Privacy Policy

This Privacy Policy explains how ISAQUE SILVA CHAVES LTDA ("Company", "we", "us"), the operator of TRANLY — the document-translation platform, developer API, and dashboard (the "Service") — collects, uses, shares, and protects personal data.

Contact / privacy channel: support@tranly.co This is also the channel for data protection matters in Brazil. The Company is a small-sized processing agent under ANPD Resolution CD/ANPD No. 2/2022 and publishes a contact channel rather than appointing an encarregado; the channel answers every request Article 18 of the LGPD gives you.

1. The two roles we play

How we handle personal data depends on where it appears:

• Platform data — we are the controller. Data about you and your account: registration, billing, API usage, logs, support messages. We decide how and why this data is processed, and this Policy governs it in full.

• Customer Content — we are the processor (operador). The documents, images, and text that customers submit for translation may contain personal data about other people (for example, names in an invoice or a contract). For that data, our customer is the controller and we process it only on the customer's instructions, to provide the Service, under our Terms of Service and any data processing addendum. If your personal data appears inside a document someone else uploaded, please direct your request to that person or organization; we will assist them as required by law.

2. Data we collect

Account data — name, e-mail address, password (stored only as a salted hash), organization details, language preference.

Billing data — subscription plan, invoices, and payment status. Payments are processed by our payment provider (currently Stripe); we do not store full card numbers.

Usage and log data — API requests and responses metadata (endpoints, timestamps, document sizes and formats, job status, quota counters), IP address, browser/user-agent, and diagnostic logs.

A document-type label — for each translation, we record a single category describing what kind of document it was (for example legal, financial, medical, or unknown), together with how confident the automated classification was. It is produced by the same translation-model provider that already receives the document's text, from a short extract of that text, and it is kept as a label only: no part of your document is stored with it, and it is never shown to you or used to decide how a document is translated. It exists so we can see which kinds of documents the Service is used for and where to improve it.

Customer Content — the documents/text submitted for translation, OCR output, the translated results, and a translation memory scoped to the customer's account (source/target segments and embeddings kept so the same terms are translated consistently for that customer).

Support communications — messages you send us.

An advertising click identifier — when you reach the site through an advertisement we paid for, the link carries an identifier the advertising network wrote (Google Ads appends `gclid`; ChatGPT Ads appends `oppref`). We keep the identifier of the last such click with the account you then create, for 90 days (Section 6), so that we can tell that network its click worked: when the account is created, when it first completes a translation, and when it first pays (Sections 4 and 9). It identifies one click, not you, and it is the only identifier we ever send back.

We do not intentionally collect special categories of data about our users. Customer Content may incidentally contain any category of data; Section 1 applies to it.

3. How we use data, and on what legal grounds

We do not sell personal data. We do not use Customer Content to train our own or third parties' machine-learning models, and we engage our translation-model providers under API terms that prohibit such training.

4. Sharing and sub-processors

We share personal data only with:

• Sub-processors that help us run the Service, bound by data protection agreements and only for the purposes above:

The current list is maintained at this page; material changes are announced in advance to API customers.

• An endpoint you name, when you ask us to deliver there. A translation request may specify webhook delivery (`delivery: "webhook"` with a `webhookUrl`). When it does, we send the translated document itself, together with the file name, language and format that describe it, to the HTTPS address given in that request — and nowhere else. This is a transfer we make on your instruction, request by request: there is no standing destination, only the address each request names. Each delivery is signed so your server can verify it came from us; we send no credential of yours with it, we do not follow redirects, and we keep no additional copy — the document remains subject to the retention window in §6, and the address is stored on the job record and deleted with it. Once a delivery arrives, the copy on your server is under your control.

• Authorities, when required by law or a valid legal process.

• A successor entity, in a merger, acquisition, or asset sale, under confidentiality and subject to this Policy.

5. International transfers

We operate from Brazil and use providers located abroad (see the table above), so personal data is transferred internationally. When we transfer data, we use safeguards recognized by applicable law — for data collected in Brazil, the transfer mechanisms of the LGPD and ANPD regulations, including the ANPD's standard contractual clauses; for data from the EEA/UK, the applicable standard contractual clauses or adequacy decisions.

6. Retention

These windows are enforced automatically: an expiry routine deletes the data on schedule rather than on request. Closing your account (Section 8) erases the above immediately, except records we must keep to comply with law.

When retention ends, data is deleted or irreversibly anonymized. We may retain data longer where required by law or to exercise rights in legal proceedings.

7. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, hashed credentials, API-key authentication, access controls and least-privilege, isolation of customer translation memories per account, and logging. No system is perfectly secure; if a security incident creates relevant risk to you, we will notify you and the competent authority as required by applicable law (in Brazil, within the deadlines set by the ANPD).

