Privacy Notice & GDPR Compliance

This Privacy Notice explains how structrans ("we", "us", or "our"), operated by Akhunzyanova Kateryna, an independent software developer based in Ukraine ("Operator"), collects, uses, processes, and protects your personal data when you visit our website, use our translation web application, interact with our edge APIs, or purchase our services.

We comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and applicable global data protection principles.

1. Roles Under Data Protection Law

Under the GDPR:

• Data Controller: Akhunzyanova Kateryna acts as the Data Controller for your account information, authentication session data, purchase history metadata, and customer support communications.
• Data Processor: When you upload source localization files or documents that may contain personal data (e.g., user interface text, customer names in documents), you act as the Data Controller of that content, and we process such content strictly as a Data Processor on your behalf pursuant to your instructions.

2. Categories of Data We Collect

1. Account & Identity Data: Email address (collected when registering or signing in via passwordless magic links), session identifiers (session_id), and timestamps.
2. Customer Content (Files Submitted for Translation): Source files (e.g., JSON, PO, XLIFF, RESX, DOCX, PPTX, PDF, etc.) containing code strings, keys, attributes, and text, as well as parsed intermediate ASTs and translated output files.
3. Billing & Transaction Metadata: Company or legal name, billing street address, and Tax / VAT identifier (collected for business invoicing and B2B reverse charge tax compliance); payment status, subscription ID, plan tier, transaction IDs, invoice history, and token quota balances. Note: We do not collect or store payment card numbers or bank account details. All payment card processing is conducted securely by our Merchant of Record, Paddle.com Market Ltd.
4. Technical & Telemetry Data: IP address, browser user-agent, operating system, edge request headers, and performance/error logs (processed at the Cloudflare edge and Sentry).

3. Lawful Bases for Processing (GDPR Article 6)

We process your data strictly under recognized legal bases:

4. Zero AI Training Guarantee & Content Confidentiality

NO MODEL TRAINING: Your uploaded files, text segments, and translated outputs are NEVER used to train, retrain, or improve machine learning or AI models (neither by us nor by our upstream inference providers).

Text segments are transmitted via encrypted, zero-data-retention commercial API gateways solely to generate the requested translations and are discarded immediately upon completion of the inference call.

5. Data Retention & File Lifecycle

We operate on a principle of strict data minimization:

• Uploaded Source Files & Translated Outputs: Stored in encrypted Cloudflare R2 object storage. Files are automatically purged within 7 days after job completion via an automated R2 lifecycle rule. You may also trigger immediate deletion from your dashboard.
• Session Cookies: Stored in Cloudflare D1 with an automated expiration of 7 days (Max-Age=604800s).
• Account Records: Retained for as long as your account remains active. Upon account deletion, personal identifiers are permanently scrubbed from our active databases within 30 days, except where retention is required by tax and accounting laws.

6. Sub-processors & Third-Party Vendors

We engage vetted third-party service providers (sub-processors) under GDPR Article 28 data processing terms:

7. Your GDPR & International Data Rights

Under Articles 15–22 of the GDPR, you have the following rights regarding your personal data:

1. Right of Access (Art. 15): Request a copy of the personal data we hold about you.
2. Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal information.
3. Right to Erasure / "Right to be Forgotten" (Art. 17): Request permanent deletion of your account and associated personal records.
4. Right to Restriction of Processing (Art. 18): Request that we limit how we process your personal data.
5. Right to Data Portability (Art. 20): Request your data in a structured, commonly used, machine-readable format.
6. Right to Object (Art. 21): Object to processing based on our legitimate interests.
7. Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing was based on consent.

To exercise any of these rights, please email us at [email protected]. We respond to all verified requests within thirty (30) calendar days without charge.

8. Cookie Notice & Tracking Technologies

We do not use marketing trackers, behavioral profiling pixels, or third-party advertising cookies. Our Service uses strictly functional and security cookies:

• session_id: Secure, HttpOnly cookie required to authenticate your account session and maintain edge API authorization (expires in 7 days).
• structrans_auth_hint: Lightweight client-readable cookie used to prevent UI flash and render authenticated dashboard states.

Because these cookies are strictly necessary for the technical operation of the Service, they do not require prior consent under the ePrivacy Directive (Directive 2002/58/EC).

9. Security Measures

We implement industry-standard technical and organizational measures (TOMs) to secure your data:

• TLS 1.3 encryption in transit across all edge routes and API communications;
• AES-256 encryption at rest for database records (Cloudflare D1) and object storage (Cloudflare R2);
• Cryptographically secure SHA-256 tokens and session hashing;
• Strict role-based least-privilege access to production infrastructure and edge keys.

10. Contact & Data Controller Information

If you have questions, concerns, or requests regarding this Privacy Notice, please contact:

• Data Controller: Akhunzyanova Kateryna (Independent Software Developer)
• Location: Ukraine
• Privacy Email: [email protected]
• Website: https://structrans.com