Privacy Policy

1. Introduction

Welcome to litei18n. This Privacy Policy explains how Aevum Technology LTD. ("we", "us", or "our") collects, uses, discloses, and protects your personal data when you access or use the litei18n platform, available at https://litei18n.com and https://app.litei18n.com (collectively, the "Service").

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

2. Data Controller

The data controller responsible for your personal data is:

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Account Data

• Email address — collected during registration or OAuth sign-in, used for authentication, communication, and account recovery.
• Full name — collected during registration or provided via Google OAuth, used for display purposes within the Service.
• Avatar URL — optionally provided via Google OAuth, used for profile display.
• Hashed password — if you register with email/password, your password is cryptographically hashed and stored securely by Supabase Auth. We never store or have access to plain-text passwords.

3.2 Billing Data

• Stripe Customer ID and Subscription ID — identifiers linking your workspace to your Stripe billing account.
• Payment card data — processed and stored exclusively by Stripe, Inc. litei18n never receives, processes, or stores your credit card numbers, CVVs, or full card details. Please refer to Stripe's Privacy Policy for details.

3.3 User-Generated Content

• Translation keys and translation values that you create within your projects.
• Project names and descriptions.
• AI context and tone settings configured for translation quality.

3.4 Bring Your Own Key (BYOK) API Keys

• Google Cloud Translation API keys and Google Gemini API keys that you optionally provide for enhanced translation capabilities.
• These keys are encrypted at rest using pgcrypto and Supabase Vault. They are decrypted only at the moment of use within server-side edge functions and are never exposed to client-side code or logged.

3.5 Usage Data

• API token usage timestamps (when your API tokens were last used).
• AI translation usage counters (number of AI-translated keys per billing period).
• Workspace and project activity timestamps (creation, modification dates).

3.6 Technical Data

• IP addresses — collected automatically by Supabase Cloud infrastructure for security, rate limiting, and abuse prevention.
• JWT session tokens — ephemeral tokens managed by the Supabase SDK for session authentication. These are not persistently stored on our servers.

4. How We Collect Data

We collect personal data through the following methods:

• Directly from you — when you register an account, update your profile, create translation projects, provide BYOK API keys, or contact our support team.
• From third-party authentication providers — when you sign in using Google OAuth, we receive your email address, name, and profile picture from Google.
• Automatically — when you interact with the Service, technical data such as IP addresses and session tokens are collected by our infrastructure.
• From payment processors — Stripe provides us with billing identifiers (Customer ID, Subscription ID) to manage your subscription.

5. Legal Basis for Processing

Under the UK GDPR, we process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b)) — to provide the Service, manage your account, process translations, and handle billing. This includes storing your account data, user-generated content, and BYOK API keys.
• Legitimate interests (Article 6(1)(f)) — to maintain the security of the Service, prevent fraud and abuse, improve the Service, and enforce our Terms of Service. We balance these interests against your rights and freedoms.
• Legal obligation (Article 6(1)(c)) — to comply with applicable laws, regulations, and legal processes, including tax and accounting requirements.
• Consent (Article 6(1)(a)) — where required, such as for optional analytics or marketing communications. You may withdraw consent at any time by contacting us at [email protected].

6. How We Use Your Data

We use your personal data for the following purposes:

• Service delivery — to operate, maintain, and provide the features and functionality of litei18n, including translation management, collaboration, and release management.
• Authentication and access control — to verify your identity, manage sessions, and enforce role-based access within workspaces.
• Billing and payments — to process subscriptions, manage plan upgrades/downgrades, and coordinate with Stripe for payment processing.
• AI-powered translations — to send your translation source text and AI context settings to Google Cloud Translation API or Google Gemini API for automated translations. No personally identifiable information is included in these requests.
• Communication — to send you service-related notifications, workspace invitations, and account updates.
• Security and abuse prevention — to detect and prevent fraud, enforce rate limits, verify API token authenticity, and protect the integrity of the Service.
• Service improvement — to analyse usage patterns (in aggregate) to improve the Service's performance, features, and user experience.
• Legal compliance — to comply with applicable laws, respond to lawful requests, and establish or defend legal claims.

