Privacy Policy
Last updated: 2026-11-02
1. Information We Collect
We collect account information you provide (such as your name and email address), the translation Content you create, import, or export (including JSON, YAML, CSV, XLIFF, gettext PO, Flutter ARB, .NET RESX, Android XML, and iOS .strings files), branch and version history, AI and machine-translation suggestions and AI review findings associated with your projects, billing details processed by our payment provider, and technical data such as IP address, browser type, and usage logs. If you or your continuous-integration (CI) pipeline upload screenshots of your application so that translators can see where each text appears, we store those screenshots together with the text positions recorded with them. Screenshots may contain personal data that was visible in the environment they were taken from, such as names or email addresses in your staging environment. We never send screenshots to AI or machine-translation providers. We also keep an audit log of security-relevant and administrative actions in your account, workspaces, and projects (such as sign-ins and failed sign-in attempts, changes to members, roles, and API tokens, branch merges, and publishing), which records who performed each action and when, together with the IP address and the browser or client user agent of the request. The audit log does not store passwords, API token values, or the text of your translations. Owners and administrators of a project or workspace can view (and, on plans that include it, export) the entries for that project or workspace, including these IP addresses and user agents; other project members see only a recent-activity summary without them, and you can view the entries for your own account. If you consent to analytics or advertising measurement, we additionally receive the measurements described in Section 10.
2. How We Collect Your Data
We collect data directly when you register, sign in, configure projects, upload or import Content, or contact support; automatically through your use of the Service, including authentication tokens and language preferences stored in your browser and the audit-log entries described in Section 1; through tools you connect to the Service, including screenshots that your continuous-integration (CI) pipeline uploads with an API token you created and, if you install the Translatize GitHub App on a repository, the repository files the app reads – only your Translatize configuration file and the locale files it names, never your other source code – together with the account, repository, and pull-request details that GitHub sends to the app; and from service providers such as our payment processor and machine-translation providers.
3. Legal Bases for Processing
Where the GDPR or similar laws apply, we process personal data on the bases of performing our contract with you, your consent where required, our legitimate interests in operating, improving, and securing the Service, and compliance with our legal obligations. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. We send service notices (such as security alerts and notices of important changes to the Service or your account) to perform our contract with you and in our legitimate interest in securing the Service. We send product update emails on the basis of your consent where you gave it, and otherwise in our legitimate interest in keeping account holders informed about the Service; you can object to them at any time, as described in Section 9.
4. How We Use Your Data
We use your data to provide and maintain the Service, authenticate you, store and process your translation Content and branches, generate AI and machine-translation suggestions, review translations with AI when your team requests it or turns on automatic AI review for a project, create translation branches and checks for your pull requests and commit translations back to them if you connect the GitHub App (by default only when someone requests it from the pull request), process payments through our payment processor, provide support, send service-related communications (including security and service notices), send product update emails about new features, improvements and tips unless you have unsubscribed or declined them at signup, and improve and secure the platform.
5. Information We Do Not Collect
We do not intentionally collect special-category or sensitive data (such as health, biometric, or political information), full payment card numbers (these are handled exclusively by our payment processor), or data from children under the age permitted by applicable law. If you provide such data within your Content, you do so on your own responsibility and contrary to this Policy and our Terms of Service.
6. Customer Responsibility for Uploaded Data
You are solely responsible for the Content you upload, import, or otherwise submit to the Service and for ensuring you have all rights and lawful bases necessary to do so. You must not upload unlawful Content or any special-category, sensitive, or otherwise restricted personal data, and you are responsible for obtaining any required consents from individuals whose data appears in your Content. Translatize does not monitor or screen Content and acts on it only as instructed by you. If you upload screenshots, take them from a staging or test environment that uses test data wherever possible, and mask any personal data that translators do not need to see. Translations you publish for over-the-air delivery are public by design: anyone who knows a distribution's address can download them, so you must not include secrets, credentials, or personal data in Content you publish this way. Our Terms of Service set out further responsibilities for over-the-air delivery (Section 15) and screenshots (Section 17).
