Privacy Policy

This Privacy Policy explains how Proxylang, operated by TITUS TIMOTHY DAVID ("Company," "we," "us," or "our"), collects, uses, and protects information when you use our services ("Service"). The Service includes our website translation proxy, Proxylang LiveChat, and the Proxylang LiveChat applications for iOS, Android, macOS, Windows and Linux.

By using our Service, you agree to the collection and use of information as described in this policy. We are committed to protecting your privacy and being transparent about our data practices.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Name (optional)
• Password (encrypted)
• Company name (optional)
• OAuth provider information (if using social login)

1.2 Domain and Configuration Data

When you configure the Service, we store:

• Domain names you register for translation
• Source and target language preferences
• Widget customization settings
• Translation exclusion rules

1.3 Website Content (Processed Temporarily)

When translating your website, we process:

• Text content from your web pages
• HTML structure (for translation targeting)
• URL paths and page structure
• Meta tags and SEO content

1.4 Usage and Analytics Data

• Translation request counts and patterns
• Page views per language
• Geographic distribution of requests (country, region, and city level)
• Response times and performance metrics
• Error logs and debugging information

For Full Proxy mode customers, we additionally store a pseudonymous visitor identifier (derived from a salted hash of IP and User-Agent — the raw IP is never retained), session identifier, browser, operating system, and device type, on the customer's behalf as a data processor. WordPress plugin Hybrid mode does not collect visitor analytics.

1.5 Payment Information

Payment processing is handled by different providers depending on the payment method: international card payments by Polar (via Stripe), and domestic Korean (KRW) card payments by PortOne (Korea PortOne Inc.) together with the payment gateway KG Inicis. We do not store credit card numbers or full payment details. We only store:

• Subscription status and tier
• Customer ID (from payment provider)
• Billing history and invoice records

1.6 Information We Do NOT Collect

• User passwords from your website's visitors
• Private messages or user-generated content (unless publicly displayed)
• Payment information from your website's customers
• Content from password-protected pages (unless explicitly proxied)
• Personal information about visitors to your translated website

2. How We Use Information

We use collected information to:

• Provide the Service: Translate and serve your website content
• Improve Performance: Cache translations, optimize delivery, reduce latency
• Analytics: Show you usage statistics and language distribution
• Billing: Process payments and manage subscriptions
• Support: Respond to your inquiries and troubleshoot issues
• Security: Detect and prevent abuse, fraud, and security threats
• Communication: Send service updates, usage alerts, and important notices
• Legal Compliance: Meet regulatory and legal obligations

3. AI Translation and Third-Party Data Sharing

3.1 Translation Providers

Text content from your website is sent to third-party translation providers for processing. Depending on the target language or use case, translation providers may include Google, Anthropic, OpenAI, or other AI providers operated by Proxylang.

All personally identifiable information is automatically redacted prior to transmission to any translation provider. No submitted text is used to train AI models.

3.2 PII Protection Before Translation

Before sending content to translation providers, we automatically detect and redact personal information, including:

• Email addresses
• Phone numbers
• Physical addresses
• Credit card numbers
• Social security numbers
• Other identifiable patterns

Redacted content is replaced with placeholder tokens during translation and restored in the final output.

3.3 What We Send to Providers

• Sent: Text content with PII removed, source/target language codes
• NOT Sent: Your user data, authentication credentials, images, media files, your visitors' personal information

3.4 AI Provider Data Usage

We use API-only access to translation providers:

• Content is processed solely for the purpose of translation
• Providers may retain content temporarily for abuse prevention
• Content is not used to train any AI models

4. Other Third-Party Services

For the complete subprocessor list with regions, DPA links, and change-notification commitments, see our subprocessors page .

4.1 Entrustment of Personal Data Processing (Korea, PIPA Article 26)

To provide domestic (KRW) payment services, we entrust the processing of certain personal data to the parties below. Each entrustment contract requires the processor to safeguard personal data in accordance with Korea's Personal Information Protection Act (PIPA).

5. Data Retention

5.1 Cache Invalidation

You can clear cached translations for your domain at any time through the dashboard. This will remove all translated content from our caches.

