Privacy Policy
Last updated: 11 November 2026
1. Who we are
Anytranslate (anytranslate.ai) is provided by Binedge, Unipessoal Lda ("Binedge", "we"), Rua do Penedinho 50, Queijas, Portugal, VAT/NIPC PT517351498.
We have not appointed a data protection officer. For any privacy question or request, write to [email protected].
This policy explains how we process personal data under the GDPR and Portuguese law (Lei 58/2019). It goes with our Terms of Service and Data Processing Terms. Facts that are specific to Anytranslate are in the Product Schedule below.
2. When we are controller and when we are processor
- Controller: for your account data, billing data, website and analytics data, support correspondence and security logs, we decide why and how the data is used. This policy covers that data.
- Processor: for the content that customers put into the service, we process the data on the customer's behalf and on its instructions. The customer is the controller of any personal data in that content. The Data Processing Terms apply. The Product Schedule lists what this content is for Anytranslate.
If your personal data is in content added by a customer or by someone else, that customer decides how it is used and is responsible for informing you. Send your request (access, deletion and so on) to that person or organisation. We help them answer. If you send such a request to us, we pass it on to them where we can identify them, and we tell you.
3. Data we collect and why
This table covers the data for which we are controller. Data we process as processor is described in the Product Schedule.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and run your account, sign in, workspaces, members and invites | Name, email, password (stored only as a hash), organisation, members and roles, API keys (stored only as hashes), invitations, language and display settings | Contract (art. 6(1)(b)) | While your account is active. Deleted within 30 days of your request. |
| Payments, invoicing and accounting | Organisation name, billing email, plan, amounts, internal ids, payment status, invoices. We never see or store card numbers. | Contract and legal obligation (art. 6(1)(b) and (c)) | Invoices and accounting records for 10 years, as required by Portuguese tax and commercial law. |
| Service emails (confirmation, password reset, invites, billing, changes to terms) | Email address, name, message content | Contract and legitimate interest in keeping you informed about the service | While your account is active. Delivery records stay in security logs. |
| Support | Your emails to us, name, email, account details you mention | Contract and legitimate interest (art. 6(1)(f)): answering you | 3 years. |
| Security, abuse prevention and fixing faults | IP address, request path, status, timing, internal ids, technical events. We do not intentionally record the content you put into the service. | Legitimate interest (art. 6(1)(f)): keeping the service secure and working | Security logs: 90 days. |
| Understanding product use | Pageviews, a few events (for example sign up), pseudonymous user id, UTM and ref parameters, IP address and browser user agent. See section 5. | Legitimate interest. You can object. | As long as needed for the statistics. You can object at any time. |
| Handling your rights requests | Request, identification details, our reply | Legal obligation | 3 years. |
| Legal claims and legal duties | Data needed for the claim or duty | Legitimate interest and legal obligation | Until the matter is closed and limitation periods end. |
| Marketing email | Email address | Consent (art. 6(1)(a)) | Until you withdraw consent. We send no marketing email without opt-in. Service emails are not marketing. |
Providing account and billing data is necessary to use the service. Without it we cannot give you an account. You do not have to give us anything else. Data in your content is whatever you choose to add.
You can withdraw any consent you gave at any time, without affecting what was done before.
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. AI output is a suggestion, a reply or a translation, not such a decision.
4. Cookies and similar technologies
We only use storage that is strictly necessary for the service you ask for. So we do not show a cookie banner (Lei 41/2004). Our analytics is cookieless.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| access_token | Cookie | Keeps you signed in. HttpOnly, Secure, SameSite Lax. | About 15 minutes |
| auth_refresh_token | Cookie | Renews your sign in. HttpOnly, Secure, SameSite Lax. Only sent to /auth paths. | 7 days |
| sidebar_state | Cookie | Remembers whether the side menu is open. | 7 days |
| Local storage | Browser storage | Language preference, theme, active workspace, list view preferences, and an id that coordinates sign in between browser tabs. Stays on your device and is never sent to us. | Until you clear it |
5. Analytics
We use an analytics tool that we host ourselves. It is cookieless: it sets no cookies and stores nothing on your device.
- It counts pageviews and a few events, such as sign up.
- For signed-in users it receives a pseudonymous user id. It does not receive your email or name.
- It keeps only UTM and ref query parameters. The URL hash is removed.
- Your IP address and browser user agent reach our analytics server like in any web request. We use them to tell visits apart without a cookie, and we do not store them as such.
This data is pseudonymous, not anonymous. Our legal basis is legitimate interest in understanding how the product is used. You may object at any time by emailing us (see section 11).
