Saintara1. Who We Are
Saintara ("we", "us", "our") is the data controller for personal data processed through this website and our translation service. Contact us at [email protected] with any privacy-related questions.
2. What Data We Collect
We collect only what is necessary to provide the Service:
- Account data — your name, email address, website URL, and company name, collected when you register for an account
- Billing data — your subscription plan, billing period, and a Stripe customer/subscription reference. Payments are processed by Stripe; we do not store your full card details
- Provider API key — your third-party translation provider API key (BYOK clients only), stored in encrypted form and never logged or transmitted beyond your designated provider
- Translation cache — translated text strings are cached to reduce repeat translation calls, and are automatically removed after 90 days without being requested. These are content strings, not personal data
- Usage data — basic server logs (IP address, timestamp, request path) retained for up to 30 days for security and debugging purposes
We do not store your full payment card details (these are handled by Stripe), nor do we collect data from your website visitors beyond the page content sent for translation.
3. Legal Basis for Processing
We process your data on the following legal bases under UK/EU GDPR:
- Contract performance (Art. 6(1)(b)) — account data and Provider API key are processed to deliver the Service you signed up for
- Legitimate interests (Art. 6(1)(f)) — server logs are retained for security monitoring and fraud prevention
- Legal obligation (Art. 6(1)(c)) — we may retain certain data where required by applicable law
4. How We Use Your Data
- To authenticate you and maintain your session
- To process translation requests on your behalf (using your Provider Key for BYOK, or our own capacity for Managed)
- To manage your subscription and process payments via Stripe
- To send transactional emails (verification, password reset, trial and billing notifications)
- To investigate security incidents or abuse
We do not use your data for advertising, profiling, or sell it to third parties.
5. Third Parties
We share data with the following third parties only as necessary to provide the Service:
- Translation providers — DeepL, OpenAI, or Amazon Translate (whichever applies to your plan). Content strings are sent to the provider for translation. Each provider has its own privacy policy and data processing terms.
- Stripe — payment processor. Handles your card details and subscription billing. We receive only a customer/subscription reference and payment status, never your full card number.
- Resend — transactional email provider. Used to deliver account, security, and billing emails to your address.
- Hetzner — cloud infrastructure provider. Our servers are located in Germany. Hetzner is GDPR-compliant.
6. Cookies
We use strictly necessary cookies only:
- sb_client_token — authenticates client portal sessions. HttpOnly, secure.
- sb_token — authenticates admin sessions. HttpOnly, secure, expires after 7 days.
These cookies are strictly necessary for the portal and admin interfaces to function. No consent is required for strictly necessary cookies under GDPR. We do not use analytics, advertising, or tracking cookies.
Web fonts are self-hosted rather than loaded from a third-party CDN, so no data about your visit is sent to a font provider.
7. Data Retention
- Account data — retained for the lifetime of your account, deleted within 30 days of account closure
- Translation cache — automatically removed after 90 days without being requested
- Server logs — retained for up to 30 days
- Billing records — retained for 7 years as required by financial regulations
8. Your Rights
Under UK/EU GDPR you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your account and personal data
- Portability — receive your data in a structured, machine-readable format
- Restriction — request we limit processing of your data
- Objection — object to processing based on legitimate interests
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with your national data protection authority (UK: ICO at ico.org.uk).
9. Data Security
We implement appropriate technical and organisational measures to protect your data, including secure encrypted storage of API keys, HTTPS enforcement, and rate limiting. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance.
11. Contact
For any privacy questions or to exercise your rights: [email protected]