, you have the right to request that we correct it.

8.4.4. Your right to delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., information necessary to complete a transaction, comply with a legal obligation, or detect security incidents).  In certain states (such as Iowa or Utah), this applies to only personal information you provided to us.

8.4.5. Your right to opt-out of certain processing

In states where applicable law provides such rights, you may have the right to direct us not to process your personal information for certain purposes, including: (a) selling your personal information; (b) sharing or using your personal information for targeted advertising; or (c) profiling or other forms of automated decision-making in furtherance of decisions that produce legal or similarly significant effects concerning you, as those terms are defined under your state’s law. Because we do not sell or share your personal information for targeted advertising, these rights are relevant primarily to automated decision-making and profiling as described in this Disclosure.

8.4.6. Your right to non-discrimination

You have the right to be free from discrimination or retaliation related to your exercise of any of your privacy rights.  We will not deny you goods or services, charge you different prices, or provide you with a lower quality of service because you exercised any of your privacy rights.

8.5 How to exercise your consumer rights

To exercise any of the rights described above, please submit a verifiable consumer request through one of the following methods:

• Online Request Form: https://support.polarsteps.com/hc/en-us/requests/new 

• e-mail: privacy@polarsteps.com 

8.5.1. Your right to appeal our decision

If we decline to act on your request, you may appeal our decision by replying to our response e-mail or contacting us at privacy@polarsteps.com and indicating that you wish to appeal. In states where required, we will respond to your appeal within the time period specified by applicable law (typically 45 days), and we will provide information about how you can contact your state’s Attorney General if you remain unsatisfied.

8.6 Browser signals and out-opt mechanisms 

As described in these Disclosures, we do not currently “sell” or “share” your personal information and use online identifiers and similar data only for security, analytics, and to provide and improve Polarsteps’s services. Because we do not engage in sale, sharing, or targeted advertising, browser- or device-based opt-out signals (such as Global Privacy Control) do not presently change how we process your personal information. If our practices change in the future, we will honor such signals to the extent required by applicable law.

Where required, we configure our systems and, where feasible, third-party tools to honor recognized opt-out signals, although some services may require you to adjust settings directly in their own tools or in your browser or device. If, for any reason, your opt-out preference signal cannot be honored directly (for example, due to technical limitations or signal loss), you may also opt out by submitting a request as described in 8.13. How to contact us.

8.7 Children and Teen Privacy 

Use of our App and/or Website is not intended for and not directed to children under 16 years of age.  Polarsteps does not knowingly collect, sell, or share personal information from children under the age of 16 and our services are not directed to children under the age of 16. If you are under 16 years of age, do not use or provide any information on our App and/or Website.

In compliance with the Children’s Online Privacy Protection Act (“COPPA”), and its implementing rules, we do not knowingly collect, use, disclose, or sell the personal information of children under 13 years of age for any purpose.  We also do not knowingly use the personal information of minors for targeted advertising or to create profiles in furtherance of decisions that produce legal or similarly significant effects.  Further, consistent with applicable U.S. state privacy laws that provide heightened protections for minors’ personal information, we do not sell or use the personal information of known minor users.

If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information as promptly as possible. If you believe we may have collected information from or about a child under 13, please contact us by submitting a request to us using the contact information found in 8.13. How to contact us below. 

In jurisdictions where applicable law treats the personal information of a known child or minor as ‘sensitive’ data, we handle that information in accordance with the heightened protections and consent requirements of that law, in addition to the measures described in this Section. If we learn that a user is under the applicable minimum age, we may restrict certain features, limit our processing of their personal information, or delete their Account, as required by law.

8.8 Our automated decision-making practices and AI features

We use AI-powered features, including (a) AI analysis of booking e-mails to extract Trip information, (b) personalized Trip recommendations and yearly recaps, and (c) aggregated and anonymized travel insights. We do not use automated decision-making that produces legal or similarly significant effects on individuals without human review.  We use third-party AI providers such as Anthropic to support these features, but we contractually prohibit them from using your personal information to train or improve their generalized models.

In accordance with applicable U.S. state privacy laws governing automated decision-making and profiling, we provide the following information: 

• We disclose that we use AI/algorithmic tools to generate personalized travel recommendations and recaps based on your Trip history.

