Data Processing Agreement

Between you, the customer, as controller, and Transept, operated by Mariia Ivakhnenko, sole proprietor, Uralská 689/7, 160 00 Prague 6, Czech Republic, as processor. It covers the personal data in everything you put into Transept: documents, translations, glossaries, comments and messages to Literess.

It forms part of our Terms of Service and applies from the moment you use Transept. You don’t need to sign anything. If your client or your authority wants a signed copy, email support@transept.ai from your account address and we send this text countersigned. Where this agreement and the Terms differ on personal data, this agreement applies.

• Purpose: storing, translating, proofreading and exporting what you upload, and running the features you use on it. Nothing else.
• Data subjects: the people named in your documents, your clients, and the members of your team.
• Personal data: whatever your documents contain, for example names, addresses, dates of birth, identity and case numbers. If a document holds special categories of data or data about criminal convictions, that is processed too, under the same terms.
• Duration: for as long as the data is in your account. See “What happens to the data when you delete it?” below.

• We process your data only on your documented instructions: these terms, and what you do in the product. If we believe an instruction breaks data protection law, we tell you.
• Everyone who can reach your data is bound to confidentiality. Today that is the two people who run Transept, and nobody reads customer documents in routine work.
• We keep the security measures listed on Technical and organisational measures and update that page when they change.
• We use other processors only as described under “Who else handles the data?”.
• We help you answer requests from the people in your documents (access, correction, deletion) and with your security, breach and impact-assessment duties under GDPR Articles 32 to 36.
• When you delete your data or your account, we delete it, as described below.
• We give you the information you need to show that these duties are met, and allow audits as described below.

You give us general authorisation to use the sub-processors on our sub-processors page. Each one is bound by data protection terms at least as strict as these, and we remain responsible to you for what they do.

We announce a new sub-processor, or a new region for an existing one, on that page at least 14 days before it starts processing your data, and we email the primary contact of every paid account. You can object by email during that time. If we can’t meet your objection, you can close your account before the change applies to you.

Everything you store sits on Hetzner servers in Falkenstein, Germany. Processing outside the EU happens only for the length of a request:

• AI requests (translation, proofreading, Literess, reading PDFs and scans, translation-memory search) run on a mix of proprietary and open-source models from Anthropic and Google, through their APIs, mainly in the United States. Neither uses a request for training. Anthropic deletes a request within 30 days; its safety systems can keep a flagged request for up to two years.
• Literess’s routing decisions use TypeSafe’s decision model in the United States. It receives her recent conversation lines, not your documents.
• Long PDFs and scans can be read by our own text-recognition engine on Google Cloud in the Netherlands (EU).
• Cloudflare carries every connection to our servers and ends the encryption at the edge location nearest to you.

Each transfer to the United States rests on the provider’s data processing terms with the EU Standard Contractual Clauses, or on the EU–US Data Privacy Framework, as listed on the sub-processors page.

The measures are on Technical and organisational measures: access, encryption, logging, backups, deletion and incident response, including what we don’t have yet.

We tell you without undue delay, and within 72 hours of becoming aware of a breach that affects your data. We tell you what happened, which data and people are affected, the likely consequences and what we are doing about it, and we send more as we learn it. You decide whether to notify your supervisory authority and the people concerned; we help you do it.

• You can export at any time. Every document downloads in its original format or as plain text, so you never need us to return anything.
• Deleting a document removes it and its translations from our database at once. Deleting your account removes everything in it.
• Backups: we copy the database before each software update and keep the ten most recent copies, in Germany. Deleted data leaves the last of them as new copies replace old ones, usually within two days.
• Server logs keep requests and errors, never document text, for up to 90 days.
• AI providers keep a request for as long as stated under “Where is the data processed?”.

Yes. Most questions are answered by this agreement, the measures page and the sub-processors page, and we answer written security questionnaires. If you still need an audit, you or an auditor bound to confidentiality can carry one out once a year, with 30 days’ notice and at your own cost. Audits required by a supervisory authority are always possible.

The law of the Czech Republic, where Transept is registered, and the GDPR. Liability follows our Terms of Service. This agreement ends when your account is closed and the data is deleted.

Under GDPR Article 30 you list the processors you use. The entry for Transept:

• Processor: Mariia Ivakhnenko, sole proprietor, operating Transept, Uralská 689/7, 160 00 Prague 6, Czech Republic. Contact: support@transept.ai.
• Purpose: translation, proofreading and storage of documents.
• Categories of data: the personal data in the documents you upload, for example names, addresses, dates of birth, identity and case numbers.
• Data subjects: the people named in the documents, your clients.
• Storage: Germany (Hetzner, Falkenstein).
• Transfers outside the EU: per request, to the AI providers on transept.ai/subprocessors, under the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
• Deletion: at once when you delete a document or account; backup copies within about two days.
• Security measures: transept.ai/security/measures.

The same entry as a one-page PDF to file: English, Deutsch, Polski.