Privacy Policy

1. Who we are

This privacy policy explains how GlotEO, an Australian business and the operator of https://gloteo.com and the GlotEO software as a service product (referred to as we, us, or our), collects, uses, stores, and shares personal information and personal data (personal data). Our customer terms are governed by the law of Victoria, Australia.

For applicable data protection law — including the Australian Privacy Principles, the General Data Protection Regulation (EU) 2016/679 (GDPR), and the UK Data Protection Act 2018 — we are the controller of personal data we collect about website visitors, account holders, and people who contact us. Where we process personal data contained in content you submit for translation (for example, copy on your website that identifies your customers), we do so as a processor on your instructions. That processing is covered by our Data Processing Addendum.

This policy applies whenever we collect your personal data. That includes when you visit this website, create an account at https://app.gloteo.com/, pay for a subscription, contact us, or use GlotEO to translate and host language versions of a website, app, images, or video.

Please read this policy carefully. It explains who we are, how and why we use your personal data, your rights, and how to contact us or a regulator if you have a complaint. Privacy questions, access requests, correction requests, deletion requests, and complaints all go through the contact form. That is the privacy contact for this policy.

2. Types of personal information we collect

The personal data we collect may include:

1. name;
2. email address;
3. account credentials (we store a hashed password, not your password in plain text);
4. billing details and payment-related information processed by our payment partner;
5. telephone number and other contact details you choose to give us;
6. information about your business, websites, and localization requirements;
7. content you submit so we can provide the service, including website or app copy, glossaries, images, video, and related files;
8. information you send through our contact form or by email;
9. information from surveys, questionnaires, or promotions you take part in;
10. when analytics or advertising cookies are allowed, device type, IP address, approximate location, page-view statistics, advertising data, and standard web log information;
11. cookie and consent choices; and
12. any other information you provide via this website, the GlotEO application, or in the course of us providing services to you.

We do not require date of birth or government ID to use GlotEO. Please do not send us sensitive information — including health information, biometric data, government identifiers, or information about racial or ethnic origin, religious beliefs, sexual orientation, or criminal records — unless you have a lawful basis to do so and we have agreed in writing that the service may be used for that information. The standard service is not designed for it.

Connecting a website can cause us to process personal data that already appears on the pages, even if you did not mean to upload it. You need a lawful basis for that processing. You are responsible for the content you connect.

3. How we collect personal information

We try to keep the information we collect complete, accurate, and protected from unauthorized access. We may collect personal data directly from you, or from third parties, including when you:

1. visit or use this website or our application;
2. create an account, start a free plan, or purchase a paid subscription;
3. connect a website, CMS, or other integration;
4. submit pages, strings, images, or video for translation;
5. contact us through our website, email, or social applications;
6. engage us to perform services, or offer to provide services to us;
7. interact with our content, advertising, or social media pages; or
8. enquire about investing in, or purchasing, our business.

We may also collect data through web analytics tools, cookies, and similar technologies. You can review and change non-essential cookie choices using Cookie settings in the footer of this website. See section 7 below.

4. How we use your personal information

We collect and use personal data to:

1. provide, operate, host, and support the GlotEO service, including translating content, generating language versions, and applying multilingual SEO settings you configure;
2. create and manage accounts, subscriptions, billing, and usage allowances;
3. respond to enquiries, provide support, and send administrative messages;
4. keep records and administer our business;
5. comply with law, resolve disputes, and enforce our agreements;
6. where we have your consent, send marketing and product updates you can unsubscribe from at any time; and
7. pursue our legitimate interests, including understanding how the website is used (where analytics consent is given), keeping the platform secure, considering job applications, and developing statistics that do not identify you where possible.

AI processing and customer content

GlotEO processes customer content to provide translation, localization, publishing, and related services. Customer content may be sent to OpenAI and to Google’s Gemini API so those providers can generate the translation or localization you requested. That is inference: using a model to produce an output. It is not permission to train or fine-tune a model on that content.

We do not use customer content to train or fine-tune AI models unless you give separate, explicit permission. We require our AI providers not to use customer content for model training unless you have given that permission. This applies on every plan, including Free, and it applies to text, images, and video you submit.

OpenAI states that API data is not used to train its models unless that use is explicitly opted in. We do not opt customer content into that use. Google’s paid Gemini API does not use prompts and responses to improve Google’s products. We do not submit customer content on unpaid Gemini quota, because that quota may be used to improve Google’s products, and we do not opt customer content into Google’s log-sharing or contributor programs.

How long a provider keeps that content depends on the provider, the API feature, and the account configuration. Customer content is not necessarily deleted as soon as a response is generated. On the paid Gemini API, Google logs prompts and responses for a limited period for abuse monitoring. OpenAI’s API retention follows OpenAI’s policies and the settings on the API account, which can include a limited abuse-monitoring period. Neither path is described here as zero retention. The website translation function sends text to the Gemini API. It does not enable Grounding with Google Search, the File API, or a zero-data-retention option. Those features have different retention rules, described in Google’s data retention notes and Gemini API terms. OpenAI’s published commitments are on its business data privacy page.

Video and audio are processed by Verbalate Pty Ltd to generate the localized media you requested. That processing is covered by the same rule: we do not use the content to train AI models, and we do not authorize a provider to do so, unless you give separate, explicit permission. Provider names and documentation are in the subprocessor register.

