Privacy Policy

This Privacy Policy describes how Doclator ("we", "us", or "our") collects, uses, stores, and protects personal information when you visit our website at doclator.com or use our AI-powered document translation service (the "Service").

We take your privacy seriously. This policy explains what data we collect, why we collect it, who we share it with, and the rights you have over your personal information. By using Doclator, you agree to the practices described here.

If you do not agree with this Privacy Policy, please do not use the Service.

1. Who We Are

Doclator is a Software-as-a-Service (SaaS) platform that uses artificial intelligence (AI) to translate documents (including Excel, Word, PDF, PowerPoint, EPUB, SubRip subtitle, and JSON files) between more than 100 languages while preserving the original formatting.

The Service is operated by the entity registered as the Doclator brand owner. For all data protection inquiries, you may contact our Data Protection point of contact at privacy@doclator.com.

2. Information We Collect

We collect several categories of information to operate, secure, and improve the Service:

2.1 Account Information

• Username and email address
• Display name and profile avatar URL (optional)
• Hashed password (we never store passwords in plaintext; passwords are hashed with bcrypt)
• OAuth identifiers when you sign in with Google or Microsoft (we receive your name, email, and a provider-specific ID — never your provider password)
• Authentication tokens (a custom JWT access token and an opaque refresh token), stored in your browser's local storage
• Session identifier used to enforce our single-active-device policy

2.2 Translation Content

• Files you upload for translation (PDF, DOCX, XLSX, PPTX, EPUB, SRT, JSON)
• Source and target language selections
• Translation options: tone, style, domain, custom glossaries, custom prompts
• The translated output we generate from your files
• Custom glossaries (term pairs) and custom prompts you create
• Custom AI provider API keys you optionally connect (encrypted at rest with AES-256-GCM)

2.3 Usage and Technical Data

• Translation job metadata: file name, file type, status, progress, total and translated text units, token usage, error messages
• Device and browser information: IP address, user agent, referrer URL, screen size
• Log data: API request paths, timestamps, response codes, latency
• Error reports captured by our crash-monitoring service when something breaks

2.4 Payment Information

• Subscription plan, billing cycle, plan expiry date
• Payment provider customer ID (Stripe, Lemon Squeezy, or Paddle)
• Payment records: amount, currency, status, provider, idempotency token
• We do not store your full credit card number, CVV, or bank credentials. These are handled directly by our PCI-DSS-compliant payment processors.

2.5 Cloud Integration Data (optional)

• OAuth access and refresh tokens for Google Drive and Microsoft OneDrive (when you choose to connect them)
• Account email and display name from the connected cloud provider
• File names and IDs retrieved when you browse your cloud drive within Doclator

3. Guest Users

You may use a limited version of the Service without registering an account. Guest uploads are subject to file-size and daily quantity limits, and the resulting translation files are automatically deleted after 24 hours along with their associated metadata. We use a guest identifier header and IP-based rate limits to enforce the daily quota; no permanent guest profile is created.

4. How We Use Your Information

We process your data only for the purposes listed below:

• To provide the Service: create your account, authenticate sessions, upload, translate, and deliver your documents.
• To process payments: create checkout sessions, manage subscriptions, send receipts, and handle refunds via our payment providers.
• To send service messages: notify you about translation completion, payment receipts, security alerts, and material changes to our terms or this policy.
• To prevent fraud and abuse: detect bots, enforce rate limits, investigate disputed payments, and protect the integrity of the Service.
• To improve the Service: analyze aggregated usage patterns, debug errors, and prioritize new features. We never read individual user files for analytics.
• To comply with the law: respond to lawful requests from authorities, enforce our Terms of Service, and meet our regulatory obligations.

We do not sell, rent, or trade your personal information. We do not use your translation content to train our own AI models.

5. AI Translation Providers

To produce translations, the text content of your files is sent to one or more third-party large-language-model (LLM) providers. The active provider for each job depends on the plan, language pair, and any custom AI key you have configured. Providers may include:

• OpenAI (GPT family models)
• Anthropic (Claude family models)
• Google (Gemini family models)
• OpenRouter and other model aggregators

Each provider operates under its own privacy policy. We select providers that offer enterprise-grade data handling commitments — in particular, that your text is not used to train their public models when accessed through their paid API. However, the providers may temporarily retain inputs and outputs for abuse-monitoring purposes (typically 30 days) before deletion.

