Trust & data
What happens to our content?
A plain description of where your content goes, who can reach it, and what we do and do not do with it. Only what is true of the product today.
The short answers
Is our content stored?
Yes. Source content, localized versions, review comments and the Context you build are stored in our database so the product can work. Everything is scoped to your workspace.
Is it used to train AI models?
No. Your content is not used to train or fine-tune any model, and it is never used to improve results for another customer. Approved language memory stays inside your own workspace.
Who can see it?
Members of your workspace, according to their role. External reviewers see only the market they were invited to review. Our staff only where it is necessary to run or support the service, and those actions are logged.
Can we get it deleted?
You can delete items in the product yourself. Account deletion and a full data export are handled manually today — email us and we will action it.
Where your content actually goes
Stored by Localizethat
- Source content you paste, upload or import
- Localized versions, segment edits and revision history
- Context you create — brand voice, terminology, claims, market guidance
- Approved language memory generated from content you approved
- Review comments, suggested edits and approvals
- Account, workspace, usage and credit records
Sent to an AI provider
To produce a localization, analyse source content and build the search index over your Context, we send the source text and the relevant compiled Context to an AI provider. Model calls are routed through the Lovable AI Gateway to Google Gemini models.
Nothing is sent to any other AI provider, and nothing is sent for training. If you never run a localization, no content leaves our own systems.
Service providers we use
- Lovable Cloud (built on Supabase) — database, authentication and file storage
- Cloudflare — hosting and delivery
- Lovable AI Gateway → Google Gemini — localization, analysis and embeddings
- Lovable email delivery — transactional email from notify.localizethat.com
- Paddle — payment processing (we never see your card details)
- Google — sign-in and, if you connect it, Drive import
This is the complete current list. Processing regions and transfer mechanisms are still being confirmed per provider, and we describe them in the Privacy Policy rather than claim something we have not verified.
Who can reach what
Workspace isolation
Content belongs to a workspace, not to an account. Access is enforced in the database itself through row-level security policies tied to workspace membership and role — not only in the interface.
Reviewer boundaries
An external reviewer opens a link scoped to one market of one project. They see the source, that market’s localization and the findings — not your other markets, not your other projects, and not your Context library.
Links expire
Invitations and review links use hashed tokens with an expiry. Once expired, the link no longer opens anything.
Connections are per person
If you connect Google Drive, the connection belongs to your user and the credentials are stored encrypted. Access to your Drive files is read-only; saving output uses a narrow scope limited to files Localizethat creates.
Staff access is logged
Our staff can reach workspace data only where it is necessary to operate or support the service, and administrative actions are recorded in an internal audit log.
In transit
Traffic to the service is served over HTTPS.
We hold no security certifications and we do not claim any. We describe only controls that are actually implemented. No service can be guaranteed to be completely secure.
Keeping and deleting
Retention
Today we keep workspace data, customer content, approved language memory, usage records and audit records for as long as the account and workspace exist, unless you delete individual items yourself in the product.
We have not yet published fixed retention periods per category. We would rather state that than advertise a period we do not currently enforce.
Deletion
In the product you can delete individual content items, projects and Context entries, remove members, and let invitations and review links expire.
Account deletion and a full personal-data export are not self-service yet. Email contact@localizethat.com and we will handle it manually. Deleting a personal account does not automatically remove shared workspace records the workspace still relies on.
Policies
Privacy Policy
What personal information we handle and why.
ReadTerms of Service
The agreement covering use of Localizethat.
ReadCookie Policy
Every cookie and storage key we use.
ReadRefund Policy
How credit purchases and refunds work.
ReadNeed a Data Processing Agreement, a subprocessor list with regions, or answers to a security questionnaire? A DPA is not yet available — email contact@localizethat.com and we will tell you exactly where we stand.
Start with content you are comfortable sharing
You decide what goes in. Try it with one asset before you bring anything sensitive.