Privacy Policy

The data controller for this website is:

Balane GmbH
Balanstraße 84
81541 Munich
Germany

Email: contact@balane.tech

Hosting

Our website is hosted on Vercel with servers worldwide, including in the EU. Vercel is a US-based provider. Data transfer to the USA is based on the EU-US Data Privacy Framework.

Database

Your data is stored in a Supabase database located in Frankfurt, Germany. Supabase is also a US-based provider.

AI translation services

For translations we use various AI services:

• OpenAI (GPT models) – USA
• Anthropic (Claude) – USA
• Mistral AI (planned for the future) – France

The texts you upload are sent to these services for translation.

Translation worker

The actual translations are processed on a worker server at Fly.io in Frankfurt, Germany.

Email sending

Transactional emails (order confirmations, password resets) are sent via Brevo. Brevo is a European provider with servers in the EU.

Ticket system

For support requests we use Zammad, an open-source ticketing system, self-hosted on a Hetzner server in Germany.

During registration

• Email address
• Password (stored encrypted)
• Registration timestamp

When using the translation service

• Uploaded files (localisation files)
• Source and target languages
• Translation history
• Translation Memory (if you create a project)
• Payment information (processed by Stripe)

Automatically collected data

• IP address
• Browser type and version
• Operating system
• Access timestamp
• Referrer URL

We process your data for the following purposes:

• Provision of the translation service
• Management of your user account
• Payment processing.
• Storage of the Translation Memory to reduce costs.
• Technical security and error analysis
• Compliance with legal data retention obligations

You are solely responsible for the content you upload and have translated.

We do not accept liability or provide any warranty for:

• The accuracy or quality of translations
• The legality of the content you have uploaded
• Any potential copyright infringements in your content
• The suitability of translations for a specific purpose

Please ensure you are authorised to process and translate the uploaded content.

Your data is shared with:

• AI Translation Services AI translation services (OpenAI, Anthropic, DeepSeek, possibly Mistral AI) – to perform translations
• Stripe – for payment processing (servers in the EU and US)
• Supabase – for database usage (servers in Frankfurt, operator in the USA)
• Vercel – for hosting the application (servers worldwide including the EU, operator in the USA)
• Umami Analytics – for anonymised collection of usage statistics (self-hosted on Railway in the EU)
• CRM System CRM system (Odoo) – for managing customer relationships and orders (only order data: email address, order number, amount)
• Email Service Email service (Brevo) – for sending transactional emails (e.g. order confirmations, password resets)
• Fly.io – for operating the translation worker (server in Frankfurt, Germany)
• Ticket System Ticketing system (Zammad) – for handling support requests (self-hosted on Hetzner in Germany)

No data will be shared with other third parties unless we are legally obliged to do so.

As we use services from international providers, your data is partially transferred to third countries:

• USA: Vercel, Supabase, OpenAI, Anthropic, Stripe, Railway, Fly.io

The USA does not have a data protection level fully corresponding to GDPR. Transfers are based on the EU-US Data Privacy Framework or Standard Contractual Clauses.

Data Processing Agreements

With all of the processors listed above (Vercel, Railway, Supabase, Stripe, OpenAI, Anthropic, DeepSeek) data processing agreements (DPAs) have been concluded in accordance with Art. 28 GDPR. They contain the European Commission's standard contractual clauses for the lawful transfer of data to third countries.

• User account data: As long as your account exists
• Translation orders: As long as your account exists (for technical reasons)
• Translation Memory: As long as your project exists or until it is manually deleted.
• Payment data: 10 years (statutory retention period)
• Server logs: 7 days

To protect your data and keep our database up to date, we automatically delete inactive accounts:

• After 12 months of inactivity, your account will be marked as inactive
• You will receive an email notification 30 days before deletion
• If you do not respond, all your data (account, projects, Translation Memory, translation history) will be automatically deleted
• Each login or use of the service resets the inactivity period

This measure is intended to protect your data in line with the data minimisation principle (Art. 5(1)(c) GDPR).

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR): You can request access to the data we hold about you.
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data
• Restriction of processing (Art. 18 GDPR): You may request restriction of processing
• Data portability (Art. 20 GDPR): You can receive your data in a structured, commonly used and machine-readable format
• Right to object (Art. 21 GDPR): You may object to the processing

To exercise your rights, please contact: contact@balane.tech

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

The competent supervisory authority is:
Bavarian Data Protection Authority (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: www.lda.bayern.de

Technically necessary cookies (essential)

These cookies are essential for the basic functions of the website and are set automatically:

• Session cookie: Login status and authentication
• Theme cookie: Stores your preference for the light/dark mode
• Locale cookie: Stores your language setting (DE/EN)

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR)

Analytics (no cookies)

We use Umami Analytics, a privacy-friendly analytics tool, to understand and improve how our website is used. Umami Analytics is activated only after your explicit consent.

Umami Analytics

Provider: Self-hosted (Balane GmbH) on Railway, servers in the EU
Data storage: EU server (Railway)
Collected data:

• Visited pages (URLs)
• Referrer (previous page)
• Browser type and version
• Operating system
• Device type (Desktop, Mobile)
• Visit duration and interactions

Important: Umami does not store IP addresses, does not use cookies, and does not create user profiles across different websites. All data is fully anonymised.

Purpose: Analysis of user behaviour to improve our website.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
Retention period: Aggregated statistics, 24 months
More information: Umami Privacy Policy

As Umami Analytics operates fully anonymised and does not process personal data, no separate consent is required.

Overview of all cookies

A detailed overview of all cookies we use can be found on our Cookie Policy page. Cookie policy page.

We may update this privacy policy from time to time. We will notify you of material changes by email or service notification.

The new privacy policy will apply on your next visit.