If you connect your own AI provider API key (Pro feature), your translation requests are sent under your own account with that provider, and their data-handling terms apply directly between you and the provider.

6. Service Providers and Sub-Processors

We rely on the following infrastructure providers to deliver Doclator. They process data on our behalf under written agreements and may only use it to provide their services to us:

We may add or change sub-processors as the Service evolves. Material changes will be reflected in this policy.

7. Data Retention

• Uploaded source files and translated outputs: stored in Cloudflare R2 and automatically deleted 24 hours after the job completes for guest users. For registered users, files are retained until you delete them or close your account, after which they are removed within 30 days.
• Account data: retained for as long as your account is active. When you delete your account, your profile, glossaries, prompts, and stored AI keys are removed within 30 days.
• Job history metadata: retained for up to 24 months after job completion for analytics, billing reconciliation, and audit. Personally identifiable details are anonymized after that window.
• Payment records: retained for at least 7 years for tax, accounting, and audit obligations.
• Backups: encrypted snapshots are retained for up to 30 days for disaster recovery; deletion requests propagate to backups within that window.
• Logs: server and security logs are retained for up to 90 days.

8. How We Protect Your Data

• All traffic between your browser and Doclator is encrypted with TLS 1.2 or higher.
• Files at rest in object storage are encrypted with AES-256.
• Custom AI provider API keys are encrypted with AES-256-GCM before being stored.
• Database access is restricted to the production application via short-lived credentials.
• Multi-tenant queries are filtered by user identifier on the server side; we use Row-Level Security policies for realtime channels.
• Passwords are hashed with bcrypt and never stored or logged in plaintext.
• JWT secrets and webhook signing secrets are rotated when compromised.
• Single-active-device session enforcement limits the impact of stolen tokens — logging in from a new device invalidates the prior session.

No system is perfectly secure. If you suspect that your account has been compromised, please email security@doclator.com immediately.

9. International Data Transfers

Doclator is built on global infrastructure. Your information may be transferred to, stored in, and processed in countries other than the one in which you reside, including the United States, the European Union, the United Kingdom, Singapore, and Vietnam. Where required by law, we rely on Standard Contractual Clauses or equivalent safeguards approved by the relevant data-protection authorities.

10. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or incomplete.
• Deletion: ask us to delete your account and the personal information associated with it (subject to legal retention requirements).
• Portability: receive your data in a structured, machine-readable format.
• Restriction or objection: ask us to limit how we use your data, or object to certain types of processing.
• Withdraw consent: where processing relies on consent, withdraw it at any time.
• Lodge a complaint: with your local data-protection authority.

To exercise any of these rights, email privacy@doclator.com. We will respond within 30 days.

11. EU/UK GDPR Notice

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent local laws apply. The legal bases we rely on to process your data are:

• Performance of a contract — processing necessary to deliver the Service you signed up for.
• Legitimate interests — to operate, secure, and improve our business in a proportionate way that does not override your rights.
• Legal obligation — to meet tax, accounting, anti-fraud, and other statutory requirements.
• Consent — where you have explicitly opted in (for example, optional marketing emails).

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, to opt out of sale or sharing of personal information, and to be free from discrimination for exercising your rights. Doclator does not sell or share personal information for cross-context behavioral advertising. To submit a request, email privacy@doclator.com with the subject line "California Privacy Request".

13. Children's Privacy

Doclator is not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

14. Cookies and Tracking

We use cookies and similar technologies to keep you signed in and to remember your preferences. We do not use third-party advertising cookies. For details, see our Cookie Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, applicable law, or our internal practices. When we make material changes, we will update the "Effective date" above and notify you by email or via an in-app banner at least 30 days before the change takes effect. Your continued use of the Service after the new effective date constitutes acceptance of the revised policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at privacy@doclator.com. For security incidents, write to security@doclator.com. For general support, use support@doclator.com.