6. Cookies and Tracking

6.1 Cookies We Use

• Authentication: Session cookies to keep you logged in
• Language Preference: Cookie to remember visitor language selection (proxylang_lang)
• Theme Preference: Cookie to remember dark/light mode

6.2 Cookies We Do NOT Use

• Third-party advertising cookies
• Cross-site tracking cookies
• Social media tracking pixels

6.3 Visitor Tracking on Translated Sites

Visitor tracking depends on the integration mode:

• WordPress plugin (Hybrid mode): We do not collect any per-visitor analytics. Only the requested URL path and the visitor's User-Agent are transmitted, and only for search-engine bot requests.
• Full Proxy mode: On the customer's behalf as a data processor, we collect a pseudonymous visitor identifier (salted hash, raw IP discarded), session identifier, country/region/city, browser, operating system, and device type. We do not link this data to a real-world identity. The customer is the data controller and is responsible for disclosing this collection in their own privacy notice and obtaining any required visitor consent.

7. International Data Transfers

Your data may be processed in multiple jurisdictions:

• Edge Processing: Global CDN network (300+ locations worldwide)
• AI Translation: Third-party translation providers (various jurisdictions)
• Database & Cache: Distributed infrastructure (multiple regions)

7.1 Safeguards

For international data transfers, we rely on:

• Standard Contractual Clauses (SCCs) with providers
• Provider certifications (SOC 2, ISO 27001 where applicable)
• Data Processing Agreements (DPAs)

7.2 EU Users (GDPR)

For GDPR purposes, we act as a "data processor" when translating your website content. You (the website owner) remain the "data controller" and are responsible for:

• Ensuring you have appropriate legal bases for processing visitor data
• Providing privacy notices to your website visitors
• Responding to data subject requests from your visitors

8. Your Rights

8.1 Account Holders

You have the right to:

• Access: View your account data through the dashboard
• Export: Download your settings and configuration
• Correction: Update your account information
• Deletion: Delete your account and all associated data
• Clear Cache: Remove all cached translations for your domains
• Object: Opt out of marketing communications

8.2 Visitors to Translated Websites

If you are a visitor to a website using Proxylang for translation:

• Contact the website owner directly for privacy requests
• We do not maintain persistent visitor profiles
• We will assist website owners in fulfilling legitimate data requests

8.3 California Residents (CCPA)

California residents have additional rights under the CCPA:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising privacy rights

To exercise CCPA rights, email hello@proxylang.dev with the subject line CCPA Request — [your account email]. We respond within 45 days, as required by CCPA.

9. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest
• Secure authentication with password hashing
• Regular security audits and monitoring
• Access controls and principle of least privilege
• DDoS protection through Cloudflare

While we take security seriously, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

10. Proxylang LiveChat Applications

Proxylang LiveChat is the agent console for our live chat product. It is used by staff at businesses that use Proxylang, not by their website visitors. This section describes the mobile and desktop applications. It adds to the rest of this policy and does not replace it.

What the applications collect

• Your account email address and user ID. Used to sign you in and to determine which conversations you may see. This is the same account you use on proxylang.dev.
• Conversation content. Messages exchanged between your business and its website visitors, their translations, and any photos sent in those conversations. The applications display and send this content; they do not create a separate copy of it.
• Your presence and activity in a conversation. Whether you are marked online or away, which conversation you have open, whether you are typing, and when you have read a message. Your teammates see this so that two people do not answer the same visitor.
• A device notification token. Issued by Apple or Google so we can deliver a notification when a visitor writes to you. See below.

What the applications do not collect

• No advertising identifiers, and no cross-app or cross-site tracking
• No analytics or advertising software development kits
• No location data
• No contacts, calendar or health data
• No microphone access

Push notifications

If you allow notifications, your device is issued a token by Apple Push Notification service or Firebase Cloud Messaging. We store that token against your account so we can tell you when a visitor has written. The token identifies the device, not you personally, and we delete it when you sign out, turn notifications off, or uninstall the application. Notification text may include the sender's name and a preview of the message, which your operating system displays according to your own settings. We never use these tokens for marketing.

Camera and photo library

The applications ask for camera and photo library access only at the moment you attach a photo to a conversation, and only for that purpose. If you decline, every other part of the application continues to work. The applications do not read your photo library in the background or at any other time. Photos sent in conversations are deleted automatically 14 days after they are uploaded.

Data stored on your device

The applications keep your sign-in session and a short cache of your recent conversations on the device, so the console opens without reloading everything. Signing out clears both, and deleting the application removes them.

Your choices

Your agent account is administered by the business you work for. To correct or delete your account, or to ask what is held about you, contact that business's account owner or write to us using the details in the Contact section below. Conversation content belongs to the business, and requests about it are handled through them.

11. Children's Privacy

Our Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending an email for significant changes

13. Contact Us

For privacy-related questions or to exercise your rights, contact us:

We will respond to privacy requests within 30 days.