Privacy Policy

This policy describes what Lingivio Translate does with personal data. It was written against the actual code and database schema, so where the system does something a privacy policy would not normally admit to, it is written down here instead of being left out.

Last reviewed — 2026-07-31

These documents are drafts written by the operator and reviewed against the running system. They are not legal advice, and they are subject to review by a qualified practitioner before launch.

1. Who is responsible

The controller for personal data described in this policy is Velniq Labs Ltd, a company in formation in the Republic of Cyprus. Until incorporation completes, the operator of record named in the identity block is the controller and will transfer that role to Velniq Labs Ltd on incorporation.

Because the controller is established in Cyprus, the lead supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus. We have not appointed a statutory Data Protection Officer; the data protection contact address in the identity block reaches the person responsible.

2. Your document text leaves our infrastructure

This is the single most important thing to understand before you upload anything. Translating a document means sending its text to a large language model that we do not run ourselves.

When you translate a document, the translatable text of that document — including text recognised by OCR from scanned pages and images — is sent to OpenRouter, Inc., which routes it to the model provider that serves the model we run, currently OpenAI. Both are in the United States. If you attach a glossary, your glossary terms are sent with it. The target language, any source-language hint, the formality setting and a fixed structural label per segment such as spreadsheet cell or subtitle are also sent.

What is not sent: your name, email address, account id, filename, job id, or any other identifier of you, and never the file itself. The request carries the text and nothing that ties it to you. Cells, runs and lines that consist solely of a formula, a number, a code, a URL or an email address are excluded from the request entirely. A number or code embedded inside a sentence is sent with that sentence, because the sentence has to be translated as a whole.

If your document contains information you cannot lawfully or contractually send to a US processor, do not upload it. We have no on-premises, EU-only or self-hosted translation option today, and we will not pretend otherwise.

3. What we collect and why

Account data: your email address, display name, password hash, and — if you sign in with Google — your Google account id, name and profile image, plus the tokens Google issues. We need these to create and secure your account and to let you sign back in.

Documents and their translations: the file you upload and the file we produce. These are stored in object storage, processed by our translation engine, and deleted on the schedule in section 5.

Job records: the original filename, the languages detected and requested, the options you chose, credit, page, segment, character and token counts, the model used, timing, status, and any error class. These are how the dashboard, billing and support work.

Billing data: your plan, subscription status and period, the customer and subscription identifiers issued by our merchant of record, and the full credit ledger of every grant, purchase, reservation, charge, release and refund on your account. Card details never reach us — the merchant of record handles payment.

Glossaries: the source and target term pairs you create. These are your content, and they are sent to the translation provider with any job that uses them.

Technical data: your IP address and browser user agent, recorded on each session by the authentication layer; abuse counters, which are keyed to your IP address before you sign in and to your account id or the identifier of the API key making the call once you are signed in; and server logs. Each counter is a number in a cache that expires by itself — within about two minutes for the ordinary per-minute limits, within two hours for the sign-in, sign-up and password-recovery limits, and within 48 hours for the limit on how often you can download a data export. We use these to keep accounts secure and to stop abuse.

Usage and cost telemetry: per-job counts of credits, segments, characters and tokens, the model tier used, and our own compute and model costs. We use these for spend limits, capacity planning and pricing.

Consent records: what you accepted, which version, when, and from where — the acceptance of these documents at sign-up, and any cookie choice you make while signed in. Your cookie choice is also kept in your own browser, and that copy is the one that decides what runs.

Safety records: if a scanner refuses an upload, we record that it happened — which check refused it, the scanner's own verdict label, the file name and size, your account id, and the job it belonged to — and we move the file itself to a separate quarantine area instead of deleting it on the usual schedule. The record never contains the contents of your document.

Sales enquiries: if you use the contact form, the name, work email, company, role, what you need to translate, the volume and file types you describe, whether you need API access, and the message you write. We keep it to reply to you, and a copy is emailed to our sales mailbox.

4. Legal bases

Performance of a contract: creating and running your account, translating your documents, storing and delivering the output, glossaries, credit accounting and support.

Legitimate interests: keeping the service secure, preventing abuse and fraud, rate limiting, understanding our own compute and model costs, and defending legal claims. We have balanced these against your interests and use the least data that works.

Legal obligation: retaining the records of payments and credit entitlements that tax and accounting law requires us to keep, and preserving and reporting apparent child sexual abuse material, which the law requires of a provider that becomes aware of it and which we therefore cannot delete on request.

Consent: only for non-essential cookies and similar technologies — the analytics and diagnostics we run in your browser, and the record of where you first arrived from. None of it starts until you allow it, and you can withdraw at any time as easily as you gave it. Section 15 sets out exactly what runs on consent and what does not, because the difference matters.

