Traducet

Legal

Privacy Policy

Last updated: July 2026

1. Data Controller

Eivura SL is the data controller (responsable del tratamiento) for all personal data processed through the Traducet platform, in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD).

  • Company: Eivura SL
  • Brand: Traducet
  • CIF: B26588327
  • Address: Avinguda de Roma 23, 43005 Tarragona, España
  • Phone: +34 646 128 931
  • Privacy contact: privacidad@traducet.com

At this time, Traducet has not appointed a Data Protection Officer because it is not legally required to do so based on its current processing activities. For any privacy or data protection request, users may contact the data controller at privacidad@traducet.com.

2. Data we collect

  • Order data: email address, full name (optional), document type, language pair, urgency.
  • Document files: the source document you upload. Official documents may contain sensitive personal data, including special-category data or data relating to criminal convictions and offences depending on the document type, as well as ordinary identification data such as name, date of birth, nationality, and family status. These files are treated with the highest level of access restriction and are scheduled for deletion from Traducet-controlled storage 90 days after delivery (see section 5).
  • Document analysis metadata: word and page counts and quality-confidence scores produced by our automated document pre-analysis (see section 13). The extracted text itself is never stored.
  • Payment data: processed by Stripe. Traducet does not store card data.
  • Account data (if you create an account): email address, hashed password (via Supabase Auth).
  • Translator data: name, contact details, MAEC appointment number, language combinations, and professional declarations. Tax identification and bank details, where needed, are requested separately at a later stage — not during registration.
  • Support correspondence: any messages sent to our support address.

3. Purposes of processing

  • Delivering the sworn translation service ordered by the customer.
  • Processing payment and issuing invoices.
  • Sending order status notifications and the completed translation by email.
  • Verifying translator credentials and managing translator accounts.
  • Complying with accounting, tax, and commercial record-keeping obligations.
  • Responding to support and privacy requests.
  • Improving the platform through aggregated analytics, where you have consented.

4. Lawful basis

Customer data: Processing is based on performance of a contract (Art. 6(1)(b) GDPR) for the delivery of the translation service. Where official documents contain special-category data, we rely on your explicit consent captured at upload (Art. 9(2)(a)); we rely on Art. 9(2)(f) (establishment, exercise, or defence of legal claims) only where a specific legal-claims context applies. Data relating to criminal convictions and offences (Art. 10 GDPR) is processed only where strictly necessary to deliver the requested translation, and is subject to the same access restrictions and retention limits.

Translator data: Processing of translator personal data (NIF/NIE, IBAN, credentials) is based on performance of the service provider contract (Art. 6(1)(b)), compliance with legal obligations including tax and social security law (Art. 6(1)(c)), and legitimate interest in verifying professional qualifications and preventing fraud (Art. 6(1)(f)).

Analytics: Both our analytics cookies (Google Analytics) and our cookieless audience measurement (Vercel Analytics) are processed only with your consent (Art. 6(1)(a) GDPR), which you give through the cookie banner and may withdraw at any time. Neither tag is loaded — and no data is sent to either provider — until you accept analytics.

Advertising: The Google Ads and Microsoft Advertising tags are loaded, and their conversion cookies set, only with your separate marketing consent (Art. 6(1)(a) GDPR). They are off by default; without your marketing consent no conversion information is sent to Google or Microsoft at all. What is sent when you have consented is limited to the fact that a paid order took place, its value in euros, and the payment reference used to avoid counting the same order twice — never your name, email address, telephone number, or anything about your documents. Google Ads is used for conversion measurement and campaign attribution of our own campaigns only — Traducet does not activate or use audience segments for remarketing, personalized advertising, or audience targeting, and the ad-personalization signal is permanently disabled. Microsoft does not document a duration for each individual cookie; at vendor level, Microsoft Advertising cookies and identifiers may persist for up to 13 months, and Microsoft may retain UET data for up to 390 days. You may withdraw this consent at any time via "Manage cookies".

5. Data retention

Customer source documents and delivered translations held in Traducet-controlled operational storage are scheduled for deletion 90 days after delivery, unless a legal hold or another documented exception applies. Traducet does not send customer source documents, final translations, or invoices as attachments in the emails it sends; where document access is required, secure access links are used instead. Historical copies previously included in outbound emails may remain temporarily within the email provider’s systems in accordance with that provider’s retention and deletion processes, while Traducet works with the provider to remove or confirm the expiry of those legacy copies. Emails that customers themselves send to Traducet (including any files they attach) are received and stored by the email provider as part of normal inbound email handling.

