What we collect, and what we refuse to.

This policy explains how Digital Socket LLC, a limited liability company formed in Delaware, United States, trading as Transglot ("Transglot", "we", "us") collects, uses, discloses and safeguards personal data when you visit the website or use the localization platform, including the editor, AI translation, the in-context editor, the REST API, the command line interface, webhooks, the delivery bundle and the marketplace connectors (together, the "Service"). It applies to visitors, to people who hold a login, to the members of an Account or a workspace and to anyone who writes to us. The capitalised terms it uses, such as User, Account, Account Owner and Billing Member, have the meanings the Terms of Service give them. It does not apply to a third party site or system you reach through a connector, which has its own policy. Using the Service means this policy applies to you.

We are the controller of the personal data we decide the purposes for: your login, your Account and workspace memberships, billing records, support conversations, marketing contacts and the operational telemetry we need to run and secure the platform. We are a processor of the personal data that happens to sit inside Customer Content, because you decide what strings to send us and why. The Data Processing Addendum governs that second role, is incorporated into the Terms of Service, and applies without anything being signed. Where a right below is one you have against a controller, exercise it against us for the first category and against the person or company that holds the Account for the second.

Login details: name, email address and a hashed password. Account details: the Account’s name, the role you hold on it, and the workspaces and roles you are given. Profile details you choose to add, such as a display name, a locale preference and a notification preference. Billing details when you subscribe: the billing contact, the billing email, the billing address, the billing country and tax identifiers, plus a payment method token held by our payment processor. We never see or store a full card number. Support and sales correspondence: whatever you write to us, plus the address you write from. Program applications: what you submit on the open source application form or the Founding Partner enquiry. Content you post inside a workspace: comments, review notes, assignments and glossary entries, which carry your name inside that workspace. A mobile number, if you choose to confirm one to unlock welcome words. We send it to our text message provider to check that it is a mobile line and to deliver a code, and we keep only a one-way fingerprint of it.

Operational telemetry: IP address, user agent, referring page, the pages and screens you open, the API endpoints you call, request identifiers, timings, queue and run outcomes, quality gate results, error traces and rate limit decisions. Usage accounting: word counts, locale counts, run counts and token counts, which is what meters your allowance. Security records: sign-in attempts and their outcome, second-factor enrolment events, token creation and revocation, role and permission changes, and SSO or SCIM events. Audit events carry the actor, the action, the target, the time and the IP address. Signup integrity signals: when you sign up, sign in (with a password or a social provider), create an Account or create a workspace, we read the network range your request came from and the random token in the tg_device cookie the Cookie Policy describes, and we store a keyed hash of each, never the address or the token itself. The pair is stored on the Account from sign-up until its welcome words are decided, with a keyed hash of the network the Account was created from. When welcome words are given, we record a keyed hash of that network and, for an address at a non-webmail email domain, of that domain, with the time of the grant, so that too many grants from one domain within 30 days or from one network within 24 hours are held for review. Where welcome words were given to an Account from a pair, the pair is also linked to a keyed hash of that Account Owner’s email address, and it is refreshed when an Owner of that Account signs in from it. We use these pairs only to refuse or review a sign-up that repeats one that already received a free allowance. Metering records counts, never the body of a request.

Customer Content is whatever you put into a project: translation keys, source strings, translations, glossaries, style guides, comments, screenshots captured by the in-context editor and the files you import. It may contain personal data, because a product string can. You decide what goes in, and the Acceptable Use Policy asks you not to submit payment card data, government identifiers, credentials or special category personal data as translatable content. We process what is in there on your instructions, under the Data Processing Addendum, and we do not go looking through it except where a report, a legal obligation or a security incident requires it.

If you sign in with a federated identity provider or with single sign-on, that provider sends us the identifiers and attributes needed to create or match your login, typically a subject identifier, an email address and a name. If you connect a repository, storage bucket, content platform or chat workspace, that system sends us the files, entries and identifiers the connector needs, using the access you granted. With optional-tracking permission, a Founding Partner link records a referral token so the partner can receive attribution; refusing does not prevent the link from opening its destination. If you permit optional tracking and arrive from a Google ad, we record the click identifier Google appended to the link, the campaign labels it carried and the page you landed on, and at that moment none of it names anybody; if you go on to sign up, it is attached to your login, which is how a signup is credited to the campaign that won it. Our payment processor sends us the status of a charge, the last four digits of a card and its expiry, a hashed fingerprint of the card, the billing country, and the tax identifiers you give it.

