Legal

Privacy notice

Effective 9 September 2026

This notice explains how Zinzolin S.L., operating under the TranslateSimple trading name, processes information when providing the hosted service. The controller’s full company information is available in the legal notice. This notice does not cover data that remains solely inside a customer’s WordPress installation.

Information processed

• Account information such as the login email address, salted password hash, verified-device token hashes, and account status.
• Connected-site information such as the WordPress site URL, installation identifier, selected languages, and token hashes.
• Source segments deliberately submitted by a WordPress administrator and the resulting machine translations while a translation job is processed.
• Operational metadata such as job identifiers, language pairs, character and segment counts, timestamps, states, bounded error codes, quota usage, and security audit events.
• Stripe customer, subscription, invoice, and billing-status identifiers. TranslateSimple does not receive or store full payment-card details.
• Information you submit through the support form, such as your name, reply email, topic, optional site URL, and message.
• Limited technical logs needed for security and reliability. Application logs are designed not to contain source text, bearer tokens, cookies, or magic-login links.

Information not requested from WordPress

TranslateSimple scans supported published public content. Private drafts, form submissions, orders, users, cookies, nonces, passwords, hidden credentials, and full WordPress database contents are not submitted to the hosted translation service.

How information is used

Information is used to authenticate accounts and sites, provide machine translations, enforce plan quotas, process billing, prevent abuse, diagnose failures, answer support requests, and maintain service security. TranslateSimple does not sell customer content or use submitted segments for advertising.

Campaign measurement is first-party and limited to sanitized source, medium, campaign, creative, referral code, selected locale, Cloudflare country code and product milestones. It does not store IP addresses, browser user-agent strings or translated content. The campaign cookie and event records expire after 90 days. No advertising pixel or campaign telemetry runs inside the WordPress plugin before a site administrator voluntarily connects the hosted service.

Expected product emails may explain account connection, a completed first translation and free-quota thresholds. They are operational onboarding messages, not third-party advertising. Separate promotional campaigns require explicit consent.

Service providers

Selected source segments are sent to Microsoft Azure Translator or DeepL to produce translations. Stripe processes subscriptions and payments. Cloudflare Turnstile processes limited browser and network information to protect the support form from abuse. Hosting, email, DNS, proxy, and encrypted-backup providers process the minimum operational information needed for their role. Their processing is governed by their own terms and privacy notices.

Optional site activity reports

After connecting a site, its administrator can separately opt in to share scan and publication counts with TranslateSimple support. This is off by default and is not required for scanning, translating or publishing. Reports contain item, segment, character, unsupported-block and published page-language counts, a report identifier and report type. They are associated with the connected site and the time we receive them; they do not include page text or titles.

Scan reports also include a scan identifier, start time, duration, status and a fixed error code. Raw error messages, paths and stack traces are never sent. These reports help support distinguish a scan from translation processing and publication. A missing completion report is not proof of failure: delivery may be delayed or reporting disabled. They describe state reported by WordPress, not independent verification of the public website. Turning off the option in WordPress language settings stops future reports and discards pending reports. Previously received reports follow the operational-metadata retention policy below.

Optional AI design review

When a site administrator explicitly requests and consents to an AI design review, TranslateSimple sends public header/menu screenshots, layout measurements and language-switcher settings to OpenAI to suggest an appearance profile. This may include text or images visible in the public header. Do not request a review of a page containing private or sensitive information. Account credentials, cookies, connection tokens, form submissions and the WordPress database are not sent to OpenAI.

The review is optional: manual design settings and translation do not require it. Suggestions are checked on desktop and mobile and require administrator approval before changing the public design; no generated code is installed.

Temporary screenshots are removed from our review worker after processing. Review settings, measurements and results are available for up to seven days and are then scheduled for deletion; review payloads are excluded from service backups. We request that OpenAI does not store the response as application state. This is not a zero-retention guarantee: OpenAI may retain API content for abuse monitoring, normally for up to 30 days, with legal and safety exceptions. OpenAI processing may occur outside Spain and the European Economic Area. See OpenAI API data controls for its retention and processing terms.

Retention

• Acknowledged source and result payloads are deleted from the hosted service within 24 hours.
• Unclaimed, queued, failed, or provider-outcome-unknown payloads are deleted within 30 days.
• Raw translation payloads are excluded from logical service backups.
• Account, site, entitlement, usage, billing, and operational metadata is retained while needed to operate the account, meet security and accounting obligations, or resolve disputes.
• Final translations and manual edits remain in the customer’s WordPress database and are controlled by that customer.

Cookies and account security

The customer portal uses HttpOnly, SameSite session and verified-device cookies. Passwords are stored only as salted scrypt hashes. Email verification links are single-use and expire. Site, session, and verified-device tokens are stored as hashes by the hosted service. A new device must be verified once by email before password sign-in completes.

Your choices

The customer portal lets an authenticated user review connected sites, disconnect a site, export service-account metadata, cancel or manage billing, and request deletion. Other requests or privacy questions may be submitted through the support form. Some billing or security records may need to be retained where applicable law requires it.

Changes

This notice may change when the service or its providers change. The effective date above identifies the current version.