Order metadata (reference, status, amount) and invoices, rectifying invoices, and related accounting documentation are retained for 6 years in accordance with commercial record-keeping obligations under Código de Comercio Art. 30, which exceeds the 4-year tax prescriptive period set by Ley General Tributaria Art. 66. The 90-day deletion applies to translation documents, not to these fiscal records.

6. Data processors

We engage the following processors, each bound by an Article 28 Data Processing Agreement:

  • Supabase — database and file storage (EU region, Frankfurt, Germany)
  • Vercel Inc. — hosting and compute (US-based; transfers to the US are governed by Standard Contractual Clauses under GDPR Art. 46(2)(c))
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Google Ireland Ltd (Google Analytics) — privacy-oriented website usage measurement, only where you have consented to analytics cookies (US-based infrastructure; transfers governed by Standard Contractual Clauses and the EU–US Data Privacy Framework)
  • Google Ireland Ltd (Google Ads) — conversion measurement and campaign attribution for our own campaigns, only where you have given marketing consent; personalized advertising and remarketing are disabled (US-based infrastructure; transfers governed by Standard Contractual Clauses and the EU–US Data Privacy Framework)
  • Microsoft Ireland Operations Ltd (Microsoft Advertising) — conversion measurement and campaign attribution for our own campaigns, only where you have given marketing consent; remarketing, audience targeting and enhanced conversions are not used (US-based infrastructure; transfers governed by Standard Contractual Clauses and the EU–US Data Privacy Framework)
  • Vercel Analytics — cookieless, aggregated audience measurement without cross-site tracking, loaded only where you have consented to analytics
  • Holded Technologies S.L. — invoicing and accounting software (EU, Spain); receives the billing details needed to issue your invoice (name, email, billing address and, where provided, tax identification number)
  • Functional Software, Inc. (Sentry) — application error and performance monitoring, used to keep the platform secure and reliable (US-based; transfers governed by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework). Configured not to collect IP addresses, cookies, or authentication data, and captured URLs are stripped of identifiers; error reports never include your documents
  • Fly.io, Inc. — isolated, self-hosted infrastructure for automated document pre-analysis (EU region, Frankfurt; see section 13). Documents are processed transiently and never stored on this infrastructure (US-incorporated provider; transfers, where applicable, governed by Standard Contractual Clauses)
  • MAEC-appointed sworn translators — process uploaded documents solely to deliver the certified translation; access is limited to the assigned document

We do not sell your personal data, and we do not share it with any party other than the processors listed above. Traducet does not activate or use audience segments for remarketing, personalized advertising, or audience targeting. Where you give marketing consent, Google Ads and Microsoft Advertising are used for conversion measurement and campaign attribution of our own advertising campaigns, and you can withdraw that consent at any time via "Manage cookies".

7. International transfers

All document storage and primary database processing takes place in the EU (Frankfurt), including the automated document pre-analysis infrastructure (section 13). Where any sub-processor is incorporated outside the EEA or relies on infrastructure outside the EEA (notably Vercel, Sentry, and Fly.io, incorporated in the US, and Google Analytics, Google Ads and Microsoft Advertising), transfers are safeguarded by Standard Contractual Clauses approved by the European Commission under GDPR Art. 46(2)(c) and, where applicable, the provider’s EU–US Data Privacy Framework certification.

8. Your rights

Under GDPR and LOPDGDD you have the following rights in relation to your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your data where it is no longer necessary for the purpose it was collected, subject to legal retention obligations.
  • Restriction — ask us to restrict processing in certain circumstances.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interest.
  • Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact privacidad@traducet.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es. If you reside in another EU/EEA member state, you may alternatively contact the supervisory authority of your country of habitual residence.

9. Security

Documents are stored encrypted at rest in private storage buckets. Access is only via short-lived signed URLs (5–15 minute expiry). Row-Level Security in our database ensures each user only accesses their own data. All connections use TLS.

