Version 0.1 · 18 October 2026 · draft for design partners

Privacy policy

What personal data the Polivor sandbox and this website use, why, for how long, and what you can do about it. We keep it short because we keep little.

Who is responsible

Polivor decides why and how the data below is used. Contact for anything about your data: hello@polivor.com.

What this covers

The public website and the sandbox: a test environment with synthetic data. Production customers have a separate contract and data processing agreement. The sandbox is for business use and not for children.

What we use and why

• Your email address and a display name taken from the start of it. To open your sandbox, sign you in and send the messages you ask for. Basis: the sandbox terms you accept (contract).
• Your sign-in identity: which provider (email link, Google or Microsoft) and its identifier for you. To recognise you when you return. Basis: contract.
• A scrambled form of your email address and of your network address, the email domain, the terms version you accepted and when. To stop abuse and duplicate sign-ups, and to show what you accepted. Basis: our legitimate interest in a secure service.
• Your choice about product updates. We send occasional product updates only if you ticked the box. Basis: your consent, which you can withdraw at any time.
• Technical logs of the service: identifiers, times and error types, never request contents, passwords, keys or tokens. For security and to keep the service running. Basis: legitimate interest.

Evidence records in the sandbox carry only anonymous identifiers, never names or email addresses. We do not use analytics or advertising trackers.

Signing in with Google or Microsoft

We receive your email address, whether the provider has confirmed it, and an identifier for your account at that provider. We do not receive your password, and we do not read your contacts, files or calendar. The provider handles your sign-in under its own privacy policy.

Cookies

Two cookies, both strictly necessary: one keeps you signed in to the console, the other protects the moment you return from Google or Microsoft and disappears after ten minutes. No cookie is used for tracking.

Who else handles the data

• Our hosting provider, with servers in Germany.
• Our email provider, to deliver sign-in links and messages you ask for.
• Google or Microsoft, only if you choose to sign in with them.

We do not sell personal data. These providers act on our instructions, except Google and Microsoft, which are independent for your sign-in with them.

How long we keep it

• Email sign-in links work once and for 15 minutes; the address in them is deleted within a day.
• A console session lasts at most 12 hours, and ends after 60 minutes without use.
• Your sandbox account stays while the sandbox exists. A sandbox with no activity for 30 days is paused, and signing in again reactivates it. We delete your personal data when you ask.
• The scrambled sign-up record and the record of what you accepted are kept as long as needed to prevent abuse and to show your consent.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, to receive it in a common format, and to withdraw consent. Write to hello@polivor.com. When we delete you, your name and email address are removed; the anonymous identifiers in evidence records stay. You can also complain to your data protection authority.

Security

Connections use TLS. Sign-in tokens and session tokens are stored only as hashes. Signing keys never leave a key vault. Access to your sandbox is limited to its users.

Changes

We may change this policy. The version and date are at the top.

This is a draft. A lawyer has not reviewed it yet.