Privacy Policy

1. Data We Collect

When you use Novel in Translation we collect the following information:

• Email address — used for authentication and account management.
• Uploaded documents — the text files you upload for translation are stored securely and processed on your behalf.
• Usage data — anonymised analytics events (e.g. features used, session duration). No cookie or persistent identifier is written to your device, and no profile is created for anonymous visitors. IP addresses are anonymised before storage.

We do not store payment card details — payment processing is handled by Stripe (see Section 3).

2. How We Use Your Data

• Authentication — to create and maintain your account securely.
• Translation processing — your documents are sent to a third-party AI language-model provider to perform the translations you request. This provider does not retain your inputs or outputs and does not use them to train its models; the data is processed in transit only.
• Service improvement — aggregated and anonymised usage data helps us identify bugs and improve features. This processing is based on our legitimate interests (Art. 6(1)(f) GDPR): no cookie or persistent identifier is stored on your device, no profile is created for anonymous visitors, and IP addresses are anonymised before storage.

We do not sell your personal data or use it for advertising purposes.

3. Third-Party Data Processors

We work with sub-processors who handle personal data on our behalf. All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security standards, under a Data Processing Agreement (DPA) or equivalent terms. Where a sub-processor is located outside the European Economic Area (EEA), transfers are protected by Standard Contractual Clauses (SCCs) or other appropriate safeguards recognised under applicable data protection law.

• AI translation provider — Uploaded document content is transmitted to a third-party AI language-model provider to perform the translation you request. Per its DPA, the provider does not retain API inputs or outputs and does not use them to train its models; data is processed in transit only.
• Payment processing (Stripe) — Subscription and billing data is handled by Stripe under its own privacy policy and DPA. We do not store payment card details.
• Transactional email — Your email address is shared with our email provider solely to deliver authentication codes, account confirmations, and service notifications.
• Infrastructure hosting — All application data, including account information, uploaded documents, and translation outputs, is stored on cloud infrastructure located in the United States.
• Analytics — Anonymised usage events are sent to our analytics provider, configured in cookieless mode with no persistent identifier written to your device and IP addresses anonymised before storage. This processing is based on our legitimate interests (Art. 6(1)(f) GDPR).

A current list of the specific sub-processors we use is available on request — see Section 7.

4. Cookies

We use a single cookie. It is set when you sign in, keeps you logged in, and is required to use the service — it is not used for analytics, advertising, or tracking. It expires after about a day, and you can delete it at any time through your browser settings, though doing so will sign you out. Because this cookie is strictly necessary to provide the service you have requested, no consent is required to set it.

Our analytics do not use cookies. Usage data is processed without storing anything on your device — no cookies and no local storage are written. This processing is based on our legitimate interests (Art. 6(1)(f) GDPR), and you can object to it at any time using the contact details in Section 7.

5. Data Retention

• Account data — retained until you request account deletion.
• Documents and translations — retained while your account is active and permanently deleted when you delete your account.
• Usage logs — retained for up to 12 months in aggregated form.
• Billing records — retained in de-identified form after account deletion, as required for financial audit and fraud-prevention purposes.

6. Your Rights

Under GDPR and applicable data protection law you have the right to:

• Access — request a copy of the personal data we hold about you, including the specific recipients of that data.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request erasure of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to certain types of processing, including direct marketing.

To exercise any of these rights, contact us at info@novelintranslation.com. We will respond within 30 days.

7. Contact

For privacy-related questions or requests, email us at info@novelintranslation.com.