Privacy Policy

The controller for data processing on this website within the meaning of the GDPR is:

Balane GmbH
Balanstraße 84
81541 Munich
Germany
Managing Director: Jonas David Höttler

Email: contact@balane.tech

We have not appointed a data protection officer; we are not legally required to do so.

On registration

• —Email address
• —Password (stored only as a cryptographic hash, never in plain text)
• —Time of registration

When using the service

• —The localization files you upload and their text content
• —Source and target languages of your orders
• —The translation memory of your projects
• —Order history, character counts and credits spent
• —API keys (stored only as a hash — you see the key itself exactly once, when it is created)

Automatically, when you open the website

• —IP address
• —Browser type and version
• —Operating system
• —Time of access
• —Referrer URL

Payment data — card numbers, bank details, PayPal accounts — never reaches our servers at any point. It is processed exclusively by Lemon Squeezy (see section 05).

Account and translation

Performance of the contract with you (Art. 6(1)(b) GDPR). Without this data we cannot provide the service.

Translation memory

Performance of the contract and legitimate interest in lowering translation costs (Art. 6(1)(b) and (f) GDPR).

Server logs and security

Legitimate interest in secure, uninterrupted operation (Art. 6(1)(f) GDPR).

Analytics

Legitimate interest in improving the website (Art. 6(1)(f) GDPR). The measurement is anonymous.

Session replay

Your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Nothing is loaded without consent.

Retention of payment records

Compliance with legal obligations under commercial and tax law (Art. 6(1)(c) GDPR).

Application

The website is hosted with Vercel Inc. (USA) and served from data centres that include EU regions. Vercel is a US provider.

Database and file storage

Your account, project and translation data, as well as uploaded files, are held with Supabase on servers in Frankfurt, Germany. The operator is a US company.

Translation worker

The translation itself runs on worker servers at Fly.io in Frankfurt, Germany.

Email delivery

Transactional emails — registration confirmations, password resets, order notifications — are sent via Brevo, with servers in the EU.

Support

For support requests we use Zammad, an open-source ticketing system that we self-host on a server at Hetzner in Germany. Your enquiries therefore do not leave the EU.

You do not buy credits from us but from Lemon Squeezy, LLC (a Stripe, Inc. company, USA). Lemon Squeezy acts as Merchant of Record — it is the seller, not our processor.

This has a data protection consequence you should know about: Lemon Squeezy is an independent controller for the processing of your payment data. We have no influence over it and conclude no data processing agreement covering it. The Lemon Squeezy privacy policy applies. Lemon Squeezy Privacy Policy

What we receive from Lemon Squeezy

After a successful purchase, Lemon Squeezy reports to us, via an interface, exactly the details we need in order to credit your balance:

• —the order number,
• —the amount paid and the package purchased,
• —your user ID in our system,
• —the payment status.

We neither receive nor store card details, bank details or billing addresses. Your invoice is issued by Lemon Squeezy.

To translate your text, we have to transmit it to an AI model. That is the core of the service and cannot be avoided.

We currently use models from OpenAI, L.L.C. (USA) exclusively, via their API. What is transmitted is the text content of your files to be translated — not your name, not your email address, not your payment data.

According to OpenAI, data submitted through the API is not used to train their models. We have concluded a data processing agreement with OpenAI pursuant to Art. 28 GDPR.

Do not upload files containing personal or confidential data that must not reach an AI service in the USA. A localization file normally contains interface strings — check that yours does too.

• —Transmission is encrypted with TLS, and storage is encrypted at rest.
• —Uploaded original files are deleted automatically after 30 days.
• —The text content remains in your project’s translation memory until you delete the memory or the project.
• —We do not use your content to train our own models and do not pass it to third parties — other than the processors named here.
• —Other customers do not get your translation memory. It is bound to your project.

We have concluded data processing agreements pursuant to Art. 28 GDPR with the following providers. They process data only on our instructions:

Vercel Inc.

Application hosting. USA, also served from the EU.

Supabase

Database and file storage. Servers in Frankfurt, provider based in the USA.