10. Cookies and analytics

Traducet uses essential cookies required for the platform to function (session management, security tokens). We use Google Consent Mode in its basic configuration: with your consent, we use Google Analytics to understand how visitors use the site — until you accept, the Google Analytics tag is not loaded and no data is sent to Google. We additionally use Vercel Analytics — cookieless, aggregated audience measurement without cross-site tracking — which we likewise load only with your consent. With your separate marketing consent, we load the Google Ads and Microsoft Advertising tags for conversion measurement and campaign attribution of our own campaigns; they stay off by default, personalized advertising and remarketing are permanently disabled, we do not use Microsoft Clarity, and you can withdraw consent at any time via "Manage cookies" — withdrawal also deletes the first-party cookies and local-storage entries these tags created. For full details, see our Cookie Policy.

11. Online Dispute Resolution

For cross-border disputes, consumers may use the EU Online Dispute Resolution platform at ec.europa.eu/consumers/odr. Our contact for ODR purposes: hola@traducet.com.

12. Processing of translator applicant and translator data

If you apply to work with Traducet as a translator or sworn translator/interpreter, Traducet processes the personal and professional data necessary to review your application, verify your professional status, manage onboarding, and maintain the translator relationship.

At the initial application stage, Traducet collects only professional profile data and declarations. Traducet does not request or accept identity document copies, digital certificate files, signed test PDFs, or bank account details during registration.

At the application stage this may include:

  • Name and contact details
  • Professional profile information and language combinations
  • MAEC sworn translator/interpreter registration details, where applicable
  • Your declaration confirming you are able to certify translations electronically with a valid qualified electronic certificate where required
  • Availability and invoicing preferences
  • Acceptance of the Privacy Policy, the Translator Service Agreement, and related terms, with the associated timestamps

If additional verification or payout information is required as your application progresses (for example, a tax identification number or bank details for payments), Traducet requests it separately and only when needed. Traducet processes this data for the following purposes: reviewing translator applications; verifying professional authorisation and MAEC registration; managing contracts, onboarding, billing, payments, tax, and accounting obligations; preventing fraud; and complying with legal, contractual, and operational obligations.

The legal bases for this processing may include pre-contractual measures, contractual necessity, legitimate interest, and legal obligation where applicable.

Document minimisation: Traducet no longer retains translator onboarding document uploads (such as identity document copies, MAEC proof, or signed test PDFs) that may have been collected under earlier versions of the registration process; those uploaded files have been deleted from active storage. Traducet retains only the verification result and the minimum information required for contract, billing, tax, legal, security, and operational purposes. Copies that may persist in routine system backups are removed in line with normal backup rotation.

Digital certificate files: Traducet does not request, accept, or store digital certificate files, private keys, certificate export files, or certificate passwords.

13. Automated document pre-analysis (OCR)

When you upload a document, Traducet may run an automated pre-analysis (optical character recognition) to count its words and pages and assess its readability. This is used solely to calculate your quote and to decide whether the document needs to be reviewed by a member of our team before a price is confirmed.

  • The analysis runs on self-hosted software on isolated infrastructure in the EU (Frankfurt); no external artificial-intelligence or cloud-vision provider receives your document.
  • The document is accessed through a short-lived, expiring link, processed transiently, and deleted from the analysis infrastructure immediately after processing.
  • The extracted text is never stored. We retain only numeric metadata: word count, page count, and quality-confidence scores.
  • Copies of uploads that are abandoned before an order is placed are deleted within 48 hours; the related analysis metadata is deleted after 30 days.
  • Any document the automated analysis cannot assess with sufficient confidence is routed to human review, and pricing decisions above the automatic threshold can always be corrected by our team. The pre-analysis produces no decision with legal or similarly significant effects on you — it only calculates a quote or routes your order to a human.

14. Server logs and operational telemetry

Like any online service, our hosting and database providers (Vercel, Supabase) keep technical server logs — IP address, browser user-agent, requested URL, and timestamps — for security, abuse prevention, and reliability, on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in operating the platform securely. These logs are retained for the short periods set by each provider. We also use Sentry for error and performance monitoring (see section 6); error reports are configured to exclude IP addresses, cookies, authentication data, and identifiers in URLs, and never contain your documents.

15. Anonymous aggregated statistics

Traducet generates anonymous and aggregated statistics about translation pricing activity, including language combinations, document categories, page and word-count ranges, pricing results and service performance. These statistics do not contain document content, customer identifiers, filenames, contact details or payment identifiers, and cannot be linked back to you, your order or your documents. Because they are anonymous, they fall outside the scope of personal-data protection law; we use them to improve pricing, service availability and platform performance. This statistical processing happens entirely on our servers and does not involve cookies, device identifiers or any third-party analytics provider.