Polaris Data Processing Agreement

Effective Date: October 20, 2026

1. Parties and Purpose

This Data Processing Agreement ("DPA") is an addendum to the Polaris Terms of Service (the "Terms") between Infinite Creations Pvt. Ltd., a company incorporated in India with its registered office at 2nd Floor, 2/16 WHS A Block Kirti Nagar Industrial Area, New Delhi ("Polaris," "we," "us"), and the customer ("you"). It applies to Customer Data that we process on your behalf when you use the Service, and it is incorporated into the Terms by Section 7.4 of the Terms. If you accept it for an organization, you confirm that you have authority to bind that organization.

2. Definitions

• "Data Protection Laws" means the laws that apply to the processing of personal data under this DPA, including India's Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and its rules, each as amended.
• "Customer Data" means the personal data contained in the Google Search Console data and other data you connect to the Service, and in the rules and settings you save, that we process on your behalf. It does not include account and contact information about you and your Authorized Users, which we handle as controller under our Privacy Policy.
• "Sub-processor" means a third party we engage to process Customer Data.
• "Data fiduciary," "data processor," "data principal," "personal data" and "personal data breach" have the meanings in the Data Protection Laws. Where a law uses "controller" or "processor," read them to match.
• Other capitalized terms have the meaning given in the Terms.

3. Roles of the Parties

For Customer Data, you are the data fiduciary (or controller), or a processor acting for your own client, and we are the data processor (or sub-processor). Each party will meet its own obligations under the Data Protection Laws.

You are responsible for having a lawful basis, and any authorization from your own clients, to connect each property and have us process its data; for giving any notices that individuals are owed; and for responding to individuals who exercise their rights, subject to Section 8.

4. Scope, Purpose and Instructions

4.1 Purpose. We process Customer Data only:

• To provide, maintain, secure and support the Service
• On your documented instructions, which are this DPA, the Terms, and how you configure and use the Service, such as the properties you connect, the rules you save, and the reports and recipients you choose
• As the law requires, in which case we will tell you first unless the law forbids it

4.2 No Other Use. We do not sell Customer Data, use it for advertising, or process it for any purpose outside Section 4.1.

4.3 Unlawful Instructions. We will tell you without undue delay if we believe an instruction breaches the Data Protection Laws.

4.4 Google Limited Use. Our processing of data received from Google APIs is also subject to Section 6.4 of the Terms and Section 5 of our Privacy Policy. No instruction can require us to use Google user data in a way those sections prohibit.

4.5 Details of Processing. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the categories of data principals and the categories of personal data.

5. Confidentiality

We make sure that the people authorized to process Customer Data are bound by confidentiality duties and access it only where necessary to provide, maintain, secure or support the Service.

6. Security

We maintain reasonable technical and organizational safeguards to protect Customer Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, taking into account the nature, scope and purpose of the processing. Annex 2 describes these measures. We may update them over time, provided the level of protection is not materially reduced.

7. Sub-processors

7.1 General Authorization. You authorize us to engage Sub-processors to process Customer Data. The current Sub-processors are listed in Annex 3.

7.2 Obligations. Each Sub-processor is bound by a written agreement with data protection duties no less protective than this DPA, and we remain responsible for their performance.

7.3 Notice and Objection. We will tell you by email or in the Service at least 30 days before we add or replace a Sub-processor. You may object on reasonable data protection grounds. If we cannot resolve your objection, you may stop using the affected part of the Service, and we will refund prepaid fees for the unused period.

7.4 Not Sub-processors. Google, as the source of the data you authorize us to access, acts under its own terms and is not our Sub-processor for that data. Ahrefs receives only a domain name from us, which is not personal data, and is not a Sub-processor.

8. Assistance with Your Obligations

Taking into account the nature of the processing, we will give you reasonable help to:

• Respond to requests from data principals who exercise their rights. If a data principal contacts us directly about Customer Data, we will pass the request to you without undue delay
• Meet your obligations on security, on notifying personal data breaches to the Data Protection Board of India and to affected data principals, and on any assessments the law requires

We provide ordinary assistance at no charge, but may charge a reasonable fee for requests that need disproportionate effort.

