Privacy Policy

Responsible for data processing on this website is:

Balane GmbH
Balanstraße 84
81541 München
Germany

Email: contact@balane.tech

Hosting

Our website is hosted on Vercel with servers worldwide, including in the EU. Vercel is a US-based provider. Data transfers to the USA are based on the EU-US Data Privacy Framework.

Database

Your data is stored in a Supabase database located in Frankfurt, Germany. Supabase is also a US-based provider.

AI translation services

For translations we use several AI services:

• OpenAI (GPT models) – USA
• Anthropic (Claude) – USA
• Mistral AI (planned for the future) – France

The texts you upload are sent to these services for translation.

Translation worker

The actual translations are processed on a worker server at Fly.io in Frankfurt, Germany.

Email sending

Transactional emails (order confirmations, password resets) are sent via Brevo. Brevo is a European provider with servers in the EU.

Ticketing system

For support requests we use Zammad, an open-source ticketing system, self-hosted on a Hetzner server in Germany.

During registration

• Email address
• Password (stored encrypted)
• Registration timestamp

While using the translation service

• Uploaded files (localization files)
• Source and target languages
• Translation history
• Translation Memory (if you create a project)
• Payment information (processed by Stripe)

Automatically collected data

• IP address
• Browser type and version
• Operating system
• Time of access
• Referrer URL

We process your data for the following purposes:

• Providing the translation service
• Managing your user account
• Payment processing.
• Storage of Translation Memory to save costs
• Technical security and error analysis
• Compliance with legal data retention obligations.

You are solely responsible for the content you upload and have translated.

We do not accept liability or provide any warranty for:

• The accuracy or quality of the translations.
• The legality of the content you upload.
• Any potential copyright infringements in your content.
• The suitability of the translations for a particular purpose.

Please ensure you are authorised to process and translate the uploaded content.

Your data will be shared with:

• AI Translation Services AI translation services (OpenAI, Anthropic, DeepSeek, possibly Mistral AI) – to perform translations
• Stripe – for payment processing (servers in the EU and the USA)
• Supabase – for database usage (server in Frankfurt, operator in the USA)
• Vercel – for hosting the application (servers worldwide including the EU, operator in the USA)
• Umami Analytics – for anonymised collection of usage statistics (self-hosted on Railway in the EU)
• CRM System CRM system (Odoo) – for managing customer relationships and orders (only order data: email, order number, amount)
• Email Service Email service (Brevo) – for sending transactional emails (e.g., order confirmations, password resets)
• Fly.io – to run the translation worker (server in Frankfurt, Germany)
• Ticket System Ticketing system (Zammad) – for handling support requests (self-hosted on a Hetzner server in Germany)

We do not disclose to other third parties unless legally required.

As we use services from international providers, your data is partially transmitted to third countries:

• USA: Vercel, Supabase, OpenAI, Anthropic, Stripe, Railway, Fly.io

The USA does not have a data protection level that fully matches the GDPR. Transfers are based on the EU-US Data Privacy Framework or Standard Contractual Clauses.

Data Processing Agreements

Data Processing Agreements (DPAs) have been entered into with all processors listed above (Vercel, Railway, Supabase, Stripe, OpenAI, Anthropic, DeepSeek) under Art. 28 GDPR. They include the European Commission's Standard Contractual Clauses for the lawful transfer of data to third countries.

• User account data: As long as your account exists
• Translation orders: As long as your account exists (for technical reasons)
• Translation Memory: As long as your project exists or until manual deletion
• Payment data: 10 years (statutory retention period).
• Server logs: 7 days

To protect your data and keep our database up to date, we automatically delete inactive accounts:

• After 12 months of inactivity, your account will be marked as inactive.
• You will receive an email notification 30 days before deletion
• If there is no response, all your data (account, projects, translation memory, translation history) will be automatically deleted.
• Any login or use of the service resets the inactivity period.

This measure is designed to protect your data in accordance with the principle of data minimization (Art. 5(1)(c) GDPR).

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR): You can request access to the data we store about you.
• Right to rectification (Art. 16 GDPR): You can request correction of incorrect data.
• Right to erasure (Art. 17 GDPR): You can request the deletion of your data.
• Restriction of processing (Art. 18 GDPR): You can request a restriction of processing.
• Data portability (Art. 20 GDPR): You can receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You can object to the processing of your data.

To exercise your rights, please contact: contact@balane.tech

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

The competent supervisory authority is:
Bavarian State Office for Data Protection Supervisory Authority (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: www.lda.bayern.de

Technically necessary cookies (essential)

These cookies are required for the basic functions of the website and are set automatically:

• Session cookie: Login status and authentication
• Theme cookie: Stores your preference for light/dark mode
• Locale cookie: Stores your language setting (DE/EN)

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR)

Analytics (without cookies)

We use Umami Analytics, a privacy-friendly analytics tool, to understand and improve how our website is used. Umami Analytics is activated only after your explicit consent.

Umami Analytics

Provider: Self-hosted (Balane GmbH) on Railway, servers in the EU
Data storage: EU server (Railway)
Collected data:

• Visited pages (URLs)
• Referrer (previous page)
• Browser type and version
• Operating system
• Device type (Desktop, Mobile)
• Visit duration and interactions

Important: Umami does not store IP addresses, does not use cookies, and does not create user profiles across different websites. All data is fully anonymised.

Purpose: Analysis of user behaviour to improve our website.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
Retention period: Aggregated statistics, 24 months
More information: Umami Privacy Policy

Because Umami Analytics operates in a fully anonymised manner and does not process personal data, no separate consent is required.

Overview of all cookies

A detailed overview of all cookies we use can be found on our Cookie Policy page. Cookie policy page.

We may update this privacy policy from time to time. We will inform you of material changes by email or in-app notification.

The new privacy policy will apply on your next visit.