We use essential cookies for sign-in, security and the preferences described in the Cookie Policy. Optional analytics, session recording, affiliate attribution and advertising require a current affirmative choice everywhere, including California, the rest of the United States, the European Economic Area, the United Kingdom and Switzerland. Before acceptance, and on pages loaded with refusal or a Global Privacy Control signal, Google Analytics, Google Ads and Smartlook remain unloaded, so no cookieless measurement pings are sent through those tags. Withdrawal stops new optional events and reloads the page without those tags; it cannot recall data already sent or cancel a request already in flight. On transglot.ai, permission allows analytics, Smartlook session recording and Google advertising personalisation, including remarketing. Smartlook does not record what you type into forms and does not run inside the product. On app.transglot.ai, permission allows analytics and conversion measurement, while advertising personalisation remains disabled. Nothing placed in a project is shared for advertising. The Privacy choices and Do Not Sell or Share My Personal Information links open controls on both hosts without requiring a login. Accept and Reject optional tracking are available together. We remember the choice across our subdomains for 180 days. A Global Privacy Control signal overrides an earlier acceptance. All core features work when optional tracking is refused. The Cookie Policy explains storage, withdrawal and the limits of a browser-specific choice.

Where the GDPR or the UK GDPR applies, we rely on: performance of a contract, to create and run your login and your Account, provide the Service, meter usage, take payment and give support; legitimate interests, to secure the platform, prevent fraud and abuse, including a browser check on sign-up and workspace forms and a one-time phone check before the second part of the welcome words, or before all of them for an address at an email relay or forwarding service, to stop the same person collecting a second free allowance, trial or launch price, using the signup integrity signals, card fingerprints and identity records described in clauses 04, 06 and 15, debug and improve the Service, keep records of what happened, measure aggregate demand and send service-related messages, balanced against your interests each time; legal obligation, to keep tax and accounting records, answer lawful requests and meet regulatory duties; and consent for optional analytics, session recording and advertising in every region, and for optional marketing email where we request it, and which you can withdraw at any time without affecting what came before. Where we act as processor, the legal basis is the one the holder of the Account relies on.

We do not ask for special category personal data (health, genetic, biometric identification, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation) and the Service is not designed to hold it. We do not knowingly collect it about you as a controller. If you place it inside Customer Content you do so as controller, on your own legal basis, and you should tell us first so we can tell you honestly whether the platform is appropriate for it. Under California law we do not collect sensitive personal information for the purpose of inferring characteristics about anyone.

A translation run sends source strings and their surrounding context, in structured batches, to the AI subprocessors disclosed by category and region in our Trust Center and in the Subprocessors document, and named in the list we furnish on request under a non-disclosure agreement. That list is the authoritative record of who can process your content and in which region, and it is enforced rather than aspirational: an automated test fails our build if a translation engine becomes reachable without a disclosure row, so we cannot route your text to a vendor we have not told you about. An exact-match translation memory hit is resolved inside our own systems and is never sent to a subprocessor. A near-match hit is different, because finding one means embedding the source string first: that lookup sends the string to the embeddings subprocessor, and it runs only on a project that has turned semantic translation memory on, which is off by default. We do not use your content to train models, on any plan, and our AI subprocessors are called for inference only under commercial terms.

The Service is automated by design: it translates, it scores quality, it applies glossary and placeholder gates, and it blocks a row that fails them. Those are decisions about a string rather than about a person, and none of them produces a legal or similarly significant effect on an individual. We do not use profiling to make decisions about you, and we do not credit-score you. Automated checks can stop a sign-up: an address at a temporary inbox service is refused, a browser check asks whether a person is filling in the form, and a sign-up from the same network and browser as an Account that already received welcome words can be refused or held for review. Welcome words, trials and launch prices are also given automatically, once per Account and once per person, email address, phone number and card. If one of these checks stopped you and you think it was wrong, write to us and a person will review it. Abuse and fraud signals can lead to a suspension, and the Acceptable Use Policy gives you a human appeal against one.

