Privacy Policy

1. Data Controller

Wordzilla is operated by Crystalbyte. As the data controller within the meaning of the General Data Protection Regulation (GDPR), we are responsible for the processing of your personal data when you use this service. If you have any questions about this policy or how your data is handled, please contact us at privacy@wordzilla.io.

2. Data We Collect

We collect the following categories of personal data:

• Account data: Your email address, display name, and profile picture obtained via OAuth (Google, GitHub) or email registration.
• Translation content: Source strings and translations you upload or create within projects.
• Payment data: Transaction records including credit purchases and usage. Full card details are processed exclusively by Stripe and are never stored on our servers.
• Usage and analytics data: Pages visited, features used, session duration, and interaction events, collected via PostHog. Without your consent, analytics are collected anonymously and without cookies — no user identity, email address, or account information is linked to these events. If you allow the Analytics category in our cookie banner, these events are linked to your account via your user ID.
• Technical data: IP address, browser type, operating system, and device information collected automatically during your session.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)): Processing your account and translation data is necessary to provide the Wordzilla service.
• Legitimate interest (Art. 6(1)(f)): Anonymous, cookieless analytics data is processed to understand how users interact with our product and to improve it.
• Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): Account-linked analytics with PostHog (Analytics category) and Google Ads conversion measurement (Marketing category) are only used if you allow the respective category in our cookie banner. You can choose each category separately.
• Legal obligation (Art. 6(1)(c)): Payment records are retained to comply with accounting and tax regulations.

4. How We Use Your Data

• To authenticate you and manage your account.
• To store and process your translation projects and strings.
• To deduct credits and process payments for the auto-translation feature.
• To send transactional emails (e.g. email verification, password reset).
• To analyze usage patterns and improve product features.
• To detect and prevent fraud or abuse.

5. Third-Party Services

We use the following sub-processors. Each operates under its own privacy policy and, where applicable, a Data Processing Agreement (DPA) with us.

6. Cookies

Wordzilla uses the following types of cookies and local storage:

• Authentication session: A session token stored in local storage by Supabase to keep you logged in. This is strictly necessary for the service to function.
• Analytics (with consent): PostHog sets cookies to recognize your sessions and link usage to your account. Without consent, PostHog works without cookies. These are not required for core functionality.
• Advertising (with consent): Google Ads sets cookies to attribute sign-ups and purchases to ad clicks. These are not required for core functionality.
• Consent choice: Your cookie banner choice is stored in local storage so we don't ask again on every visit. This is strictly necessary.

7. Data Retention

• Account and project data: Retained for as long as your account is active. Deleting your account permanently removes your profile and all associated projects.
• Transaction records: Retained for 7 years in accordance with applicable tax and accounting regulations.
• Analytics data: Retained for 12 months in PostHog, after which it is automatically deleted.

8. International Data Transfers

Our databases are hosted in the United Kingdom, for which the European Commission has adopted an adequacy decision under Article 45 GDPR. Some of our sub-processors (including OpenAI, Stripe and Google) are based in the United States. Where data is transferred to other countries outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Chapter V of the GDPR.

9. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests, including analytics.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@wordzilla.io. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you via email or a prominent notice within the application. Continued use of Wordzilla after changes are posted constitutes your acceptance of the updated policy.

11. Contact

For any privacy-related inquiries or to exercise your rights, please reach us at:
privacy@wordzilla.io