Polyverto Privacy Policy

Polyverto Privacy Policy

Version 1.1 Effective date: 2 October 2026

This Privacy Policy explains how Polyverto OÜ ("Polyverto", "we", "us", or "our") processes personal data when you visit polyverto.com, sign in, submit a translation job, make a payment, request a refund, contact us, or otherwise use our services.

We designed Polyverto around data minimisation. We collect account and billing information needed to secure access, recognise returning customers and administer transactions. Customer document content is not intended to be retained after a translation job reaches an end state.

1. Who is responsible for your data?

The data controller is:

Polyverto OÜ Registry code: 17613868 Registered address: Ruunaoja tn 3, 11415 Tallinn, Estonia Website: polyverto.com Privacy contact: privacy@polyverto.com

Polyverto has not appointed a Data Protection Officer unless and until appointment becomes legally required.

Questions or requests concerning personal data may be sent to:

privacy@polyverto.com

2. What personal data do we process?

Authentication information

Polyverto supports account access through email and password, email sign-in links, and Google sign-in.

For email accounts, we process your email address, full name, password verifier, email-verification status and account-security records. We store a one-way password hash rather than your readable password. Password reset and email-verification links use short-lived, single-use tokens.

When you authenticate through Google, it may transmit authentication information to Polyverto.

Polyverto retains your email address so that we can recognise you when you return and associate you with your jobs, purchases and refunds.

We do not intentionally build a broader personal profile from your OAuth information.

When you create an account, we record whether and when you accepted the Terms and Privacy Policy, together with the policy versions. Email registration is not completed until you verify the email address.

You may optionally provide a billing profile after registration. It can include your country, billing address, whether the profile is for an individual or a business, a business legal name and a tax or VAT identifier. We use this information to administer billing and related transaction records. Billing profile fields are encrypted before they are stored by the financial service.

Authentication providers independently process information in accordance with their own privacy notices and terms.

Translation content

When you submit a translation job, Polyverto temporarily processes:

• the document or text you submit;
• the text extracted from that document where applicable;
• the translated output;
• translation instructions you provide;
• source and target language information; and
• other information necessary to perform the requested translation.

Documents may incidentally contain personal data relating to you or other people.

Depending on the document, this may include sensitive information such as health information, legal information, financial information or other special-category personal data.

Polyverto processes document content only for the purpose of providing the service you requested, except where you separately and voluntarily agree to the improvement process described in Section 11.

Transaction and job information

Polyverto may process information necessary to administer a job and its payment, including the job identifier, submitted filename, source and target languages, translation settings, job status and timestamps, price, payment status, refund status and information necessary to reconcile the transaction. These job records can remain after the document content has been deleted.

Separate activity records for job creation, translation requests and completion may include your account identifier, job identifier, original filename, selected model, languages, input type, formatting choice, status and activity time. The application configuration schedules these activity records for deletion after 90 days by default; deployments may override that setting.

Polyverto does not need to receive or store your complete payment-card number when your payment is handled directly by a payment service provider.

Communications

If you contact us, we process the information contained in your communication and the information necessary to respond. Messages sent through the support assistant and relevant conversation history may be stored in encrypted form, linked to your account, and deleted early when you delete the conversation. Conversations expire after the configured retention period, which is 30 days by default in the application.

Refund feedback

If you use the voluntary Polyverto Satisfaction Guarantee, we process your selected refund amount, primary reason, and required ratings for the overall process, product result, payment experience and ease of use. These structured answers are required only to use the Satisfaction Guarantee request function. They do not limit mandatory legal rights or automatic technical-failure refunds.

You may choose either a 50% or 100% refund in accordance with the Terms applicable to the job.

You may optionally select common issue phrases or write an explanation of up to 400 characters. Your written explanation is available to authorised support staff for service-improvement review and is not shown to other customers. We also use aggregate counts and ratings to identify common problems. The reusable issue phrases are managed by Polyverto staff; customer comments are never automatically published as suggestions.