Other members of the workspaces you belong to, according to their role and their project access, which is why a comment you write carries your name inside that workspace, and the Account Owners, who have access to every workspace on the Account. The service providers that run the platform on our behalf, under written terms and confidentiality obligations, in the categories set out in the Subprocessors document: AI translation, cloud hosting and database, object storage, email delivery, payment processing and support messaging. With your permission, Smartlook records how pages on this website are used, as described in clause 07, on our behalf and with storage in the European Union; it never sees the product. Two providers act on the security of sign-up and logins rather than on your content, so they are named here: Cloudflare runs the browser check (Turnstile) on sign-up and workspace forms and receives your IP address, browser signals and the page’s site key, under its Turnstile privacy addendum; Twilio receives the mobile number you confirm, to check its line type and send the code. The tools our team uses for internal communication. The endpoints you yourself register: webhooks, connectors and storage destinations receive exactly the events and content you subscribe them to, and once delivered that data is in your hands. Professional advisers under duties of confidence. Anyone a valid legal obligation requires, where we will narrow the request and tell you unless we are legally barred from doing so. A successor, if the business is acquired or reorganised, subject to this policy continuing to apply. When optional tracking is permitted, Google receives the website measurement and the conversion measurement described in clause 07 as an independent controller for its own advertising products, rather than as a provider acting on our instructions: which pages you opened, which ad brought you here, and, when you sign up or pay, a SHA-256 hash of your email address and, where a billing address gives us them, of your first and last name, alongside the postal code and the two letter country in the clear because Google will not accept those hashed. A SHA-256 hash is a one way digest that Google can match against its own records; it is pseudonymous personal information, not anonymous data. Enhanced conversions are sent only when configured and permission is current; the unhashed email address is not sent with them. We do not sell personal data for money. The disclosure to Google is sharing for cross-context behavioural advertising under United States state law, and clause 24 sets out what you can do about it. Nothing you place in a project is part of any of this.

The current subprocessor disclosure, with the purpose, the region and the condition under which each category is engaged, is published in the Trust Center and summarised in the Subprocessors document; the named vendors behind those categories are furnished on request under a non-disclosure agreement, by writing to privacy@transglot.ai. We give notice by email before a new subprocessor starts processing customer personal data, and the Data Processing Addendum gives you a right to object on reasonable data protection grounds. Several entries are conditional rather than always on: some are engaged only for paid plans, and some only when a project turns on an optional feature.

We run the platform in one cloud region, fixed at deployment, and some of our subprocessors process data in the United States and, for one optional translation engine, in Singapore. There is no per-project region pinning today and we do not sell one. Where personal data leaves the United Kingdom, the European Economic Area or Switzerland, we rely on the safeguards recognised under applicable law, principally the European Commission Standard Contractual Clauses with the UK International Data Transfer Addendum where the UK GDPR applies and with the Swiss adaptations where Swiss law applies, together with the supplementary measures described in the Data Processing Addendum. A copy of the transfer mechanism relied on for a given subprocessor is available on request. The analytics and advertising data in clause 07 reaches Google in the United States, where Google is an independent controller of it and relies on its own transfer safeguards rather than on ours.

