Effective date: 23 July 2026
This Privacy Policy explains how Localization.One handles personal data when you visit the website, create an account, use a localization project, contact us or purchase a subscription.
Who is responsible for your data
The data controller is ONOSTAS, marketing in storitve, d.o.o., Gabrov trg 24, 1000 Ljubljana, Slovenia. Company registration number: 8451303000. Tax number: 54242878. Contact: [email protected].
Data we collect
- Account data: name, email address, password hash, authentication tokens and, if you use Google Sign-In, the name, email and profile image supplied by Google.
- Project data: project names, localization keys and strings, translations, comments, context, prompts, uploaded files, team membership, permissions, API settings and webhook configuration.
- Billing data: Stripe customer and subscription identifiers, plan, subscription status and billing period. Payment card data is collected and processed by Stripe; we do not store complete card numbers.
- Usage and technical data: IP address, browser and device information, timestamps, pages and product actions, security events, authentication cookies and display preferences.
- Communications: messages, email address, name and files you send through the contact form or support email.
Why we process data
- To create accounts, host projects, provide translations, exports, APIs, webhooks and support. The legal basis is performance of our contract with you.
- To process subscriptions, invoices, refunds and accounting records. The legal basis is performance of the contract and compliance with legal obligations.
- To secure the service, prevent abuse, diagnose failures and improve reliability. The legal basis is our legitimate interest in operating a safe and useful service.
- To understand aggregate product usage with our self-hosted Umami analytics installation. The legal basis is our legitimate interest in improving the service; where local law requires consent, we rely on that consent.
- To send essential account, verification, billing and service messages. We do not use account data for third-party advertising.
AI and machine translation
When a project owner enables AI or machine translation, relevant localization strings, keys, category names, context and custom prompts may be sent to OpenAI or Google services (including Gemini or Google Translate) to generate a translation. Do not place personal, secret or regulated information in localization strings unless you are authorised to process it and accept this provider processing. Human review is recommended before publishing generated translations.
Who receives data
We disclose data only where needed to operate the service. Providers may include Stripe for billing, Google for Sign-In and translation, OpenAI for AI translation, Hetzner for hosting, email delivery infrastructure, and self-hosted Umami analytics operated on our infrastructure. Project data is also visible to the collaborators and public users allowed by the project's visibility and permission settings. We may disclose information where required by law or to protect users and the service.
International transfers
Some providers may process data outside the European Economic Area. Where required, transfers are covered by an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism. Provider privacy terms may also apply to their processing.
How long we keep data
- Anonymous wizard uploads are stored temporarily and are normally deleted within 24 hours.
- Account and project data is retained while the account or project remains active and afterwards only as necessary to resolve disputes, maintain security and meet legal obligations.
- Authentication and email verification records are retained only as needed for sign-in and verification.
- Billing, invoice and transaction records are retained for the period required by accounting, tax and payment laws.
- Support communications, security logs and analytics records are retained for as long as reasonably necessary for their stated purpose, then deleted or aggregated.
Cookies and analytics
Localization.One uses cookies or similar storage for authentication, security, theme and device preferences. Our analytics is self-hosted and is not used to build advertising profiles. Browser settings can block non-essential storage, but authentication cookies are required to sign in.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and may object to processing based on legitimate interests. You may withdraw consent at any time where processing relies on consent. To make a request, email [email protected]. We may need to verify your identity.
You may also lodge a complaint with the Slovenian Information Commissioner at ip-rs.si or with the data protection authority in your country.
Security and children
We use technical and organisational measures intended to protect data, including encrypted transport, password hashing, access controls and signed payment webhooks. No online service can guarantee absolute security. The service is not directed to children under 16, and we do not knowingly collect their data without appropriate authorisation.
Changes and contact
We may update this policy when the service or legal requirements change. Material changes will be indicated by a new effective date. Questions and privacy requests can be sent to [email protected].