• Your personal Trip data is not used to train third-party AI models.

8.9  Our data retention periods

We retain personal information for as long as reasonably necessary to fulfill the purposes for which we collected it, including to provide the services, comply with our legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements, and as otherwise required or permitted by applicable law. 

The table below summarizes our typical retention periods for key categories of personal information.

If we cannot feasibly delete data within the periods above, we will instead de-identify or aggregate it, and we may retain certain information longer where necessary to comply with legal, tax, or accounting obligations or to establish, exercise, or defend legal claims.

8.10 What happens if there is a data breach?

In the event of a data breach involving your personal information, we will notify affected U.S. residents in accordance with applicable state data breach notification laws, which generally require notification without unreasonable delay and in some cases within a specified period (for example, 30–60 days) after discovery of the breach.

Notification will be provided via e-mail to the address associated with your Account and will include: (a) a description of the incident; (b) the types of personal information involved; (c) steps you can take to protect yourself; (d) what we are doing in response; and (e) how to contact us with questions.

To report a suspected security issue or data breach, please contact us immediately at: privacy@polarsteps.com 

8.11: State-specific provisions

8.11.1 California Residents

8.11.1.1 California “Shine the Light” Disclosure

California Civil Code Section 1798.83 permits California residents who have established a business relationship with us to request information about whether we have disclosed personal information to any third parties for their direct marketing purposes during the immediately preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. 

8.11.1.2 Your Right to Know 

Under the California Consumer Privacy Act (“CCPA”), California residents have the right to request that we disclose the personal information we have collected about them during the preceding 12-month period. 

This right includes:

• The categories of personal information we collected about you;

• The categories of sources from which that personal information was collected;

• The business or commercial purpose for collecting, selling, or sharing that personal information;

• The categories of third parties to whom we disclose personal information; and

• The specific pieces of personal information we have collected about you (a “data portability” request).

This right applies to personal information collected during the 12-month period preceding the date of your request.  We are not required to retain personal information solely to respond to a future request, and we will honor your right‑to‑know request in accordance with the look‑back period and other limitations permitted under California law.

To submit a Right to Know request, please contact us using one of the methods described in 8.13. How to contact us. We will verify your identity before disclosing any personal information. Verification may require you to provide information that matches data we already hold on file, such as your registered e-mail address or account credentials. We will not charge a fee for processing your request.      

If we are unable to fulfill your request — for example, because we cannot verify your identity — we will notify you of the reason and, where possible, provide alternative means of verification.

8.11.2 Nevada Residents

8.11.2.1 Nevada Privacy Rights

Nevada Revised Statutes Chapter 603A grants Nevada residents the right to opt-out of the sale of their covered information (as defined under Nevada law) to third parties even if their personal information is not currently being sold. Consistent with our general practices described above, we do not currently sell covered information as defined under Nevada law. If you have questions about our data practices or wish to submit a Nevada opt-out request, contact us by submitting a request to us using the contact information found in 8.13. How to contact us, below.

8.12 Financial Incentives and Loyalty Programs

From time to time, and only where permitted by applicable law, we may offer financial incentives — such as discounts, premium features, or other benefits — in connection with the collection, retention, or sale of personal information (for example, as part of a loyalty or referral program). Where we do so, we will:

• Notify you of the financial incentive or price or service difference before you opt in;

• Explain the material terms of the financial incentive program, including the categories of personal information implicated and the value of your data to our business;

• Obtain your separate opt-in consent to the financial incentive before enrolling you; and

• Honor your right to withdraw from the program at any time without penalty, by contacting us at privacy@polarsteps.com or through our Online Request Form:

 https://support.polarsteps.com/hc/en-us/requests/new.

We will not use financial incentive structures that are unjust, unreasonable, coercive, or usurious in nature. Any financial incentive we offer will be reasonably related to the value of the personal information we collect in connection with it.

8.13 How to contact us

For all privacy inquiries, requests, or complaints relating to U.S. law, please contact:

Where permitted by law, we may extend our response time by an additional 45 days when reasonably necessary due to the complexity or number of your requests, and we will inform you of any such extension and the reasons for it.