Login, Account and workspace records: for as long as each exists, then as clause 16 describes. Billing and tax records: as long as tax and accounting law requires, and a closed Account keeps its invoices for 7 years after it closes. Support correspondence: while it is useful and then on our ordinary correspondence schedule. Project content: for as long as the project exists. Translation version history: 180 days, with a floor of the newest 20 versions per string, which survives any age, on every plan rather than as a paid tier. Notifications: 90 days. Comments: kept while a thread is unresolved, and 365 days after a thread is resolved. Activity feed: 180 days. Assistant conversations: 90 days, and deleted with the login that made them. In-context screenshots: 90 days. Connector sync run records: 90 days, keeping the most recent run per connection. Delivery bundle: the most recent 20 published versions per project and locale. Referral click records: 90 days. Ad click attribution: one row a person, holding the Google click identifier, the campaign labels it carried and the page it landed on, kept while the login exists unless optional tracking is withdrawn, when the attribution record is removed, and deleted with the login. The conversion ledger, which records what we reported to Google, when, and the hashed identifiers sent with it: kept as the record of a report we made, and detached from your login when the login is deleted. Withdrawal prevents future reports and removes identifiers from unsent conversions; it does not recall a report already sent to Google. A signed-in login’s optional-tracking choice and the time it was recorded are kept to enforce that choice, including before a queued conversion is uploaded. Unreviewed translation memory entries that were never reused: 90 days. Audit events: append-only and kept until the workspace is purged; on an Account’s own audit trail the IP address is removed after 395 days. Webhook delivery records: kept for the life of the endpoint, with no time-based prune today, so delete an endpoint to clear its history. Failed background jobs: 7 days. Expired API tokens: swept 24 hours after they lapse. Operational metrics: 30 days. Signup integrity signals: the pair and the network hash stored on an Account are removed when its welcome words are decided, and otherwise 90 days after the Account was created; a pair from which welcome words were given is kept until 90 days after it was last seen. Sign-up refusal records: 90 days. Welcome words velocity records, a keyed hash of a non-webmail email domain or of a network with the time of a grant: 30 days for a domain and 24 hours for a network. Sign-up allowlist entries, which an operator writes to let one email address or one network and browser pair past the sign-up checks: until the expiry the operator sets, never more than 365 days. An Account that was never verified and has no workspace and no payment history is deleted 30 days after it was created, unless a sign-up review of it is pending; the fingerprints described below are kept. While a sign-up review of an Account is pending, its signals and its refusal record are kept past those periods until the review is decided or the Account is deleted. Welcome words and trial records: a one-way fingerprint of each email address, login and phone number that received welcome words or a trial, kept 1,095 days from the grant, so that they are given once; a phone number’s fingerprint, and the fingerprints carried over from the welcome words records kept before Accounts existed, are kept for as long as the Service runs. The trial ledger, which holds a hashed fingerprint of the card each trial started with: 1,095 days. A card fingerprint flagged for a dispute or an unpaid invoice: 1,095 days. Backups: encrypted backups keep these identifiers for up to 3 weeks after they leave the live database. After any restore from a backup, the deletions carried out since the restored moment are applied again, login and identity deletions before the Service restarts and scheduled deletions by their next daily run, and a deletion request not yet carried out is repeated by support.

They are three different actions with different clocks, and the difference matters. Deleting your login is immediate and irreversible: your sign-in methods, notifications, saved views, assignments, assistant conversations and the record of which ad click brought you are hard deleted at once, and there is no recovery window. What you contributed inside a workspace stays with that workspace, including the comments you wrote and the record of what you did, and those can still show your name, because deleting one member must not rewrite another workspace’s history. Closing an Account cancels its subscription at once, bills any usage beyond the plan on a final invoice, and deletes every workspace on it after 30 days; the Account’s invoices are kept as clause 15 describes. Deleting a workspace makes it read only for 30 days, during which an Account Owner can cancel; after that it is purged, and projects, translations, versions, usage history, webhook deliveries, screenshots and audit events cascade out of the live database. Deleting a workspace cancels nothing, because the plan belongs to the Account. Those purges do not reach the encrypted backups behind them, which roll off on their own schedules described in clause 17. When a login received welcome words or a trial, its fingerprints are not deleted with it: they cannot be turned back into an address, a number or a card, and without them the allowance could be collected again, so they are kept for the periods in clause 15.

Transport security with TLS 1.2 or better at the edge. Passwords hashed with bcrypt at cost factor 12. Optional two-factor authentication with time-based codes and recovery codes, plus passkeys, available on every plan including Free, and a requirement for a whole workspace that an Account Owner can switch on. API tokens and delivery keys stored as SHA-256 digests and shown once at creation. Third party credentials and webhook secrets stored in encrypted columns. Outbound webhooks signed HMAC-SHA256 over the timestamp and the body. Role-based access control at workspace and project level on every plan, with per-language grants. Tenant scoping on every query, where a cross-tenant identifier answers 404 rather than 403 so existence never leaks. Rate limits on public endpoints. Append-only audit records. Encrypted database backups (retained as two full backups plus differentials with continuous write-ahead log archiving) and encrypted file backups (retained as 30 daily, 12 weekly and 12 monthly snapshots). What we do not claim: the live volumes are not disk-encrypted, there is no cryptographic hash chain over the audit log, and we hold no third party security certification today. The security page states those gaps in the same words.

