Privacy policy

Who this policy covers

• Customers and their teams: people who create or use an account at hub.verbafy.app.
• People who visit verbafy.app: people who browse our website or use the contact form.
• People who visit a website that uses Verbafy: we process a small amount of information about you on behalf of the website's owner, who is our customer and decides how your information is used. If you have questions about that website, contact its owner.
• People named on our customers' websites: if a page we translate mentions you, we process that text for the website's owner, only to translate it.

What we collect

From customers and their teams. Your name, email address and password when you sign up; the password is held by our identity provider, sysinit.sh, only as a one-way hash we cannot read. Your team's name and the names and email addresses of people you invite. The sites you add: their domain, name and settings. Your plan and payment status, and the identifier Stripe assigns to you as a customer; card details go straight to Stripe and we never see them. Usage: how many words have been translated, and a record of actions taken in your team's account, such as adding a site or inviting a member. Support emails you send us and our replies.

Your content. The text of the pages you connect to Verbafy, the addresses of those pages, and the translations we produce or you edit. Our Terms of Service ask you to keep confidential and sensitive personal information off those pages.

From people who visit a website that uses Verbafy. When the widget asks us for a translation, we receive the website's public key, the address of the page, the text on it, the language chosen, and the technical details any web request carries, including your IP address and browser details. We use the IP address to limit abusive request rates and in our server logs, and for nothing else. We do not build profiles, run advertising, or track you across websites.

From people who visit verbafy.app. The name, email address and message you type into the contact form, which goes to our inbox by email. Cloudflare, which serves the site, sees your IP address and tells our page which country you are in, so that prices show in Australian dollars for a visitor in Australia; we store nothing from that. There are no analytics trackers and no cookies on verbafy.app.

How we use it

• to run Verbafy: translate and serve your pages, remember a visitor's language choice, and show your team its account;
• to create and secure accounts and detect fraud and abuse;
• to bill you and keep the financial records the law requires;
• to answer support requests and send service notices about security, billing and changes;
• to fix problems and improve Verbafy;
• to comply with the law and protect our rights.

We do not use personal information for any kind of automated decision that has a legal or similarly significant effect on a person.

Translation engines

Translations are produced by machine translation engines run by other companies. We send them the text to be translated and nothing about the visitor who asked for it. The engines in use are:

• Google Cloud Translation (Google LLC, United States), which serves most languages. Google holds the text only in memory while it translates it, does not use it to train its models, and does not share it. Google processes it on its global infrastructure, which may be outside Australia.
• Anthropic's Claude models (Anthropic PBC, United States), such as Claude Haiku, where we use AI translation. Anthropic's commercial terms do not allow it to train on the text we send, and it keeps that text only for a limited period to detect misuse. Processing is in the United States.

We may add or change engines; this policy names the ones in use. If you connect your own AI tool to translate a language, the text goes to that tool's provider under your agreement with it, not ours.

Who we share personal information with

These are the companies that handle data for us so that Verbafy can run.

We may also share personal information with our professional advisers, with a buyer or successor if we sell or restructure the business, with law enforcement, regulators or courts where the law requires, and with anyone you ask us to share it with. We do not sell personal information.

Information sent overseas

We are an Australian company. Our application and database are hosted in Germany, and the providers above process information in the United States and, in Google's case, on its global infrastructure. Before we disclose personal information overseas we take reasonable steps, usually by contract, to make sure it is handled in a way consistent with the Australian Privacy Principles. Information processed in another country may be accessible to the authorities of that country under its laws.

How we keep information secure

Data is encrypted in transit and at rest. Passwords are stored by our identity provider only as a one-way hash. Access to personal information is limited to the people who need it. Card details are entered on Stripe's own payment pages and never reach our servers; Stripe is a PCI DSS Level 1 service provider. No method of storage or transmission is completely secure. If you find a security problem, email [email protected].

Cookies and browser storage

On verbafy.app. No cookies and no trackers.

In the dashboard at hub.verbafy.app. One strictly necessary cookie, verba_refresh, keeps you signed in. The dashboard also keeps in your browser's local storage which team you last had open (verba_active_org) and, for the current tab only, whether you have dismissed a notice. When you choose a plan or open your Billing page, you are on pages hosted by Stripe, which sets its own cookies under Stripe's cookie policy.

On websites that use Verbafy. The widget sets no cookies. It uses your browser's storage for the site it is on, and nothing on it identifies you:

• verbafy:lang:<site> in local storage: the language you picked, written only when you pick one, so the site stays in that language on your next visit. It is removed when you switch back to the site's own language, or when you clear the site's data.
• verbafy:site-config:<site> in local storage: the site's list of languages, so the language switcher can be drawn without waiting for a request.
• verbafy:<site>:<language>:<page> and verbafy:discovered:<site> in session storage: the translations already fetched for the pages you have viewed, so they are not fetched twice. Session storage is cleared when you close the tab.

Clearing the website's data in your browser removes all of it. The website's owner is responsible for mentioning this in their own cookie or privacy notice where the law requires it.

If you visit a website that uses Verbafy

The owner of that website decides how your information is used and is the controller of it under privacy law. We act on their instructions. To access, correct or delete information about you, contact the website's owner; we will help them respond. The IP address and browser details that arrive with a translation request are used only to limit abusive request rates and in our server logs, which roll over as new entries arrive.

How long we keep information

Account and team details are kept while your account is open and until you ask us to delete them. Your pages' text and their translations are kept while your account is open, including through a lapsed trial or a cancelled plan, so they are ready if you come back. We delete them when you ask, and we may remove translations from a long-inactive account at our discretion. Contact-form and support emails are kept in our mailbox for as long as they are needed to deal with your request. Invoices and payment records are kept for 7 years, as Australian tax and company law require. Server logs roll over and are not kept long-term.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. There is no charge. We may need to confirm your identity first. We aim to respond within 30 days, and if we refuse a request we will tell you why. If you are in the EU or the UK, you also have the rights that the GDPR gives you, including to object to or restrict processing and to complain to your local data protection authority.

If you have a complaint about how we have handled your information, contact us first at [email protected] and we will do our best to resolve it within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Emails we send

We send service emails: address verification, team invitations, password resets, and notices about billing, security and changes to our terms. Stripe sends receipts for payments. We do not currently send marketing emails. If we start, we will ask first or make it easy to opt out, as the Spam Act 2003 requires.

Children

Verbafy is for businesses. We do not knowingly collect personal information from anyone under 18. If you believe we have, email [email protected] and we will delete it.

Data breaches

If we become aware of a data breach that affects information we hold for a customer, we will tell that customer without undue delay and help them decide whether people or a regulator need to be notified. Where the Notifiable Data Breaches scheme requires it, we notify the people affected and the Office of the Australian Information Commissioner.

Changes to this policy

We may update this policy. The date at the top shows the latest version. For a change that materially affects you, we will email account holders or show a notice in the dashboard before it takes effect. Earlier versions are available on request.

Contact

Privacy enquiries: [email protected]. Verbafy - BSA Corp Pty Ltd, ACN 680 726 327, New South Wales, Australia.