Fly.io

Translation worker. Servers in Frankfurt, Germany.

OpenAI, L.L.C.

Machine translation of text content. USA.

Brevo

Delivery of transactional email. Servers in the EU.

Hetzner Online GmbH

Infrastructure for our self-hosted services (Zammad, OpenReplay). Germany.

Railway

Infrastructure for our self-hosted analytics (Umami). EU.

Not a processor, but an independent controller

Lemon Squeezy, LLC processes your payment data as Merchant of Record on its own responsibility. There is therefore no data processing agreement, and one would not be legally correct. See section 05.

Beyond this, we do not pass your data to third parties. We do not sell data. Disclosure to authorities occurs only where we are legally obliged.

Some of the services named are based in the USA. Personal data is therefore transferred to a third country whose level of data protection does not fully match that of the GDPR.

USA

Vercel, Supabase (servers however in Frankfurt), OpenAI, Fly.io, Lemon Squeezy (as an independent controller).

EU and Germany

Brevo, Hetzner, Railway, and the servers of Supabase and Fly.io.

We base these transfers on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Despite these safeguards a residual risk remains: under certain conditions, US authorities can access data without you having a remedy equivalent to the European one. We say this plainly rather than hiding it behind a formula.

Account data

For as long as your account exists.

Uploaded files

30 days, then deleted automatically.

Translation memory

For as long as the project exists, or until you delete it.

Order data

For as long as your account exists.

Records of credit purchases

Ten years, due to retention obligations under commercial and tax law (§ 147 AO, § 257 HGB). This data is blocked from deletion.

Server logs

Seven days.

Session replay recordings

30 days.

Analytics

Aggregated and anonymous, 24 months.

We delete accounts nobody uses any more. Data minimisation under Art. 5(1)(c) GDPR is not an end in itself — it is the best protection for data nobody needs.

• —After 12 months with no login and no order, we mark an account inactive.
• —You receive an email 30 days before deletion.
• —If there is no response, we delete the account, projects, translation memories and order history.
• —Any login resets the period.

Strictly necessary cookies

These cookies are required for operation and are set without consent (§ 25(2) no. 2 TDDDG):

Session cookie

Login status and authentication.

Locale cookie

Stores your language choice (German or English).

Theme cookie

Stores your choice of light or dark appearance.

Umami — analytics without cookies

We self-host Umami on servers in the EU. Umami sets no cookies, stores no IP addresses and builds no cross-site profiles. It records pages visited, referrer, browser, operating system, device type and time on page — fully anonymised.

Because no personal data is processed, no consent is required for this. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

OpenReplay — session replay, only with consent

With your express consent we use OpenReplay to find bugs and usability problems in the application. We self-host it at Hetzner in Falkenstein, Germany. Without consent, OpenReplay is not loaded.

Recorded

Mouse movements, clicks, scrolling, navigation path, console and network errors, browser, operating system, screen size, truncated IP address, anonymous session ID.

Not recorded

Input in form fields. Passwords and payment data are masked by default.

Retention

30 days, then deleted automatically.

Legal basis

Consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Revocable at any time with effect for the future.

You can withdraw your consent at any time. An overview of all cookies and the settings are here: Cookie settings

Access (Art. 15)

You can find out what data we process about you.

Rectification (Art. 16)

You can have inaccurate data corrected.

Erasure (Art. 17)

You can request deletion of your data. You can also delete your account yourself.

Restriction (Art. 18)

You can have processing restricted.

Portability (Art. 20)

You receive your data in a common, machine-readable format. Translation memories and files can be exported by you at any time.

Objection (Art. 21)

You can object to processing based on legitimate interests.

Withdrawal (Art. 7(3))

You can withdraw consent at any time with effect for the future.

To exercise your rights, an email is enough: contact@balane.tech

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

Website: www.lda.bayern.de

We update this policy when the service or the law changes. For material changes — a new AI provider or a new processor, for instance — we notify you by email or in the service.

The current version is always on this page. The date is noted at the top.