Privacy policy

The data controller is MB IBS Development, trading as Devsolutely, registration code 304756667, VAT number LT100013459817, Kauno g. 3A, Vilnius, LT-03001, Lithuania.

For anything in this policy, including a request about your own data, write to [email protected].

Your email address, which is required — it is both your account name and how you sign in. A display name if you give one.

Credentials you choose to set: a password, which is stored only as a hash, and a second-factor secret if you turn two-factor authentication on. API keys are stored only as hashes, which is why we cannot show you one twice.

Where your signup came from, when your browser tells us — the referring site, the page you first landed on, and any campaign parameters on the link you arrived through.

Ordinary technical records created by running a web service: request logs and error reports, which include IP addresses.

When a customer invites a colleague, we store that person’s email address, and their name if the inviter gave one, so the invitation can be sent and accepted. This is personal data we hold about somebody who did not give it to us and may never become a user.

It is kept only for as long as the invitation is useful, and the same rights below apply to it. If you have been invited to a workspace and would rather we did not hold your address, write to [email protected] and we will remove the invitation.

The translation keys, values, languages, comments and screenshots you and your team add, and the workspaces and projects they sit in.

This is your content, not our data about you. We process it to run the service for you and to show it to the people you have given access. We do not mine it, sell it, or use it to train anything.

Screenshots deserve naming separately: they are images of your product, and they may contain whatever was on screen when you took them. Only upload what you are content to store here.

To perform our contract with you: running your account, storing your content, sending sign-in links, invites and notices about your plan.

For our legitimate interests: keeping the service secure and working, understanding aggregate usage, and knowing when somebody signs up or pays.

To meet legal obligations: invoices and VAT records have to be kept whether or not you would like them to be.

The invitation case above rests on legitimate interests rather than a contract, because there is no agreement with somebody who has not signed up — ours in running a product people can invite colleagues to, and the inviter’s in being able to.

Stripe processes payments. Card details go to Stripe and never reach us; we hold only the fact of a payment, its amount and currency.

Postmark sends transactional email — sign-in codes, invites and plan notices. Postmark retains the content of those messages for 45 days.

Heroku hosts the application and its database. Cloudflare serves the domain and stores uploaded screenshots.

Plausible provides website analytics. It is cookieless and aggregate, and does not track individuals across sites.

Google Workspace carries our own business email, which is where notices about signups and payments arrive.

If you choose to sign in with Microsoft, Microsoft confirms your identity to us. We receive your email address and whether your organisation has verified the domain it belongs to — nothing else, and only when you use that button.

If you choose to sign in with Google, Google confirms your identity to us. We receive your email address and whether Google has verified it is yours — nothing else, and only when you use that button.

The LocalizeMe application and its database run in Heroku’s EU region, which is hosted in Ireland. Your account and everything you put into the product live there.

Not all of it stays inside the EU, and it would be misleading to say otherwise. Some of the providers listed above operate outside the European Union — in particular the ones that send our email, take payments and serve uploaded images.

Where data reaches them, the transfer relies on the safeguards in their own data processing terms, which for each of them means the European Commission’s standard contractual clauses.

When you sign in we keep a token in your browser so you stay signed in. It is necessary for the app to work and is not used for advertising.

We run no advertising or cross-site tracking, and the analytics we use set no cookies.

Account and content data is kept while the account exists. Close a workspace or ask us to delete an account and it goes, apart from what we must keep.

What we must keep is billing records, for as long as tax and accounting law requires.

Sign-in links and codes expire after ten minutes, and the messages carrying them leave Postmark after 45 days.

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and object to processing we do on the basis of legitimate interests.

You do not need to ask us for your content: export is available on every plan, in JSON, PO, iOS .strings and .xcstrings, Android XML, XLIFF 1.2, Flutter .arb, Java .properties, CSV and YAML, for one language or all of them.

Write to [email protected] and we will answer within a month.

If you think we have handled your data wrongly you can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), or to the supervisory authority where you live.

If this policy changes we will update the page and the date at the top, and tell account holders by email where the change is significant.