Privacy basics
On this page
This page is general information. It is not legal advice. Privacy law depends on your facts, so ask a lawyer about your own site.
Who decides what#
Our working assumption, which a lawyer still has to confirm (OPEN):
- For your visitors' data, you decide why and how it is used. We act on your behalf.
- For the data of the people in your team who sign in, we decide, because it is our product.
What we store#
| Data | Notes |
|---|---|
| Text from your site and its translations | Needed to do the job. Could include personal data if your pages show it. |
| Your glossary | Terms you choose. |
| Account data | Email, name, password hash, two-factor setup. |
| Key records | Hashes and the first characters. Never the whole key. |
| Usage, audit and job records | Who did what, and when. |
| Billing data | Held by the payment provider, not by us. |
Published files are public#
Your translation files are public static files. Anyone who knows the address can read them. Do not let personal data into text that is published. Keep account, checkout and similar pages out of what is scanned.
What your visitors' browsers and our file hosts see#
See What visitors' browsers store. The hosts that serve your files see the visitor's IP address and browser details, as any web host does. Access logs are meant to be kept for a short time.
Retention#
Proposals, not decisions (OPEN): 30 days read-only after you cancel so you can export, then deletion; backups for 35 days; audit log for 12 months; file-host logs for 14 days.
Documents#
The terms of service, privacy policy, data processing agreement, sub-processor list and cookie statement are linked in the site footer. They are drafts until a lawyer has approved them, and each page says so while that is true: OPEN.
The company name, address, VAT number, contact, governing law and refund window on those pages come from one settings section. While a value is empty the page shows a visible placeholder instead of a guess. The sub-processor list names every outside service the product calls, and a test fails if the product starts calling one that is not listed. A security contact file is published at /.well-known/security.txt as soon as a contact address is set.
Where data is held#
Which region holds the data, and whether you can choose, is OPEN.