7. Customer Backup and Verification Responsibility
While the Service provides branch and version history features, you remain responsible for maintaining your own independent backups of your translation Content and for verifying its integrity. You are also responsible for reviewing and verifying AI and machine-translation suggestions and any other output of the Service before relying on, publishing, or otherwise acting on them. Branch and version history are convenience features and are not a substitute for your own backup, retention, or quality-assurance processes, and Translatize is not responsible for any loss, corruption, or inaccuracy of Content or output that independent backups or verification would have prevented.
8. How We Share Your Data and Sub-Processors
We do not sell your personal data. We share data only with sub-processors needed to operate the Service – such as cloud hosting, our database hosting, our storage and content-delivery provider, our payment processor, email delivery and email hosting, AI and machine-translation providers, the messaging service we use for internal operational notifications (such as new sign-ups and support requests), and website analytics (Google Analytics, used on our marketing website only and only where you have consented) – and where required by law or to protect our legal rights. We engage these processors under written agreements requiring appropriate technical and organizational safeguards. We keep a current list of our sub-processors and their locations and provide it to Customers on request at privacy@translatize.com; Customers are notified of changes to it as described in Section 15. AI and machine-translation providers receive the texts to be translated or reviewed – for AI review, both the source text and its translation – together with the context the Service adds to the request, such as key names, descriptions, character limits, glossary terms, your style guide, and similar existing translations; they never receive screenshots. Our storage and content-delivery provider stores screenshots and translation files published for over-the-air delivery in the European Union, and delivers published translation files to the end users of your applications through its content delivery network (CDN). Requests that your applications send to the CDN, including the requesting device's IP address and user agent, are processed by that provider to deliver and protect those files; Translatize does not receive these request details, only aggregated request counts and data volumes per distribution and day, which we use to measure your delivery usage. Where you have consented to ad measurement, Microsoft (Microsoft Ireland Operations Limited) also receives the measurements described in Section 10; Microsoft processes them as an independent controller under its own privacy statement, not as our processor.
9. Your Data Protection Rights
Depending on your location, you have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where we act as a processor for translation Content, requests from individuals should be directed to the relevant Customer as controller. You can exercise rights regarding data for which we are the controller by contacting privacy@translatize.com. You can stop product update emails at any time, free of charge, using the unsubscribe link included in every such email or the email preferences in your account settings; this does not affect service notices, which we send while your account is active.
10. Cookies and Local Storage
Translatize relies on browser local storage for essential functions such as keeping you signed in via an authentication token and remembering your language preference. These items are necessary for the Service to function. Your authentication token is removed when you sign out or clear your browser storage; your language preference persists on your device until you change it or clear your browser storage, and is not necessarily removed on sign-out. Our public marketing website additionally uses Google Analytics 4 to measure visits, traffic sources, and clicks on calls to action. Those analytics cookies are non-essential: they are set only after you give prior consent through the banner on that website, never inside the signed-in application, and you may withdraw consent at any time through the cookie settings control. We do not use analytics for advertising or profiling. With your prior consent, our marketing website and the application also use Microsoft Advertising's Universal Event Tracking (UET) to measure which of our ads lead to visits, sign-ups and subscription purchases. We do not use it for remarketing, and our websites show no ads. For a confirmed first subscription payment we report the purchase amount to Microsoft, but never your name, email address or payment details; page addresses are sent without their query strings, and pages that carry one-time links (such as password-reset and invitation links) are never reported. UET cookies are set only after you accept, and you can withdraw consent at any time through the cookie settings control on the website or in the application – one choice covers both. Our Cookie Policy describes these items, how long they persist, and your controls in full.
11. Data Retention
We retain personal data and translation Content for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, tax, or accounting obligations, after which it is deleted or anonymized. You may request deletion of your account and associated Content, subject to retention we are legally required to maintain. Some data has its own retention periods. Screenshots: an automatically captured screenshot is deleted 7 days after a newer capture of the same screen replaces it, unless a team member has linked it to a translation key by hand, in which case it is kept until its last link is removed; a captured screenshot that is linked to no translation key is deleted 30 days after it was captured or after its last link was removed, whichever is later; manually uploaded screenshots are kept until you delete them, and deleting a project deletes all of its screenshots. Audit log: entries are kept for 30 days on the Free plan, 90 days on Starter, 180 days on Professional, and 365 days on Agency – according to the plan, at the time the entry is recorded, of the account that pays for the project or workspace concerned, or of your own account for entries about your account – and are then deleted automatically; entries about actions taken by our administrators are kept for 365 days. Over-the-air delivery: for each distribution we keep the files of the 20 most recent published versions (and of the version being served, if you rolled back to an older one) and delete the files of older versions; deleting a distribution or its project deletes all of its published files, but copies that applications or other parties have already downloaded are outside our control.