We maintain an incident response process. If a personal data breach affects data we process on your behalf, we will notify the Account Owners without undue delay after becoming aware of it, with the information the Data Processing Addendum requires, and we will assist you with your own notification duties. If a breach affects data we hold as controller and is likely to result in a high risk to you, we will tell you directly and notify the relevant supervisory authority within the time the law allows. We will not condition notification on your agreement to any restriction on what you may say about it.

Depending on where you live, you may have the right to: know what personal data we hold and get a copy of it; correct data that is inaccurate or incomplete; delete it; restrict or object to processing, including profiling and direct marketing; receive it in a portable, machine readable form and have it transmitted to another controller where technically feasible; withdraw consent at any time without affecting what came before; and not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. Most login information is editable in your settings, Account Owners can manage the Account, its members and its workspaces, and workspace admins can manage members, roles and tokens; only Account Owners can delete a workspace. We will not discriminate against you for exercising a right.

Write to privacy@transglot.ai and say what you want. An opt-out through Privacy choices, Do Not Sell or Share My Personal Information, or Global Privacy Control does not require a login, proof of identity or acceptance of terms. For requests that require verification, such as access to or deletion of personal records, we will verify that the request comes from you or from someone you have authorised, using the email address of your login where we can and asking for reasonable additional information where we cannot; we ask for the minimum needed and we do not create a new identity record to answer a request. We respond within one month where the GDPR or UK GDPR applies, extendable by two further months for a complex request with an explanation, and within 45 days where United States state privacy law applies, extendable once by a further 45 days. There is no charge unless a request is manifestly unfounded or excessive. Where the personal data sits inside another customer's project content we are the processor, so we will pass the request to that customer's Account Owners and support them in answering it rather than answering it ourselves.

If you are unhappy with how we have handled your personal data, tell us first and we will try to put it right. You also have the right to complain to a supervisory authority: in the European Economic Area, the authority in the country where you live, work or where the issue arose; in the United Kingdom, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner. Nothing in this policy takes away that right or requires you to come to us first.

Where we are required to appoint an Article 27 representative for the European Economic Area, that is our EU Article 27 representative, whose details are published here once appointed and are available on request in the meantime, and for the United Kingdom our UK Article 27 representative, on the same basis. As to a data protection officer, we have not appointed a Data Protection Officer, because we are not required to. Privacy questions are handled by the team behind the address below. You can always reach a person about privacy at the address at the foot of this document.

This clause is the notice at collection required by the California Consumer Privacy Act as amended. In the last twelve months we have collected these categories of personal information: identifiers (name, email address, phone number, login and Account identifiers, IP address, one-way fingerprints of your email address and phone number, keyed hashes of the network range and the browser token a sign-up came from, and a hashed fingerprint of a payment card); customer records (billing contact, billing email, billing address, billing country and tax identifiers); commercial information (plan, subscription and payment history); internet or network activity (pages and endpoints used, request logs, device and browser information); geolocation inferred only at the coarse level an IP address gives; professional information where you tell us your role or company; and content you place in a project, which may contain any category you choose to put there. We collect it for the business and commercial purposes in clause 08, retain it for the periods in clause 15, and disclose it to the categories of recipients in clause 12. Two of those categories are also shared for cross-context behavioural advertising, as clause 24 sets out: identifiers, meaning the hashed email address sent with a conversion and the click and cookie identifiers the Google tag uses, and internet or network activity, meaning which pages you opened and which ad you arrived on. We do not collect sensitive personal information for the purpose of inferring characteristics, and we make no use of it that would trigger a right to limit.

