Privacy Policy

 

Last updated: 13 October 2025

Protecting your privacy and personal data matters to us. We process personal data in accordance with applicable laws, in particular the EU/EEA General Data Protection Regulation (GDPR), the UK GDPR and UK Data Protection Act 2018, and—where applicable—other local laws. This policy explains what we collect, why, how long we keep it, with whom we share it, and your rights.

This policy applies to the use of our website-only translation service at [yourdomain.com] (the “Website”) and related support channels, whether or not you create an account or purchase Credits.

1. Data Controller / Contact / Data Protection Officer

Controller:
Your Company Name
[Registered address]
[Country]

Privacy email: [[email protected]]
Support: [[email protected]]

(Optional) Data Protection Officer (DPO):
[Name / Provider, Address]
Email: [[email protected]]

2. Scope and Definitions

• Personal data means any information relating to an identified or identifiable natural person (GDPR Art. 4(1)).
• Service means our online translation service delivered solely via the Website.
• Credits means the prepaid website currency you buy with a payment card and spend on translations (see Terms & Conditions, Section 8).

3. What We Process When You Use the Service

3.1 Account creation and login

Data: email, password (hashed), IP address, basic device data (security logs).
Purpose: create/manage your account, secure access, prevent abuse.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (legitimate interests: security/fraud prevention).

3.2 Credits purchase and billing

Data: name, billing address, country, VAT/tax IDs (if applicable), payment token details (via payment processor), card last 4 digits & brand (masked), transaction IDs, invoices/receipts.
Purpose: process payments, keep accounting records, handle chargebacks/refunds.
Legal basis: Art. 6(1)(b) GDPR; legal obligations (tax/commerce laws).

We do not store full card numbers. Payments are handled by our processor (see Section 8.1).

3.3 Translation jobs (texts & documents)

Data: the text you submit or the files you upload; language pair; job size; character counts; timestamps; error logs; delivered output.
Purpose: provide the translation you requested; deliver files; troubleshoot failures.
Retention: we process only as necessary to perform the Service. Translated content and outputs are not retained permanently unless you enable an optional feature like “Saved translations.” By default, source and output data are removed after completion and short-term buffering for reliability (see 3.5).
Legal basis: Art. 6(1)(b) GDPR.

We do not use your content or output to train our models without your explicit consent.

3.4 Optional features (customer choice)

If you enable Saved translations, history, or glossaries, we store that content in your account until you delete it or delete your account.
Legal basis: Art. 6(1)(b) GDPR; your control in product UI.

3.5 Short-term buffering & debugging

To ensure reliability, we may hold encrypted copies of job content/output for up to 72 hours to recover failed jobs or diagnose critical errors, then auto-delete. Access is restricted and logged.
Legal basis: Art. 6(1)(f) GDPR (service reliability and security).

3.6 Support communications

Data: email, name (if provided), message content, attachments, ticket metadata.
Purpose: handle your requests, verify identity, improve service.
Legal basis: Art. 6(1)(b) GDPR (contract/steps prior), Art. 6(1)(f) GDPR (service quality).

4. Website Logs, Security, and Basic Analytics

When you visit the Website, your device sends technical data we process for security and reliability:

• date/time, IP address, user-agent (browser/OS), referrer URL, pages requested, response codes, bandwidth, diagnostic/error logs.

Purpose: ensure stability, detect abuse/bots, investigate incidents, measure basic site performance.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests: security and service quality).
Retention: security logs typically up to 14 days (longer if needed for incidents); aggregated/statistical data may be kept longer in non-identifiable form.

5. Legal Bases Summary (GDPR)

• Contract (Art. 6(1)(b)): providing the Service, account management, transactions, translation jobs, optional saved features.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, service reliability, essential diagnostics, improving support workflows.
• Consent (Art. 6(1)(a)): any model-training use of your content (off by default).
• Legal obligations (Art. 6(1)(c)): tax/accounting, responding to lawful requests.

6. How Long We Keep Data

• Account data: while your account is active; then as needed for legal retention (e.g., tax records typically 6–10 years, jurisdiction-dependent).
• Translation content/output: only as needed to perform the job; default deletion after completion and short-term buffering (see 3.5). Saved items remain until you delete them.
• Support tickets: typically 24 months, or longer if legally required or tied to a dispute.
• Security logs: typically up to 14 days, unless needed longer for incident handling.

We delete or anonymize data when no longer required.