We may analyze operational information — such as error logs, usage counts, and security events — to maintain security, troubleshoot problems, and improve service performance. That uses operational records. It is not use of customer content for machine learning or model training.

5. Sharing your data

We may share personal data in these circumstances:

1. with the service providers named in our subprocessor register, for the purposes, data types, and locations listed there — including hosting, infrastructure, email, analytics (when consented), and AI or media providers that generate translations or video localization;
2. with a payment provider shown at checkout, when you pay. We do not store full card numbers;
3. with professional advisers such as lawyers, accountants, and auditors, under confidentiality obligations;
4. where required by law, regulation, or a competent authority;
5. if there is a change of control, sale, or transfer of business assets, to the extent permitted by law, under confidentiality arrangements; and
6. with a third party you ask us to share data with.

We do not sell your personal data. Before we start using a new subprocessor for customer content, we update the register. Business customers may object as the Data Processing Addendum describes.

6. Customer content and your own visitors

GlotEO is built to translate websites, apps, images, and video that you control. You are responsible for that content, including any personal data of your customers, employees, or visitors that appears in it.

You must have a lawful basis to collect and submit that data, and you must not use GlotEO to process content you are not allowed to copy, translate, or host. Our Terms explain your warranties and the limited license to process that content so we can provide the service.

7. Cookies

This website uses cookies and similar technologies. Necessary cookies keep the site working (including remembering your cookie choices). With your consent, we may also use:

1. preference cookies, to remember settings;
2. analytics cookies, including Google Tag Manager / Google Analytics, to understand how the site is used; and
3. marketing cookies, to measure campaigns and related content.

The marketing site uses an opt-in consent model. Analytics and marketing tags do not load until you accept those categories. You can change your choices at any time via Cookie settings in the footer. The GlotEO application may use additional strictly necessary cookies for sign-in and account security.

8. Security

We maintain reasonable and appropriate technical and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and loss. Those safeguards include access controls, HTTPS (TLS) for the website and application, hashed account passwords, and procedures for responding to security incidents. We review them as the platform develops. More detail, including what we do not currently certify, is on the Security page.

If we confirm a security incident that affects personal data we hold, we will notify affected account holders without undue delay and reasonably cooperate with their investigation. That notice is separate from any duty to report to a regulator or to notify individuals.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Links

Our website and application may contain links to other sites, including CMS platforms, payment pages, and partner products. Those links are provided for convenience. We are not responsible for the privacy practices of linked websites. Review their policies before using them.

10. Your rights

Depending on where you live, you may have some or all of the following rights in relation to your personal data:

1. Access. Obtain access to personal data we hold about you, and related information about how we use it.
2. Be informed. Receive clear information about how we use your data. This policy is part of that.
3. Rectification. Ask us to correct inaccurate or incomplete personal data.
4. Object. Object to certain processing, including processing for direct marketing.
5. Restriction. Ask us to restrict further use in certain cases. We may still store the data.
6. Erasure. Ask us to delete personal data when it is no longer needed for the purpose collected, or in other cases provided by law.
7. Portability. Ask for some of your personal data in a commonly used, machine-readable format, or for it to be sent to another controller where technically feasible.
8. Withdraw consent. Where we rely on consent (including marketing and non-essential cookies), you may withdraw it at any time. That does not affect processing already carried out.
9. Complaints. Lodge a complaint with a supervisory authority. In Australia that includes the Office of the Australian Information Commissioner. In the UK, the Information Commissioner’s Office. In the EEA, your local data protection authority.

To exercise these rights, use our contact form. We may need to verify your identity before acting on a request. We aim to respond to access, correction, and deletion requests within 30 days. If a request is complex, we will tell you and explain the extra time we need.

11. How long we keep data

We keep personal data only for the periods below, and only as long as needed for the purpose we collected it. A provider named in the subprocessor register may keep its own copy for the shorter or longer period stated there, such as abuse-monitoring logs.

We destroy or de-identify personal data when we no longer need it, in line with applicable law, including Australian Privacy Principle 11 where it applies. Some records must be kept for tax, disputes, or security even after you ask for deletion.

Deleting a project or closing an account removes the content from GlotEO’s active systems on this schedule. It does not erase copies of pages you have published that search engines or other independent sites may already hold.

12. Transfers outside Australia, the UK, and the EEA

We use the providers in the subprocessor register. They may store or process data in Australia and in other countries, including the United States. Those countries may not provide the same legal protections as the country where you live.

When we transfer personal data out of the UK or EEA, we take steps to protect it to a comparable standard, which may include the European Commission’s standard contractual clauses or another lawful transfer mechanism. Contact us if you want more information about those safeguards.

13. Contact, changes, and complaints

For questions about this policy, to access, correct, or delete your personal data, or to make a complaint, use our contact form. Put “Privacy complaint” in the message if you are complaining. We will acknowledge a complaint and aim to respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or the regulator where you live.

We may change this privacy policy by posting an updated copy on this page. If we make a material change, we will give account holders at least 30 days’ notice by email or in the application before it takes effect, unless a shorter period is required by law or to address a security risk. If you do not agree to a material change, you may close your account before it takes effect. Please check this page from time to time.

Related: Terms · Security · Subprocessors · Data Processing Addendum · Contact