5. How long we keep things

Documents and translations: deleted 24 hours after the upload begins, by a cleanup job that runs every minute and removes the stored objects and the file record together. A file whose translation is still running is skipped until the job reaches a final state, so 24 hours is a floor rather than a hard ceiling; a separate sweep bounds how long a stuck job can hold a file open.

Job records outlive the file. The original filename, the language breakdown, the credit, page, segment, character and token counts, the model, the cost and the status are kept after the document itself is gone, so that your history and your invoice stay intelligible. They are kept until you delete your account.

Sessions and sign-in state: session records, including the IP address and user agent attached to them, are deleted once the session expires. Sessions last up to seven days. Short-lived sign-in verification records are deleted once they expire.

Failure diagnostics: the technical detail attached to a failed job is deleted from our database after 30 days. For a small number of unmapped errors that detail is the raw exception text from a document parser, which can contain a fragment of the document that caused it. Our database is not the only copy. The same unmapped exception is also written, with its traceback, to the log stream of the compute platform that runs the translation engine and to our hosting platform's logs. We do not redact those writes today, and we do not set those platforms' log retention — it is each provider's default. So a fragment of document content can outlive the 24 hour file window in two places: our own copy, which we delete after 30 days, and the providers' logs, whose retention we do not currently control. Redacting at the point of writing is an open item on our record of processing activities and we will state a number here once it is closed.

Cached API responses: results of the segment translation API held for safe retries are deleted 24 hours after the call.

Financial records: the credit ledger, subscription records and usage telemetry are retained for as long as tax and accounting law requires, and are pseudonymised rather than deleted when you close your account, as described in section 8.

Safety records and quarantined files: an upload refused by the malware or content check, and the record of that refusal, are deliberately kept outside the 24-hour deletion above. Where the law obliges us to report the material we keep it for at least 90 days after the report, and longer if an authority asks us to; otherwise we keep it for 30 days to investigate the abuse and then delete it. Deleting it is an action taken by a named person, never a scheduled job.

Sales enquiries: kept until we have answered and you ask us to delete them, or until we remove closed enquiries ourselves. Deleting an account does not delete an enquiry sent before the account existed; write to us and we will remove it.

6. Training

We do not use your documents, translations or glossaries to train, fine-tune or evaluate any model, and we do not sell or share them for anyone else to do so.

We should be precise about what backs that up. Nothing in our own code could train a model on your content — we have no training pipeline and no durable store of your text to train on. What we cannot enforce in code is what our translation providers do with the text we send them; that is governed by the terms and account settings we hold with them, which is a contractual guarantee rather than a technical one. If you need a contractual commitment on that point in writing, ask us.

7. Caching in the translation engine

To avoid translating and charging for the same text twice, the translation engine keeps recently translated fragments in the memory of the running process. This cache holds at most a few thousand fragments, is never written to disk or object storage, and disappears when the process restarts.

The cache is keyed on the text and the translation settings, not on the account, so two accounts translating an identical sentence with identical settings can be served the same cached result. It holds fragments of text with nothing identifying attached, it is not searchable, and because it is not durable it is not something a deletion request can address.

8. Who else processes your data

We use a small number of processors: a cloud platform for hosting, storage and the database; a compute platform that runs the translation engine and the OCR step; a model gateway and the model provider behind it; and a merchant of record for payments. Each one, what it receives, and where it processes it, is listed with a date on our Subprocessors page.

Our merchant of record is not only our processor. As the seller of record it is an independent controller for the tax, invoicing and fraud-prevention data it collects from you at checkout, under its own privacy policy.

9. International transfers

Be clear-eyed about this: processing outside the European Economic Area is the normal case here, not an exception. Our hosting runs at whichever edge location is nearest the visitor, worldwide. The translation engine runs in the United States. The model gateway and model provider are in the United States. The merchant of record processes in the UK, the EU and the United States.

These transfers rely on the European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, in each case as set out in the data processing terms we have with each provider. We do not currently offer an EU-only processing region, and we do not pin storage or compute to the EU.

10. Your rights

You have the right to access your data, to correct it, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis. You will never be treated worse for exercising any of them.

Two of these are self-serve in Settings. Export downloads a machine-readable JSON file containing your account, sessions, job history, glossaries, credit ledger, usage records, subscription records, API key metadata and consent records. Delete account erases your account as described below. Everything else, and any request you would rather make in writing, goes to the privacy contact address; we answer within one month.

The export is capped at a few thousand rows per category and tells you plainly which categories, if any, were cut short. If yours is, write to us and we will supply the rest.