7. Data Storage and Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Row Level Security (RLS) — 25+ database-level security policies ensure that users can only access data within their authorised workspaces and projects.
• Encryption at rest — BYOK API keys are encrypted using pgcrypto and Supabase Vault before storage. The underlying database is encrypted at rest by the cloud provider.
• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• API token hashing — API tokens are SHA-256 hashed before storage. Raw tokens are shown only once at creation time.
• Webhook verification — Stripe webhook payloads are verified using cryptographic signature validation to prevent tampering.
• Rate limiting — per-user and per-API-token rate limiting protects against brute force attacks and abuse.
• Parameterised queries — all database queries use parameterised statements to prevent SQL injection attacks.

While we take extensive measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously review and improve our security practices.

8. Third-Party Services and Data Sharing

We share personal data with the following categories of third parties, solely to the extent necessary to operate the Service:

We do not sell, rent, or trade your personal data to any third party. We do not share your data with third parties for their own marketing purposes.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom, including the United States, where our infrastructure providers (Supabase/AWS, Stripe, Google, Railway, Sentry) maintain their servers.

Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with the UK GDPR, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).
• Transfers to countries or organisations recognised as providing an adequate level of data protection.
• Binding contractual obligations with our data processors requiring them to protect your data to equivalent standards.

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retention periods are as follows:

• Active account data — retained for the duration of your active account and use of the Service.
• Soft-deleted data — data marked for deletion (e.g., deleted projects, keys, or translations) is permanently removed by automated daily processes (cron jobs).
• Rate limit records — automatically cleaned every hour.
• Workspace invitation tokens — expire automatically after 7 days.
• Account deletion — upon your request, we initiate a 30-day grace period during which your data can be recovered. After this period, all personal data associated with your account is permanently and irreversibly deleted.
• Billing records — retained as required by applicable tax and accounting laws (typically 6–7 years in the UK).

11. Your Rights

Under the UK GDPR and other applicable data protection laws, you have the following rights regarding your personal data:

• Right of access (Article 15) — you have the right to request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — you have the right to request correction of inaccurate or incomplete personal data. You can update your profile information directly within the Service.
• Right to erasure (Article 17) — you have the right to request deletion of your personal data, subject to certain legal exceptions. You may delete your account through the Service, which initiates a 30-day grace period followed by permanent deletion.
• Right to data portability (Article 20) — you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to restriction of processing (Article 18) — you have the right to request that we restrict the processing of your personal data under certain circumstances.
• Right to object (Article 21) — you have the right to object to the processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent — where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or with your local supervisory authority.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days, as required by law. We may request additional information to verify your identity before processing your request.

11.1 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know — you have the right to know what personal information we collect, use, disclose, and sell.
• Right to delete — you have the right to request deletion of your personal information.
• Right to opt out of sale — we do not sell your personal information. As such, there is no need to opt out.
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights.

12. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such data promptly.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at [email protected] so that we can take appropriate action.

13. Cookies and Tracking Technologies

The Service uses the following cookies and similar technologies:

• Essential authentication cookies — session tokens managed by Supabase SDK, stored in your browser's local storage. These are strictly necessary for the Service to function and cannot be disabled.
• Supabase infrastructure cookies — used by Supabase Cloud for load balancing and security purposes.

We do not use third-party advertising cookies, social media tracking pixels, or behavioural analytics trackers. We do not participate in cross-site tracking or retargeting.

You can manage cookie preferences through your browser settings. Please note that disabling essential cookies may prevent the Service from functioning correctly.

14. Authentication Methods

We offer the following authentication methods:

• Email and password — your password is cryptographically hashed using industry-standard algorithms before storage. We never store plain-text passwords.
• Google OAuth 2.0 — you may sign in using your Google account. When you do so, we receive your email address, display name, and profile picture from Google. We do not receive or store your Google password.

15. Automated Decision-Making

The Service uses automated processing for AI-powered translations (via Google Cloud Translation API and Google Gemini API). This processing applies solely to your translation content and AI context settings — it does not involve profiling of individuals or automated decision-making that produces legal effects or similarly significantly affects you. You retain full control over whether to accept, modify, or reject AI-generated translations.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this Privacy Policy.
• Notify you via email or through a prominent notice within the Service prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

17. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):