12. Security
We use technical and organizational measures such as encryption in transit, access controls, and token-based authentication to protect your data, but no method of transmission or storage is 100% secure and Translatize cannot guarantee absolute security. Data is provided to and stored with the Service at your own risk. Subject to Section 16 (Limitation of Liability) and to liability that cannot be excluded under applicable law, Translatize is not liable for unauthorized access, disclosure, alteration, or loss of data. Where Translatize acts as a processor, it will notify the relevant Customer (as controller) of a personal data breach affecting that Customer's data without undue delay, and the Customer is responsible for any notification to affected individuals or supervisory authorities; where Translatize acts as the controller, it will notify affected individuals and authorities as required by applicable law.
13. Disclaimer of Warranties
The Service, including all branch and version-history features and all AI and machine-translation suggestions and output, is provided on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind, whether express, implied, or statutory. To the maximum extent permitted by applicable law, Translatize disclaims all implied warranties, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement, as well as any warranty as to the accuracy, completeness, quality, reliability, or fitness of AI and machine-translation suggestions and output. AI and machine-translation output is generated automatically, may contain errors or inaccuracies, and is provided only as a suggestion; you are solely responsible for reviewing and verifying it before relying on it, and you assume all risk arising from your use of and reliance on the Service and any such output. Translatize does not warrant that the Service will be uninterrupted, secure, error-free, or that any defect will be corrected. Some jurisdictions do not allow the exclusion of certain warranties, so some of these exclusions may not apply to you.
14. Service Availability and Changes
Translatize does not guarantee any particular level of availability or uptime for the Service. We may modify, update, suspend, restrict, or discontinue the Service or any of its features, in whole or in part, at any time, with or without notice, and we are not liable to you or any third party for doing so. We will use reasonable efforts to provide notice of material changes that significantly affect your use of the Service where practicable.
15. Controller and Processor; Data Processing Terms
For the translation Content and Authorized-User data within a Customer's projects, the Customer is the data controller and Translatize acts as processor, processing such data only on the Customer's documented instructions, including as set out in this Policy and any applicable order or agreement. For account, billing, and Service usage data, Translatize is the controller. Where Translatize acts as a processor and where required by applicable law, this Policy together with any executed data processing agreement ("DPA") forms the parties' Article 28 (GDPR) processor terms; the DPA will govern in the event of any conflict with this Policy as to processor obligations. Such terms address Translatize's processing on documented instructions, confidentiality, security measures, the engagement of sub-processors (for which the Customer provides general authorization subject to Translatize giving notice of changes and the Customer's right to object on reasonable data-protection grounds), assistance to the Customer with data-subject requests and breach notification, deletion or return of Content on termination, and the making available of information reasonably necessary to demonstrate compliance, subject to confidentiality and reasonable limits on audits. A Customer that requires a separate signed DPA may request one by contacting privacy@translatize.com.
16. Limitation of Liability
To the maximum extent permitted by applicable law, and except for liability that cannot be excluded or limited by law: (a) Translatize, its affiliates, and its suppliers will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, anticipated savings, data, translations, or Content, business interruption, or cost of substitute services, arising out of or relating to privacy, data protection, security, the Service, or this Policy, whether based in contract, tort (including negligence), strict liability, or any other theory, even if Translatize has been advised of the possibility of such damages; and (b) Translatize's total aggregate liability arising out of or relating to privacy, data protection, security, the Service, or this Policy will not exceed the greater of (i) the total amounts you paid to Translatize for the Service in the twelve (12) months immediately preceding the event giving rise to the liability, or (ii) one hundred US dollars (USD $100). This is the same aggregate liability cap as, and is to be read consistently with, Section 11 (Limitation of Liability) of our Terms of Service. The limitations and exclusions in this Section apply even if any limited remedy fails of its essential purpose. Nothing in this Policy excludes or limits liability that cannot be excluded or limited under applicable law, including liability for damage caused intentionally or through gross negligence, for death or personal injury caused by negligence, or for fraud, or affects the mandatory rights of consumers.
