Data Processing Terms

Last updated: 11 November 2026

1. Scope

These terms apply when you use Anytranslate (anytranslate.ai) as a business and your content contains personal data of third parties, such as your end customers, website visitors or staff. They apply automatically. No signature is needed.
They are part of the Terms of Service between Binedge, Unipessoal Lda ("Binedge", "we", the processor), Rua do Penedinho 50, Queijas, Portugal, VAT/NIPC PT517351498, and you ("the Customer", the controller). They meet Article 28 of the GDPR.
On data protection matters for Customer content, these terms prevail over the Terms of Service.
For personal data where Binedge is controller (account, billing, analytics, support, security logs), the Privacy Policy applies instead.
If the Customer is itself a processor for another controller, the Customer confirms it has that controller's authority for these terms, and these terms apply between us on the same basis.

2. Definitions

GDPR: Regulation (EU) 2016/679. "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR.
Customer content: the personal data in the content that the Customer or its users put into Anytranslate, or that Anytranslate receives through the Customer's channels, as described in the Product Schedule.
Product Schedule: the schedule below that sets out the processing details specific to Anytranslate. It is part of these terms.
Sub-processor: a third party we use to process Customer content.
SCCs: the standard contractual clauses approved by the European Commission for international transfers.

3. Details of the processing

The subject matter, duration, nature, purpose, types of personal data and categories of data subjects are in the Product Schedule. The processing lasts for as long as the Customer uses Anytranslate, plus the period in section 11.

The Customer is responsible for the lawfulness of the processing, for having a legal basis, and for informing data subjects (GDPR Articles 13 and 14).

4. Customer instructions

We process Customer content only on the Customer's documented instructions. These terms, the Terms of Service, and the Customer's use and configuration of Anytranslate are its instructions.
We may also process when EU or Portuguese law requires it. Unless the law forbids it, we tell the Customer first.
We tell the Customer if we think an instruction breaks data protection law.
We do not use Customer content for our own purposes. We do not sell it. We do not use it to train AI models.
Additional instructions that need extra work or cost are agreed in writing.

5. Confidentiality

We allow access to Customer content only to staff who need it to provide and support the service. They are bound by a duty of confidentiality, by contract or by law, that continues after their work ends.

6. Security measures

We apply the technical and organisational measures in Annex 1, together with any in the Product Schedule, appropriate to the risk (GDPR Article 32). We may update them if the level of protection does not fall.

7. Sub-processors

The Customer gives us general authorisation to use the sub-processors listed in Annex 2.
We bind each sub-processor by contract to data protection obligations no less protective than these terms. We stay responsible to the Customer for their performance.
We update Annex 2 and notify business Customers by email at least 30 days before a new sub-processor (including a change of AI model provider) starts processing Customer content.
The Customer may object, on reasonable data protection grounds, within that period by emailing [email protected]. We then work with the Customer to find a solution. If we cannot, the Customer may terminate the affected service and receive a pro rata refund of prepaid, unused fees. This is the only case in which prepaid fees are refunded, apart from consumer withdrawal rights.
Services we host ourselves in our EU infrastructure are not sub-processors.

8. International transfers

Our own servers, database, file storage and backups are in the EU only.
Some sub-processors are US companies. We transfer data to them only on the basis of the EU-US Data Privacy Framework certification or SCCs. Where needed we sign SCCs (module 3, processor to processor) with the sub-processor.
Where the Customer is outside the EU, the Customer and we agree that the SCCs (module 2, controller to processor) apply to any transfer to us that needs them, to the extent the law requires. Ask us at [email protected] for a signed copy.
We will not transfer Customer content to another country without a valid transfer mechanism.
The Customer authorises these transfers.

9. Assistance

Data subject requests. If a data subject contacts us about Customer content, we pass the request to the Customer without undue delay and do not answer it ourselves, unless the law requires. We provide tools and, on request, reasonable help so the Customer can answer requests for access, correction, deletion, restriction, portability and objection.
GDPR Articles 32 to 36. We help the Customer with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information we have.
We provide the information the Customer needs to show compliance with Article 28.
Help beyond what the service already offers is at reasonable cost, if it needs significant work. We tell the Customer first.