We do not sell personal information for money. With permission, we disclose the identifiers and browsing activity described in clauses 07, 12 and 23 to Google for advertising, including cross-context behavioural advertising on this website. This is sharing under California law, even though no money is paid for the data. Such sharing began on September 8, 2026. Since October 21, 2026, optional tracking requires affirmative permission in every region; the previous outside-Europe default no longer applies. The product keeps advertising personalisation disabled even after acceptance, and project content is never shared for advertising. Select Do Not Sell or Share My Personal Information or Privacy choices on either host and choose Reject optional tracking to opt out immediately. A Global Privacy Control signal also opts you out and takes priority over an earlier acceptance. No login or identity verification is needed. The browser choice lasts 180 days across both hosts. A refusal received while signed in also blocks future server-side advertising conversions for that login until a new affirmative choice is made. You can also contact privacy@transglot.ai. We do not knowingly sell or share personal information of anyone under 16.

California residents may request to know the categories and specific pieces of personal information we collected, the sources, the business purpose and the categories of recipients; to delete personal information, subject to applicable exceptions; to correct inaccurate personal information; and to opt out of sale or sharing. We do not sell personal information for money, but permission-based advertising sharing occurs as described in clause 24. Optional tracking is off until you affirmatively accept. Use Do Not Sell or Share My Personal Information, Privacy choices, or Global Privacy Control to refuse or withdraw permission without a login or identity verification. For other rights requests, write to privacy@transglot.ai; we verify identity only to the extent required for that type of request. We will not discriminate against you for exercising a right: no price difference, no service difference and no denial of service. An authorised agent may act for you with the authority required by applicable law; for requests that require identity verification, we may ask you to verify directly.

Residents of states with comprehensive privacy laws may have rights to confirm, access, correct, delete, obtain a copy of their personal information, and opt out of targeted advertising, sale and certain profiling. The optional advertising on this website is described in clauses 07 and 24. It requires affirmative permission in every region and can be refused through Privacy choices, Do Not Sell or Share My Personal Information, or Global Privacy Control. We do not sell personal information for money or carry out profiling that produces legal or similarly significant effects. Write to privacy@transglot.ai to exercise other applicable rights or appeal a decision. We respond within the period your state allows and, if an appeal is refused, explain how to contact your attorney general.

We honour Global Privacy Control on both transglot.ai and app.transglot.ai. A Sec-GPC: 1 request header or a browser globalPrivacyControl setting of true is treated as refusal of optional analytics, session recording and advertising, everywhere. It overrides an earlier acceptance. On page loads with that signal, optional third-party tracking scripts stay unloaded. If the signal changes while a page is open, we stop new optional events and reload without those scripts. We prevent new advertising attribution and conversion reports, and remember the refusal across both hosts for 180 days. When you are signed in, the refusal is also recorded for your login so later server-side advertising conversions are blocked. A browser-only choice cannot identify another browser or an anonymous visit, so enable Global Privacy Control there or refuse tracking there too. The older Do Not Track signal is not interpreted as consent or as Global Privacy Control. All core features remain available after refusal.

The Service is a business tool, is not directed at children, and is not intended for anyone under 16. We do not knowingly collect personal data from a child. If you believe a child has given us personal data, write to the address below and we will delete it. If your own product is directed at children and you localize its strings with us, you remain the controller of whatever you place in a project and are responsible for the consents that requires.

Service messages are part of the product and are not marketing: invitations, run and review notifications, quota and billing notices, security alerts, incident notices and changes to these documents. You can tune many of them in your notification settings, and you cannot switch off the security and billing ones while you hold a login, because those are the ones you most need. Marketing email is separate, is sent only where we have a lawful basis to send it, and every one carries a one-click unsubscribe that we honour promptly.

We update this policy from time to time. When we do we change the effective date at the top and, for a change that materially affects your rights, give additional notice by email or in the console before it takes effect. We keep the superseded version available on request so you can see what changed. Continuing to use the Service after a change takes effect means the updated policy applies to you.

Privacy questions, data subject requests and anything about this policy go to privacy@transglot.ai. Vulnerability reports go to security@transglot.ai. Anything else, including contract and billing questions, goes to hello@transglot.ai. A postal address for formal correspondence is on your invoice and is available on request.