Privacy statement
What we hold about you, and why.
Short version: this website collects almost nothing. If you fill in a form, we keep what you typed so we can answer you. That is the whole story on this side of the product.
Last updated 20 September 2026
This is about the website, not about the product
Two different things carry the Polly name. This page is about pollyhelp.com, the website you are reading now. It is not about the Polly platform that our customers run, where their own knowledge and their own end users live. That side is covered by the agreement and the data processing agreement we sign with each customer, and your own organization holds a copy. If you came here looking for that, write to us through the contact form and we will send you the right document.
Who is responsible
Polly.Help B.V., Maanlander 47, 3824 MN Amersfoort, the Netherlands. Chamber of Commerce 68552386. For anything on this page, write to us through the contact form. We have not appointed a data protection officer, because what this website processes does not reach the scale or nature that triggers that requirement under Article 37 GDPR. If that changes, we will name one here with contact details.
What we collect, and why
| What | Why | How long |
|---|---|---|
| Form entries | Your name, email address, organization, and anything else you type into the demo form or the contact form. We use it to answer you and to prepare the conversation. Nothing else. | Two years after our last contact, unless you become a customer. Then the agreement decides. |
| Which page you sent it from | Stored alongside the form entry, so we know what you were reading when you decided to write. It helps us answer better. | Same as the form entry. |
| Analytics | Only if you accept. What we set and why is listed in the cookie statement. | See the cookie statement. |
| Company recognition | Only if you accept. Leadinfo looks up which organization an IP address belongs to. It identifies companies, not people. | See the cookie statement. |
| Server logs | Our hosting provider logs requests to keep the site running and to stop abuse. We do not read them for anything else. | Short, and set by the provider. |
We do not buy personal data, we do not enrich what you gave us with data from elsewhere, and we do not sell or rent anything to anyone.
On what grounds
- Your consent, for anything that measures: analytics and company recognition. None of that loads before you say yes, and you can withdraw it at any time in the cookie statement. The typefaces are the one thing that loads either way, and they measure nothing; the table below says where they come from.
- Steps before a contract, for a demo request: you asked us for something and we cannot answer without your details.
- Our legitimate interest, for a contact request, for keeping the site available and safe, and for confirming that the service emails described below actually reached you.
Who else sees it
Only the parties we need to run the site and to reach you. We have a processing agreement with each of them.
| Who | What for | Where |
|---|---|---|
| Netlify | Hosting the website | United States, under the EU standard contractual clauses |
| Supabase | Storing the form entries | European Union, Ireland |
| Amazon SES | Sending the confirmation and the notification email | European Union, Frankfurt |
| Analytics and advertising measurement, only after you accept | United States, under Google's EU-US Data Privacy Framework certification, with standard contractual clauses in place as a fallback safeguard | |
| Leadinfo | Company recognition, only after you accept | European Union, the Netherlands |
The Data Privacy Framework is currently facing a legal challenge before European courts, so we keep the standard contractual clauses active alongside it rather than relying on the framework alone, and we will update this page if that changes.
Beyond that, we share nothing unless the law requires it.
The emails we send you
When you fill in a form you get a confirmation by email. That email is sent through Amazon SES, which adds an invisible image of one pixel and rewrites the links through awstrack.me, so an opened email and a clicked link can be counted. We do this on the basis of our legitimate interest in knowing whether a service email reached you and in improving how we follow up, not because it falls outside any consent requirement. This is separate from the cookie choice on the website itself, since that choice governs the site and this runs in your inbox instead. You can object to this at any time by writing to us through the contact form, and almost every email program can block remote images, and then the pixel never loads. The same thing is described in the cookie statement.
What you can ask us to do
Under the GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to limit what we do with it, object to it, or ask for it in a portable form. Write to us through the contact form. We answer within a month, and we will not ask you for more identification than we need.
If you think we handled it badly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We would rather you told us first, so we can put it right.
What we do not do
- No decisions about you are made automatically, and there is no profiling on this website.
- No advertising network runs here that follows you across unrelated websites, beyond the Google cookies named in the cookie statement.
- No session recording and no heatmaps. We do not watch where your mouse goes.
- This site is not aimed at children, and we do not knowingly collect anything about them.
When this page changes
The date at the top is the last revision date. If something material changes, we change this page, and the version you are reading is the one that applies.
Questions
Write to us through the contact form. A person reads it.