10. Personal data breach

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer content.
The notice goes to the account email and includes, as far as known: the nature of the breach, the categories and approximate number of people and records affected, likely consequences, and what we have done or propose to do. We add details as we learn them.
We act quickly to contain the breach and reduce harm.
The Customer decides whether to notify the authority (CNPD or another) and data subjects. Our notice is not an admission of fault.

11. Return and deletion

While the contract runs, the Customer can export its Customer content and delete it, as described in the Product Schedule.
After the contract ends, Customer content is available for export for 30 days. Then we delete it.
On the Customer's request, we delete Customer content within 30 days.
Deleted data may stay in backups until they rotate out, up to 90 days. It stays protected by these terms and is not used.
We may keep data where EU or Portuguese law requires it (for example invoices and accounting records, which are Binedge's own controller data), and tell the Customer what and why.
On request we confirm deletion in writing.

12. Information and audits

On request we give the Customer the information needed to show that we meet these terms.
The Customer may audit us once a year, or more often after a personal data breach affecting its data or if a data protection authority requires it. It gives 30 days' written notice, the audit runs during business hours, and the Customer pays its own costs and ours. The Customer or an independent auditor bound by confidentiality carries it out.
The audit must not disrupt our operations or expose other customers' data, our trade secrets or security-sensitive information. We may meet the request by sharing documents, answering a questionnaire or an independent report instead of an on-site visit, where that gives the same assurance.

13. Liability

Liability under these terms follows the Terms of Service, including the cap for business Customers and the cases that cannot be excluded. Nothing here limits liability to data subjects under GDPR Article 82, or between us for anything the law does not allow us to limit.

14. Governing law and courts

Portuguese law applies. We first try to settle disputes in good faith. Failing that, the courts of Lisbon (Comarca de Lisboa) have jurisdiction.

15. Duration and changes

These terms start when the Customer starts using Anytranslate with Customer content and last as long as we process it. They end when we have returned or deleted it as described in section 11. Sections that by their nature continue (confidentiality, liability, deletion) survive. We may update them under the change rules in the Terms of Service (30 days' notice for material changes) or if the law or a supervisory authority requires.

Product Schedule: Anytranslate

Item	Description
Subject matter	AI translation of the Customer's documents, keeping the layout
Duration	While the Customer uses AnyTranslate, plus the export period and backup rotation in section 11
Nature of the processing	Storage, text recognition (OCR), machine translation using third-party AI model providers, rebuilding the document with the translation, temporary download links, deletion
Purpose	To provide the translation service to the Customer
Types of personal data	Uploaded documents and their translations, which may contain any personal data the Customer chooses to upload. Names and email addresses of the Customer's account users.
Data subjects	The Customer's staff and users, and any people named in the documents
Special categories	Not required. If the documents contain them, the Customer must have a lawful basis and is responsible for that.

The Customer is responsible for the lawfulness of the documents it uploads.
Customer content is the uploaded documents and their translations. The text of documents is sent to the AI model provider in Annex 2 for translation.
During the contract, the Customer can export its documents and translations on request.
Additional security measure: download links for documents are temporary and signed, and expire after about one minute.

Annex 1. Security measures

Encryption of data in transit (HTTPS).
Passwords and API keys stored only as hashes. Short-lived access tokens.
Access control by organisation, with roles, enforced in the database (row level security).
Secrets for integrations encrypted at rest.
Rate limiting.
Backups taken before each deployment and kept on our servers.
Restricted staff access, limited to what staff need for their work, with confidentiality duties.
Servers, database, file storage and backups hosted in the EU only.
Logs and traces designed not to record the content of Customer content. Security logs are kept for 90 days.
Processes to detect, assess and handle security incidents and personal data breaches.

Annex 2. Sub-processors

Name	Purpose	Location	Safeguard
Anthropic (current AI model provider)	AI language model: Customer content sent for AI processing, as described in the Product Schedule. Its API terms do not allow training on this content.	USA	EU-US Data Privacy Framework and SCCs
Cloudflare	Website delivery, DDoS protection, sending transactional emails	Global (US company)	EU-US Data Privacy Framework and SCCs
Mollie B.V.	Payments (organisation name, email, internal ids, payment amount; no Customer content)	Netherlands (EU)	EU
Hosting provider in the European Union	Servers, database, file storage, backups	EU	EU

Not sub-processors: tools we host and run ourselves in our EU infrastructure (for example for text recognition, search, analytics and observability). If the AI model provider changes, this table is updated before the change takes effect.

Questions: [email protected].