Get started

Privacy policy

Details supplied by the owner

This policy explains what personal data [LEGAL ENTITY: OPEN] ("LgTranslate", "we", "us") collects when you visit our website, create an account, pay us or contact us, why we collect it, who sees it, how long we keep it and what rights you have. It is written in plain language on purpose.

Two roles. For the data in this policy (our website visitors, account holders and their team, billing contacts, people who contact us) we decide how and why the data is used: we are the controller. For the content customers send us to translate, and for the visitors of a customer's translated website, the customer decides and we act on their instructions: we are the processor. That second role is covered by our Data Processing Agreement, not by this policy.

Contact. Privacy questions and requests: [OPEN: mailbox]. Postal address: [LEGAL ENTITY NAME, registered address, registration number: OPEN].

1. What we collect, why, and for how long

Data Where it comes from What we use it for Legal basis (EU/UK) How long we keep it
Web server logs of this website: IP address, page requested, time, browser type Automatically Security and fixing problems Legitimate interests Set by our hosting provider; we do not use these logs for analytics
Sign-up and log-in details: e-mail address, optional name or company You Create and secure your account Contract (steps before and during the agreement) While your account exists. Sign-ups that are never verified are deleted after 7 days
Password You Signing in Contract Only a salted, one-way hash is stored, never the password
Two-factor secret and recovery codes You Protecting Owner and Admin accounts Contract; security Secret stored encrypted; recovery codes stored hashed; until you change or remove them
Sessions Automatically Keeping you signed in Strictly necessary for the service Server-side; 30 minutes idle or 8 hours at most
Sign-up abuse controls (a keyed hash of your IP address, a hidden form field, a list of disposable e-mail domains) Automatically Stopping automated sign-ups Legitimate interests Pseudonymous counters; trimmed as they are reused. See section 8
Audit events of your account (who did what and when, truncated IP address; never secrets) Automatically Your own audit log, security, accountability Legitimate interests; contract 365 days by default (configurable)
API-key records: name, scopes, first characters, a hash of the key, last-used time You Authenticating API calls Contract Until you revoke the key
Licence records: licence key hash, plan, term, sites activated You, billing Enforcing paid plans, updates for the WordPress plugin Contract While the licence exists, then as in section 8
Billing: plan, interval, subscription status, period dates, invoice number, amounts and links. Card details are entered at our payment provider, Stripe, and never reach our servers. For Shopify stores, Shopify bills you You, payment provider Charging, invoicing, giving you the right plan Contract; legal obligation (tax and accounting records) As long as the law requires us to keep accounting records
Transactional e-mail: your address, the type of message, delivery state; a suppression list of addresses we must not write to You Verification, password reset, invoices, usage and failure alerts Contract; legitimate interests Message bodies are wiped from our outbox after sending; our e-mail provider keeps its own copy under its own retention
Support conversations You Helping you Contract; legitimate interests As long as needed to help you, then deleted or archived
Waiting list for upcoming platforms (e-mail address, platform, the wording you agreed to, time) You Telling you once when a platform is available Consent Until we have told you or you ask us to remove you. No IP address or browser details are stored
Webhook addresses and delivery logs (status, short error; no response bodies) You Delivering events you asked for Contract Delivery log 30 days
Operational logs of the service, with API keys, tokens, passwords, e-mail addresses and secret-looking values removed Automatically Running and securing the service Legitimate interests Kept briefly, as set by our hosting setup
Shopify store details: store domain, an encrypted access token, permissions granted, install and uninstall times Shopify Running the Shopify app Contract Until you uninstall, then as in section 8

We do not run analytics or advertising trackers on our website, we do not track whether you open or click our e-mails, we do not sell personal data, and we do not take decisions about people by automated means that have legal or similarly significant effects.

2. Cookies and similar technologies on our own site

Our public pages set no cookies, except that the sign-up, log-in and waiting-list forms set a security (anti-forgery) cookie. Signed-in dashboard pages use essential cookies to keep you signed in and to protect forms. We use no advertising or analytics cookies. Details are in the cookie and storage statement.

3. Visitors of a customer's translated website

When a customer's website uses LgTranslate, a visitor's browser loads a small script and translation files from the customer's own site and from content delivery networks (CDNs). Those servers see the visitor's IP address, browser type and the address of the customer's page (never the page path or query), as any web server does. What the script stores in the browser is listed exactly in the cookie and storage statement. The customer is responsible for telling its own visitors; we provide text to help. We do not use this data for our own purposes.

4. Customer content

Customers send us page text, page addresses and glossaries so we can translate them. The text is sent to the translation providers listed in our sub-processor list. Translations a customer publishes are public files. If personal data is in the source text, publishing makes it public; customers are responsible for what they publish. We do not remove personal data from text before it is sent for translation, so do not submit text that contains personal data you do not want a translation provider to see. Page addresses are stored as submitted, including any query string, so avoid personal data in addresses.

5. Who receives personal data

Only the categories below, and only as far as needed. The current list with each provider's name, purpose and data is on the sub-processor list.

  • our hosting and database provider;
  • content delivery and storage providers;
  • translation providers (for customer content only);
  • our e-mail sending provider;
  • our payment providers (Stripe; Shopify for Shopify stores);
  • the platforms where the product is installed (WordPress, Shopify), where you choose to use them;
  • professional advisers, and authorities where the law requires it.

6. International transfers

Some of these providers process data outside your country, including in the United States. Where the law requires a safeguard for transfers from the EU, UK or Switzerland, we use the standard contractual clauses or another recognised mechanism with those providers. Our hosting location and the data region for customer content are stated at the top of this page when we have set them. We do not currently offer a choice of region.

7. Your rights

Depending on where you live you may have the right to access your data, correct it, have it deleted, restrict or object to our use of it, receive it in a portable format, withdraw consent at any time, and complain to your data protection authority. To use a right, write to the privacy address above. We will check who you are, answer within one month (extendable where the law allows) and tell you if we cannot do what you ask and why.

Today, requests are handled by us by hand, not through a self-service button. You can export all of your site translations yourself at any time. Deleting an account, or all personal data about a particular person, is something we do for you on request; some records must stay for legal reasons (for example invoices), and copies at our payment and e-mail providers are removed under their own rules.

8. How long we keep data after you leave

After you cancel or your subscription lapses, your published translations keep being served and your export stays available (see the Terms of Service). On request, or after the period stated in the Terms, we delete your account and site data. Invoices and accounting records are kept as the law requires. Backups are overwritten on their normal cycle. If we have not yet written down a period for a specific record, we keep it no longer than needed for the purpose above and delete it on request unless we must keep it by law.

9. Security

We protect personal data with encryption in transit, hashed passwords and keys, encrypted secrets, mandatory two-factor sign-in for owners and admins, separation between customers, signed translation files and an audit log. Our security overview describes the measures. No system is perfectly secure. If a breach affects your data we will tell you and the authorities where the law requires.

10. Our staff and support access

Support staff use a separate back-office with mandatory two-factor sign-in. Every action needs a recorded reason and is logged. If support looks at your account on your behalf, access is read-only, limited to 30 minutes and visible in your own audit log.

11. Children

The service is for businesses and people aged 18 or over. We do not knowingly collect personal data from children.

12. Changes to this policy

When we change this policy in a way that matters to you, we will update the version and date at the top of this page and add a line to the change log below. For significant changes we will also e-mail account holders. We will update this page before we add analytics or any new use of personal data.

Change log

Version date What changed
2026-11-05 First complete version for the public launch.