17. Customer Indemnification
To the maximum extent permitted by applicable law, you agree to defend, indemnify, and hold harmless Translatize, its affiliates, and their respective officers, directors, employees, and agents from and against any third-party claims, demands, proceedings, losses, liabilities, damages, fines, penalties, costs, and expenses (including reasonable legal fees) arising out of or relating to the Content you upload, import, or submit to the Service; your violation of this Policy, the Terms of Service, or applicable law; your failure to obtain any required rights or consents for personal data within your Content; or your upload of unlawful, special-category, sensitive, or otherwise restricted data. Translatize will give you reasonable notice of any such claim, and you may not settle any claim in a way that imposes any obligation or admission on Translatize without its prior written consent.
18. International Data Transfers
Where personal data is transferred across borders, including to sub-processors located outside your jurisdiction, we rely on appropriate safeguards such as standard contractual clauses or other lawful transfer mechanisms to protect it in line with applicable law. This includes analytics data processed by Google and the ad-measurement data Microsoft receives as an independent controller (Section 8), which may be transferred to the United States under Google's and Microsoft's own transfer mechanisms; declining those cookies prevents that transfer entirely. The delivery network of our storage and content-delivery provider is global: published translation files are cached in, and requests for them are answered by, its data centres around the world, including outside the EEA, and the provider is based in the United States. Screenshots and the stored copies of published files remain stored in the European Union. The provider processes personal data under its data processing terms, which include the EU standard contractual clauses. While we require our processors to maintain appropriate safeguards, and subject to Section 16 (Limitation of Liability), Translatize is not liable for the acts or omissions of third-party processors beyond those contractually agreed safeguards.
19. Force Majeure
Translatize is not liable for any failure or delay in performing, or for any unavailability, interruption, or degradation of, the Service or its obligations under this Policy to the extent caused by events beyond its reasonable control, including acts of God, natural disasters, fire, flood, epidemic or pandemic, war, terrorism, civil unrest, labor disputes, governmental action, failures or interruptions of the internet, telecommunications, hosting, power, or other utilities, denial-of-service or other attacks, and the acts or omissions of third-party providers. Translatize will use reasonable efforts to resume performance as soon as practicable.
20. Severability
If any provision of this Policy is held to be invalid, illegal, or unenforceable by a court or other authority of competent jurisdiction, that provision will be deemed modified to the minimum extent necessary to make it valid and enforceable while preserving the parties' original intent, and in particular any limitation, exclusion, or disclaimer of liability or warranty that is held unenforceable will be reduced or narrowed to the maximum protection permitted by applicable law rather than struck in its entirety. If such modification is not possible, the provision will be severed, and the remaining provisions of this Policy will continue in full force and effect.
21. Governing Law and Dispute Resolution
This Policy, and any dispute or claim arising out of or relating to it or to our processing of your personal data, is governed by and construed in accordance with the laws of the Republic of Latvia, without regard to its conflict-of-laws rules, and the courts of the Republic of Latvia will have jurisdiction over any such dispute. Nothing in this section deprives you, where you are a consumer, of the protection afforded by the mandatory provisions of the law of your country of residence in the European Union, or of your rights under the GDPR, including the right to lodge a complaint with your supervisory authority.
22. Changes to This Policy
We may update this Privacy Policy from time to time and will post the new version with an updated effective date; for material changes we will provide additional notice. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy.
23. How to Contact Us
The controller of your personal data is SIA "MICRON", a limited liability company (sabiedrība ar ierobežotu atbildību) registered in the Republic of Latvia under registration number 42103081578 (registered on 7 November 2017), VAT number LV42103081578, with its registered office at Aldaru iela 36/38 – 21, Liepāja, LV-3401, Latvia. For privacy questions or to exercise your rights, contact privacy@translatize.com, or our support team at support@translatize.com for general assistance. If you are in the EEA or UK, you may also lodge a complaint with your local data protection authority; in Latvia, this is the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).