Privacy policy

Glotra is a localization platform powered by Yaxbi Software, LLC, which provides it and whose policies apply to it. In this policy “we”, “us” and “our” mean Glotra and Yaxbi Software, LLC. It covers the Glotra website, dashboard, API and SDK export endpoint (together, the “Service”).

Questions about this policy or your data go to glotra@yaxbi.com.

Account data is information about the people who use the Service — you, your teammates, the owner of your organization. We decide how it is used, and this policy describes that.

Customer content is what your organization puts into the Service: projects, translation keys, translated strings and their edit history. We process it only to run the Service for your organization, on its instructions. Each organization's content is kept in its own separate database. We don't sell it, mine it or use it to train models.

• Account details — your name, work email address, organization name, and your role in that organization. Passwords are stored only as a one-way hash; we never see or store them in plain text.
• Billing details — invoices, orders and payment history for your organization, plus the brand, last four digits and expiry date of the saved card. Full card numbers are handled by our payment processor, Stripe, and never reach our servers.
• Security and audit records — the IP address and browser user-agent of sign-ins and sessions, and a log of significant actions (for example, who changed a key, invited a member or created an API key) so your organization can see who did what.
• Communications — messages you send us, and the transactional emails we send you (invitations, password resets, receipts, renewal reminders).
• Usage analytics — which pages of our site and dashboard are visited and which features are used (for example, creating a project or downloading an export), and how often your apps fetch translations through the SDK (request counts, platform, response size and time per API key, per day). Signed-in activity is linked to your account; visits from people who aren't signed in are counted with a code derived from the IP address and browser that changes every day, so a visitor can't be followed from one day to the next. We collect it ourselves, only our staff can see it, and we use it to improve the Service. If your browser sends a Global Privacy Control or Do Not Track signal, the dashboard doesn't send usage events at all.

We do not use advertising or third-party analytics trackers, and analytics never uses cookies. The site sets one cookie, which remembers the language you chose for up to a year. The dashboard keeps your sign-in session in your browser's local storage, and it is removed when you sign out.

• To provide the Service: sign you in, enforce your organization's roles and permissions, and store and deliver your translations.
• To bill for the Service: issue invoices, charge the saved card for renewals and send receipts.
• To keep the Service secure: detect abuse, investigate incidents, and let organization owners audit activity.
• To communicate with you about your account, including service and billing notices. We don't send marketing email without your consent.
• To meet legal obligations, such as keeping financial records.

Where laws such as the GDPR apply, we rely on performing our contract with you or your organization, our legitimate interest in running a secure service, and our legal obligations.

We don't sell personal data. We share it only with service providers that help us run the Service, under contracts that limit them to that purpose:

• Hosting and databases — cloud providers that run our servers and store our databases.
• Stripe — payment processing and saved cards.
• Email delivery — the provider that sends our transactional email.
• DeepL — only when someone in your organization uses machine translation, and only the text sent for translation.

We may also share data within the Yaxbi Software, LLC group to operate the Service, if required by law, or as part of a merger or acquisition — in which case this policy continues to apply to it.

We keep account data and customer content for as long as your organization's account is active. When an account is closed we delete or anonymize its data within a reasonable period, except billing records, which we keep as long as tax and accounting law requires. Security and audit logs are kept for a limited period and then purged. Detailed usage events are deleted after 90 days; after that we keep only daily totals that identify no one. Per-key SDK delivery counts are deleted after about 13 months.

Data is encrypted in transit. Each organization's content lives in its own database, and shared records are protected by database-level row security as well as application checks. Sign-in sessions are short-lived and can be revoked. No system is perfectly secure, but we work to protect your data and will notify affected customers of a breach as the law requires.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your local data-protection authority. Email glotra@yaxbi.com and we will respond within the time the law requires.

If your account belongs to an organization, that organization controls its customer content, and we may refer requests about it to them.

Our providers may process data in countries other than yours. Where that happens we rely on appropriate safeguards, such as standard contractual clauses.

The Service is built for businesses and is not directed at children under 16. We don't knowingly collect their data.

We will update the date at the top when this policy changes, and let organization owners know by email before any material change takes effect.