Privacy policy

Applicable under the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA, and comparable laws in Virginia, Colorado, Connecticut and Utah) — Last updated: 15 October 2026

To be reviewed by qualified counsel before publication. This policy covers the situations typical of an AI translation service, but must be checked against your actual practice: the processors genuinely used, your real retention periods, and whether a data protection officer or EU/UK representative needs to be appointed given your scale of processing.

1. Who we are

A project by Mila Ruana, author of fantasy novels — official biography
Email: [email protected]

For the purposes of the GDPR, we are the controller of the personal data described in this policy. Where your submitted text contains personal data about third parties (for example, real names in a manuscript or business correspondence), we act as processor for that content on your behalf — see Section 4.

2. What data we collect

Data you provide directly

• Account data: name, email address, password (stored only as a hash with salt, computed by a one-way hashing algorithm — never in plain text).
• Billing data: billing address, tax identifiers, and payment details — the latter handled entirely by our payment processor; we do not store full card numbers.
• The content of the text you submit for translation, together with any glossary terms or custom style instructions you supply.
• Anything you send us through the contact form or by email.
• Payment data: when you buy credits, the payment is processed by Lemon Squeezy, our Merchant of Record and payment provider. To complete the purchase, Lemon Squeezy collects and processes the data required for the transaction — typically your name, email address, billing address, tax identifiers, payment method and, where applicable, card details — together with technical data such as your IP address, for the purposes of processing the payment, preventing fraud, and meeting tax and accounting obligations. We do not receive or store your full card details.

Data collected automatically

• Technical and usage data: IP address, browser type, device identifiers, pages visited, timestamps, and error logs, collected for security and to keep the service running.
• Technical cookies, and — only with your consent — anonymous statistics cookies. See our cookie policy.

3. The text you submit for translation

This is the point that deserves the most care, and we want to be explicit about it.

• Never used for training. Text you submit is used exclusively to generate your translation. It is not used to train, fine-tune, or evaluate any AI model, whether operated by us or by a third-party processor.
• Limited retention. Source text and translations are retained only for as long as needed to deliver the service — by default, no longer than 90 days after your last activity on a given project, or immediately upon your request for deletion, whichever comes first.
• Limited access. Access to submitted text is restricted to the automated systems that perform the translation and to personnel who need it to maintain those systems; it is not read by staff as a matter of course.
• Sub-processors. Depending on the service tier you choose, translation may be processed on our own infrastructure or through a vetted third-party AI provider operating under a data processing agreement that prohibits use of your content for model training and requires deletion after processing. A current list of sub-processors is available on request.

If your text contains personal data about identifiable third parties, we process that data as your processor under Article 28 GDPR. Where required, we enter into the corresponding data processing agreement with you on request.

4. Why we process your data (legal bases under GDPR)

5. Who we share data with

We disclose personal data only to: staff who need it to operate the service; hosting and infrastructure providers; the AI sub-processor(s) used to perform translation, under the terms described in Section 3; our payment processor; and professional advisers (legal, accounting) where necessary. We disclose data to public authorities only where required by law.

We do not sell your personal information to third parties, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA and similar US state laws.

Where data is transferred outside the European Economic Area or the UK, we rely on the European Commission's Standard Contractual Clauses (or the UK's International Data Transfer Addendum) and equivalent safeguards required by applicable law.

Payments are processed by Lemon Squeezy, which acts as Merchant of Record. For the payment data it processes to complete the sale, Lemon Squeezy acts as an independent data controller — as the seller of record — and not as our processor: it determines how that data is used and protected, and its own privacy policy applies (see Lemon Squeezy's privacy policy). We receive only the information needed to associate the purchase with your account, such as the amount paid and the order reference. Where payment data is transferred outside the EEA or the UK, Lemon Squeezy applies the safeguards described in its own documentation.

6. How long we keep data

7. Your rights

If you are in the EU, UK, or a jurisdiction with equivalent law

Under the GDPR you may at any time:

• request access to your personal data and obtain a copy;
• request rectification of inaccurate data;
• request erasure of your data ("right to be forgotten");
• request restriction of processing;
• object to processing based on our legitimate interest;
• request data portability, in a structured, machine-readable format;
• withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

You also have the right to lodge a complaint with your local supervisory authority.

If you are a US resident (California, Virginia, Colorado, Connecticut, Utah, and comparable states)

Depending on your state of residence, you may have the right to:

• know what categories of personal information we have collected about you, and why;
• access a copy of your personal information;
• request correction of inaccurate personal information;
• request deletion of your personal information;
• opt out of the sale or sharing of personal information, and out of targeted advertising — we do not engage in either, so there is nothing to opt out of, but you may still submit a request for confirmation;
• not be discriminated against for exercising any of these rights;
• designate an authorised agent to submit a request on your behalf.

To exercise any of the rights described in this section, write to [email protected]. We will respond within the time limits required by applicable law (generally 30 days under the GDPR, 45 days under the CCPA/CPRA, extendable once where permitted). We may need to verify your identity before actioning a request.

8. Children's privacy

This service is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections, passwords stored using one-way hashing functions with salt, mandatory two-factor authentication for account access, access controls limiting who can reach submitted text, and regular backups. No system is completely immune to risk, and we cannot guarantee absolute security, but we treat this as a continuous responsibility, not a one-time checklist.

10. Changes to this policy

We will post any update to this page with a revised date. Where a change affects a purpose for which we rely on your consent, we will ask for it again before the change takes effect.

11. Contact

Questions about this policy, or about how we handle your data, can be sent to [email protected].