6. AI and your content
- To provide the AI features, the relevant content is sent to third-party AI model providers so they can produce the result. The Product Schedule says what is sent. The categories of providers are listed in section 7.
- Some AI-related tools run on our own servers in the EU.
- We do not use customer content to train AI models. We only use providers whose API terms do not allow them to train on it.
- Providers keep content only as long as needed to process it and for abuse monitoring, as set by their API terms.
- If we change the AI provider, we update the list of sub-processors in our Data Processing Terms before the change takes effect.
7. Who we share data with
We do not sell personal data. We share data only with the categories of providers below, which help us run the service. Our servers (database, backend, file storage and the AI-related services we run ourselves) are in the European Union only.
| Category | Purpose | Location | Safeguard |
|---|---|---|---|
| AI model provider | AI language model: the content needed to produce a result (see the Product Schedule) | USA | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Website delivery and email provider | Website delivery, DDoS protection, sending of transactional emails | Global (US company) | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Payment provider | Payments. We share organisation name, email, internal ids and payment amount. | Netherlands (EU) | Within the EU |
| Hosting provider in the European Union | Servers, database, file storage, backups | EU | Within the EU |
We also run some tools ourselves in our EU infrastructure, so they are not separate recipients: an analytics tool and our own observability system, plus the tools named in the Product Schedule. Our observability system receives technical traces and logs (request path, status, timing, internal ids). We do not intentionally record the content you put into the service.
We may also disclose data to authorities or advisers when the law or a public authority requires it, or to defend legal claims.
The named list of sub-processors is in the Data Processing Terms. The AI provider may change. We update the list before a change takes effect and notify business customers by email at least 30 days before a new sub-processor starts.
8. International transfers
Our own servers are in the EU only. Some providers (the AI provider and the website delivery and email provider) are US companies or send data to the United States. We rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses. You can ask us for a copy of the safeguards at [email protected].
9. Retention and deletion
- While your account is active, we keep your data. You can delete individual items in the app where that feature exists.
- On request by email, we delete your account and content within 30 days.
- Deleted data may remain in backups until they rotate out, up to 90 days.
- We keep invoices and accounting records for 10 years, security logs for 90 days, support emails for 3 years and rights requests records for 3 years.
- For content we process for customers, the customer decides retention as controller. The Product Schedule gives details for Anytranslate.
10. Security
- Encryption in transit (HTTPS).
- Passwords and API keys stored only as hashes.
- Short-lived access tokens.
- Access control by organisation with roles, enforced in the database (row level security).
- Integration secrets encrypted at rest.
- Rate limiting.
- Backups taken before each deployment and kept on our servers.
- Restricted staff access.
No system is fully secure. If a breach affects you and the law requires it, we will notify you and the CNPD within 72 hours of becoming aware, when we are controller. We notify business customers whose content is affected without undue delay and within 48 hours.
11. Your rights and how to use them
You have the right to:
- access your data and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interest, including analytics;
- withdraw consent at any time, where we rely on it, without affecting earlier processing;
- not be subject to decisions based solely on automated processing with legal or similarly significant effects (we make none).
Email [email protected]. We reply within one month, free of charge. We may ask you to prove who you are. If your request is about data in a customer's content, we direct you to that customer.
You can complain to the Portuguese data protection authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, which has a complaint form on its website. You may also complain to the authority of your own country.
12. Children
Anytranslate is for people aged 18 or over. We do not knowingly collect data from minors or create accounts for them. If you think a minor has an account, tell us and we will delete it.
Product Schedule: Anytranslate
This schedule applies to Anytranslate and is part of this Privacy Policy.
Documents and translations (we are processor)
The content customers put into Anytranslate is the documents they upload, the text extracted from them, the translations produced, the language choices and the page counts. The customer who uploads a document is the controller of any personal data in it. Data in a document is whatever the customer chooses to upload. We process it only to provide the translation service, on the customer's instructions and under the Data Processing Terms.
If your personal data is in a document uploaded by someone else, send your request to that person or organisation. We will help them answer it.
AI and text recognition
- To translate, the text of the documents is sent to a third-party AI model provider. The output is a machine translation.
- Text recognition (OCR) for scans and images runs on our own servers in the EU. It is not a separate recipient.
Retention of documents and translations
- Uploaded documents and translations are kept until the customer deletes them or the account is deleted.
- Download links to files expire after about one minute.
13. Changes
We may update this policy. We will notify you by email or in the app about material changes, at least 30 days before they take effect where possible. The date at the top shows the latest version.
14. Contact
Binedge, Unipessoal Lda, Rua do Penedinho 50, Queijas, Portugal. Email: [email protected].