Access by our personnel. A small number of authorized Company staff can open an internal console to help you: it shows your organization's account details, members, plan, usage counters, and the metadata of your translation jobs (format, language, size, status, the document-type label). It does not show the documents you uploaded, the translations we produced, or their file names. Two of those staff may also correct a usage counter — for example when a translation was counted twice — which changes only what counts against your monthly allowance and never a payment or your plan. Every time a member of staff opens your organization's record, and every correction they make, is written to an internal audit log with who did it, when, and why; that log is kept for the period stated for security logs in Section 6, and you may ask us for the entries concerning you.

8. Your rights

Subject to applicable law, you may ask us to:

• confirm whether we process your data, and access it;
• correct incomplete, inaccurate, or outdated data;
• delete it, or anonymize/block data that is unnecessary or excessive;
• port it to another provider in a structured format;
• provide information about sharing with third parties;
• object to processing based on legitimate interest;
• withdraw consent at any time, where processing is based on consent, and be informed about the consequences of refusing it.

Account holders can exercise the first two directly in the dashboard, without asking us: Account → Export your data downloads everything we hold about the account in a structured, machine-readable file, and Account → Close account deletes the account and its content (see Section 6 for what law requires us to keep).

For anything else, write to support@tranly.co. We respond within 15 days of a verified request. We may need to confirm your identity first. Remember Section 1: for personal data inside Customer Content, we will refer your request to the customer who controls it and assist them.

8.1. Brazil (LGPD)

If you are in Brazil, we process personal data in accordance with Law No. 13.709/2018 (LGPD). You have the rights listed in Article 18 of the LGPD, exercisable through the contact channel shown at the top of this Policy. You also have the right to petition the Autoridade Nacional de Proteção de Dados (ANPD) (gov.br/anpd) regarding your data, and the right to request review of automated decisions that affect your interests. Legal bases cited in Section 3 correspond to Article 7 of the LGPD.

8.2. EEA and United Kingdom (GDPR)

If you are in the EEA or UK, the legal bases in Section 3 correspond to Article 6 GDPR, and you additionally have the right to lodge a complaint with your local supervisory authority. Transfers out of the EEA/UK rely on the safeguards described in Section 5. Our representative contact for GDPR matters is support@tranly.co.

8.3. Other jurisdictions

Where your local law grants additional rights (e.g., US state privacy laws), we honor verified requests through the same channel.

9. Cookies and similar technologies

The dashboard uses only essential cookies/local storage: session authentication, security, and your preferences (such as interface language).

The public website additionally stores one first-party identifier: a random value, generated in your browser, that means nothing outside this Service. We use it to count how many people a page reaches, and to record which version of a page you were shown when we are testing two. It is not an advertising identifier, it is never shared with anyone, it cannot follow you to another website, and it decides nothing about the Service you receive. What we record against it is limited to page views and actions on the site — never the content of a document, and never a payment detail. These records are kept for 12 months (Section 6) and are deleted when the account they led to is closed.

We use no third-party analytics or advertising script. The records above are written to our own servers, and we do not use third-party advertising cookies.

If you arrived through one of our advertisements, we tell the network its click worked. The link you clicked carried an identifier the network wrote (Section 2). We read it from the link and keep it on our own servers with the account you create. We send it back to the network that sold the click, with the time of the event, and each event at most once. Google Ads receives it when the account is created, when the account first completes a translation, and when the account first pays for a plan. OpenAI, for an advertisement shown in ChatGPT, receives it only when the account first pays (Section 4). With the payment we also send the plan's list price. Nothing else travels — no name, no e-mail address, no document, no translated text, no payment detail. No script from either network runs on our pages, and neither network sets a cookie here. The identifier is erased 90 days after the account is created (Section 6).

There is exactly one third-party script on our pages, and it is the payment form. When you start a purchase we may show Stripe's card form inside our page instead of sending you to Stripe's own site; in that case your browser loads Stripe's script, and Stripe receives the request that loads it. It is loaded only when you start a purchase, never on any other page and never before you act. Stripe is already our payment processor and already receives your payment details either way (Section 4); this changes where you type them, not who receives them. No other page loads anything from, or reports anything to, another company.

10. Children

The Service is intended for business use and not directed to anyone under 18. We do not knowingly collect personal data from children; if you believe we have, contact support@tranly.co and we will delete it.

11. Changes to this Policy

We may update this Policy. For material changes we will tell you by e-mail or in the product, and we will ask you to accept the new version before you use the Service again. The "Effective date" at the top always reflects the current version.

12. Contact

ISAQUE SILVA CHAVES LTDA · CNPJ 53.961.212/0001-00 · Rua dos Guaicanas, 426, Vila Costa e Silva, Campinas — SP, CEP 13081-020, Brazil Privacy and data protection channel: support@tranly.co