11. What deleting your account actually does

Deleting your account is irreversible and is not a flag on a row. Every session and API key is revoked immediately. Every stored object under your account in our storage — uploaded files and translated outputs — is deleted. Your identity record, password hash, linked sign-in accounts, sessions, files, job records, failure diagnostics, glossaries, API keys, cached API responses and consent records are deleted from the database.

If a translation is still running when you ask, deletion cannot complete instantly: cancelling a job in flight requires the compute backend to acknowledge it, and deleting a running job's storage underneath it would strand it. Your credentials are revoked straight away and the erasure completes automatically once the job reaches a final state, normally within minutes.

Three things are deliberately kept, pseudonymised rather than deleted, because accounting and tax law requires records of payments: the credit ledger, the subscription records, and the usage and cost telemetry. Your email address and name are removed from the billing profile, and the raw payment provider payload — which is the widest set of personal data we hold about a payment — is erased. What remains is an account identifier that no longer resolves to any person, attached to amounts and dates. The customer identifier issued by our merchant of record is kept so a later refund, chargeback or tax audit can be reconciled; the merchant of record retains its own records under its own obligations regardless.

One record is created rather than deleted: the fact that an erasure was requested and completed, and when. It contains no identity and exists so we can demonstrate that we did what you asked.

One further thing survives an erasure and is not pseudonymised: a safety record and the quarantined file behind it. Where we have found apparent child sexual abuse material we are obliged to preserve it and to report it, and a deletion request cannot be a way to destroy that evidence or to shed the record of a decision we took about an account. That is the exception the law makes for a legal obligation and for the defence of legal claims, and the periods in section 5 are the limit of it. It is also why the export in section 10 does not include these records: the same law restricts what we may tell a reported account. You are not kept in the dark about the refusal itself — the upload is refused there and then, and a suspended account is told it is suspended and how to reach us.

12. Security

Traffic is encrypted in transit. Passwords are stored as hashes, API keys are stored only as hashes and the plaintext is shown once and never again, and every storage key and database query is scoped to the owning account. Uploads go directly to storage under a server-derived key, so one account cannot address another account's objects.

Uploads are checked before they are translated: every file is scanned for malware by a virus scanner that runs inside our own processing container, and a file that carries images is also checked for illegal or abusive imagery. Neither check is a guarantee — they classify apparent content and do not match against known-material hash databases — and where the image check is not available on a deployment we refuse an image-bearing upload rather than translate it unchecked. Honestly stated limits: we have no bug bounty programme yet, and our platform log retention is whatever our hosting provider applies by default. Report a suspected vulnerability or a security concern to the abuse contact address and we will respond.

13. Children

The service is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will delete it.

14. Cookies

Most of what the app stores in your browser is strictly necessary or a functional preference. Two items are analytics and are stored only if you allow that category: an opaque random identifier so a visit is counted once rather than three times, and a note of the campaign or site you first arrived from. Neither is shared with anyone and neither is used to build a profile. Our Cookie Policy lists every cookie and browser-storage item with its purpose, lifetime and category.

15. How we measure the product, and on what basis

We measure two different things under two different legal bases, and we keep them apart deliberately.

On your consent, in your browser: privacy-preserving traffic measurement from Cloudflare, a count of which pages you reached, and a note of the campaign, search engine or site you first arrived from. If you decline analytics, none of this runs — the measurement script is never placed in the page in the first place, no identifier is stored, and nothing is sent. If you withdraw later, collection stops immediately, the identifiers in your browser are deleted, and the record of where you arrived from is deleted from our database too.

On contract and legitimate interests, on our servers: the record that an account was created, that a document was submitted, that a translation finished or failed and with which error, that a checkout was started, and that a subscription was created, renewed or topped up. These are records of things you asked us to do and of what they cost and earned us; we need them to run the service, bill correctly, understand our own margins and answer tax and accounting obligations. They are not analytics cookies and they do not depend on your cookie choice, so declining analytics does not remove them and is not meant to.

What is never in either of them: the content of your documents, any text extracted from or translated in them, filenames, storage keys, glossary terms or anything you typed. The set of details an event may carry is a fixed list of short technical values — a file format, a language code, a plan name, an error class, a page count — and anything outside that list is rejected rather than trimmed, so there is no path by which document content can arrive there.

The traffic measurement is Cloudflare Web Analytics, which is cookieless: it stores nothing in your browser and reads no identifier we hold. We checked that against Cloudflare's own published description of the script rather than assuming it, and we still placed it behind your consent, because a claim we depend on is a claim we should not be the only ones bound by.

16. Changes and complaints

The current version and its effective date are always published here, and we will tell you in the app or by email before a material change takes effect. If you are unhappy with how we handle your data, please write to the privacy contact first — and you always have the right to complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the supervisory authority where you live.