9. Personal Data Breaches

We will notify you without undue delay, and in any event within 72 hours, after we become aware of a personal data breach affecting Customer Data. We will send the notice to your account email address and describe, as far as we know, the nature, extent and timing of the breach, its likely consequences and the measures taken or proposed. We will take reasonable steps to limit the breach, keep you updated, and cooperate with you in notifying the Data Protection Board of India and affected data principals.

10. International Transfers

We store and process Customer Data in India and the United States. You authorize this processing. We will follow any restrictions on transfers of personal data outside India that the Government of India notifies, and we use contractual protections with our Sub-processors where the law requires.

11. Deletion and Return of Data

You can delete connected properties, reports and your account at any time in the Service. If you disconnect a property, we keep its data for up to 6 months in case you reconnect and then delete it, or sooner if you ask. After you close your account, you may ask us to export your Customer Data for 30 days. We then delete or de-identify it within 6 months, and any backups are overwritten within the same period. We may keep data where the law requires it, for example security and access logs, which we keep for at least one year.

12. Audit

We will give you the information reasonably needed to show that we comply with this DPA, including summaries of our security measures and answers to reasonable security questionnaires sent to [email protected]. We do not currently hold ISO 27001 or SOC 2 certification. If that information is not enough, you may request an audit once in any 12-month period on reasonable written notice, during business hours, under confidentiality, and without unduly disrupting the Service. We may charge a reasonable fee for help that goes beyond sharing existing documentation.

13. Liability

Each party's liability under this DPA is subject to the limits and exclusions in Section 14 of the Terms, including the exceptions in Section 14.4 of the Terms. This DPA does not increase either party's liability beyond what the Terms allow, and nothing in it limits liability that cannot be limited by law.

14. Term, Governing Law and Changes

This DPA takes effect when you accept the Terms or start using the Service and lasts as long as we process Customer Data for you. Confidentiality duties survive termination. Governing law and dispute resolution are those in Section 18 of the Terms: the laws of India, with arbitration seated in New Delhi. If this DPA conflicts with the Terms on how personal data is handled, this DPA prevails, as Section 20.1 of the Terms provides. We may update this DPA under Section 17.2 of the Terms, with at least 30 days' notice of material changes that are adverse to you.

15. Acceptance and Contact

Using the Service means you accept this DPA, and no separate signature is needed. If your organization needs a countersigned copy, contact us. Questions about this DPA can be sent to [email protected].

Annex 1: Details of Processing

Subject matter. Providing the Polaris SEO analytics, reporting and optimization service.

Duration. While a property is connected, for the history your Plan includes, up to 6 years. After you disconnect a property or close your account, Section 11 applies.

Nature and purpose. Accessing, storing, organizing, analyzing and presenting the Google Search Console data you connect, and applying the rules and settings you save, to produce SEO analysis, reports and dashboards, to keep historical data, and to share reports with the recipients you choose.

Categories of data principals. People whose information appears in the data from your connected websites, mainly searchers whose queries appear in Search Console data.

Categories of personal data. Search Console data is aggregated, and Google generally anonymizes search queries. Where personal data is present, it may include:

• Search queries that contain personal data typed by a searcher, in limited cases
• Approximate location, such as country
• Device and browser type
• Page URLs and landing pages

Rules and settings you save are generally not personal data.

Special categories. We do not request special categories of personal data or intentionally process children's data. Please do not connect properties whose data is meant to include them.

Annex 2: Technical and Organizational Security Measures

• Hosting. Customer Data is stored on DigitalOcean infrastructure in India and the United States.
• Sign-in. Users sign in only with Google. We never receive a Google password.
• Search Console access. We access properties only through the Google permissions you grant, and you can revoke them at any time.
• Encryption. Data is encrypted in transit using HTTPS.
• Access control. Access to production systems and Customer Data is limited to authorized personnel on a need-to-know basis.
• Separation. Customer Data is logically separated by account within a shared database.
• Logging and monitoring. We keep security and access logs for at least one year.
• Vendor management. Sub-processors are bound by written data protection terms.
• Certifications. None at present.

Annex 3: Sub-processors

We will add any AI provider to this list, with 30 days' notice under Section 7.3, before AI features launch.

Last Updated: October 20, 2026

Infinite Creations Pvt. Ltd., New Delhi, India