7. Sharing Your Data (Processors and Recipients)

We do not sell your personal data. We use vetted processors to run the Service under data-processing agreements, for example:

• Payments: [Payment Processor, e.g., Stripe Payments] — processes payment data and fraud signals; may involve international transfers under appropriate safeguards.
• CDN/Security: [CDN/Security provider, e.g., Cloudflare] — protects against attacks and improves delivery; usually processes IP and header metadata.
• Support desk: [Support tool, e.g., Zendesk] — ticketing and support communications.
• Email service: [Email provider, e.g., Postmark/SendGrid] — transactional emails (receipts, password resets).
• CRM (B2B only, optional): [CRM vendor, e.g., Salesforce/HubSpot] — sales pipeline and customer communications (only if relevant).

We require processors to act only on our instructions, use appropriate security, and support GDPR compliance (e.g., SCCs or adequacy for international transfers).

We may also disclose data where required by law or to establish, exercise, or defend legal claims; or to prevent fraud, abuse, or threats to safety.

7. Sharing Your Data (Processors and Recipients)

We do not sell your personal data. We use vetted processors to run the Service under data-processing agreements, for example:

• Payments: [Payment Processor, e.g., Stripe Payments] — processes payment data and fraud signals; may involve international transfers under appropriate safeguards.
• CDN/Security: [CDN/Security provider, e.g., Cloudflare] — protects against attacks and improves delivery; usually processes IP and header metadata.
• Support desk: [Support tool, e.g., Zendesk] — ticketing and support communications.
• Email service: [Email provider, e.g., Postmark/SendGrid] — transactional emails (receipts, password resets).

   

We require processors to act only on our instructions, use appropriate security, and support GDPR compliance (e.g., SCCs or adequacy for international transfers).

We may also disclose data where required by law or to establish, exercise, or defend legal claims; or to prevent fraud, abuse, or threats to safety.

8. International Data Transfers

If we transfer personal data outside the EEA/UK, we rely on adequacy decisions (Art. 45 GDPR) or Standard Contractual Clauses (SCCs) with supplementary measures (Art. 46). Details are available on request.

9. Marketing Emails and Product Updates (Optional)

• We may send service/transactional messages (e.g., receipts, operational notices) without consent.
• We send marketing/newsletters only with your consent or as permitted under applicable law (you can opt out anytime via the unsubscribe link or by emailing [[email protected]]).
  Legal basis: Art. 6(1)(a) or Art. 6(1)(f) GDPR (soft opt-in where permitted).

10. Your Rights (EU/EEA & UK)

You have the following rights under GDPR/UK GDPR (subject to conditions/exceptions):

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”).
• Restriction of processing.
• Portability (structured, commonly used, machine-readable format).
• Objection to processing based on legitimate interests and to marketing at any time.
• Withdraw consent at any time (without affecting processing before withdrawal).

To exercise rights, contact [[email protected]]. We may need to verify your identity.

EU supervisory authority: You can lodge a complaint with your local authority (e.g., in Germany: LDI NRW). UK users can contact the ICO. We’d appreciate the chance to resolve your concerns first.

11. Children’s Data

Our Service is not intended for children under 16 (or lower age where permitted by local law). We do not knowingly collect children’s data. If you believe a child provided data, contact us so we can delete it.

12. Security

We implement appropriate technical and organizational measures (encryption in transit, access controls, least-privilege, auditing, secure development practices) to protect personal data against unauthorized access, alteration, or loss. No system is 100% secure; please use a strong, unique password and keep your account details confidential.

13. Changes to this Policy

We may update this policy from time to time. We will post the new version with a new “Last updated” date and, if changes are material, provide reasonable advance notice where required by law.

15. Regional Addenda (Enable as needed)

15.1 United Kingdom (UK GDPR)

References to GDPR include the UK GDPR and Data Protection Act 2018. UK users may contact the ICO.

15.2 California (CCPA/CPRA)

We are not a “seller” or “share[r]” of personal information as defined by CCPA/CPRA. California residents have rights to know/access, correct, delete, and opt out of “sale”/“sharing” (not applicable where we do not sell/share). Exercise rights via [[email protected]].

15.3 Other jurisdictions

We will honor local rights where applicable. Contact [[email protected]] for country-specific questions.

Contact
Your Company Name — [Registered address], [Country]
Privacy: [[email protected]]
Support: [[email protected]]