Technical and security information

Our hosting, security or application infrastructure may process technical information necessary to deliver and protect the service, such as an IP address, request information, timestamps, browser/device information and security events. Application logs may also include account or job identifiers, selected models, correlation identifiers, and operational metadata. The translation service's prompt logger records a call label and prompt length rather than prompt text. This Policy does not establish how long application logs are retained, or whether independently configured log collectors, monitoring tools, or provider systems retain request data.

3. Why do we process personal data?

Our principal purposes and legal bases are:

GDPR expressly recognizes contract performance, legal obligations, consent and legitimate interests as possible lawful bases. EUR-Lex

Where we rely on legitimate interests, our interests include securing Polyverto, preventing fraud and abuse, maintaining service reliability, defending legal claims and operating the service efficiently. We assess those interests against the rights and interests of affected individuals.

4. Special-category and sensitive information

Documents submitted for translation may contain information concerning health, ethnicity, religion, political opinions, trade-union membership, genetics, biometrics, sexual life or sexual orientation. GDPR imposes additional restrictions on processing these categories of data. EUR-Lex

You should submit such information only where you are legally entitled to have it processed.

If you submit information relating to another person, you are responsible for ensuring that you have the necessary authority or legal basis to provide that information for translation.

For business customers that determine the purposes and means of processing personal data contained in documents, Polyverto may act as a processor rather than the controller of the document content. Where required, an appropriate Data Processing Agreement should govern that relationship.

5. How long do we keep translation documents?

When a job reaches a terminal state, the application clears source text, translation instructions and saved checkpoints from its active database records, and attempts to delete the temporary source file. Scheduled cleanup checks terminal jobs again, so file removal can be delayed if cleanup fails. Unpaid jobs are configured to expire after 30 minutes; expiry cleanup runs periodically, so this is not a 30-minute source-file deletion guarantee.

A successful translated result is configured to remain available in Previous jobs for 30 days from completion. You can request its removal earlier using Delete result in your job history. The expiry time controls availability; scheduled file cleanup may occur later.

Job records use a separate 30-day age threshold and may remain longer while a result is within its retention period or file cleanup fails. Activity records use a 90-day default with daily cleanup. Support conversations use a 30-day default with hourly cleanup. These are application defaults and schedules, not guarantees about deployed overrides. Backup copies and provider-side retention are not established by this application cleanup code.

6. How long do we keep other information?

Your account information may be retained while your account is active and as needed to recognise you as a returning Polyverto customer. You may request account deletion; some transaction or consent records may need to be retained where there is an overriding legal reason.

Accounting source documents and business records necessary to reconstruct transactions are generally required to be preserved in Estonia for seven years from the end of the relevant financial year. Riigi Teataja

Payment, refund and transaction information may therefore be retained where necessary to comply with these requirements or other applicable tax/accounting obligations.

Support or dispute records may be retained for as long as reasonably necessary to resolve the matter, comply with law, or establish, exercise or defend legal claims.

Security information is retained only for the period necessary for the security purpose for which it was collected.

7. Who receives personal data?

Polyverto does not sell customer personal data.

We may disclose or make personal data available only where necessary to categories of recipients including:

Authentication provider. Google processes authentication information when you choose Google sign-in. Polyverto currently offers Google as its third-party sign-in option.

OpenAI. Polyverto uses OpenAI for Translation and the Support Assistant. Necessary document content, support messages and relevant conversation history may be sent to OpenAI to provide those services.

Cloud and infrastructure providers. Hosting, storage, database, networking, security and operational service providers may process information necessary to run Polyverto.

Payment service. Polyverto's financial service records payment and refund information for the application. The current checkout uses a mock provider for testing; no real external payment processor collects a payment.

Email and communication providers. Providers may process information necessary to send transactional or support communications.

Professional advisers and authorities. Accountants, lawyers, auditors, regulators, courts or authorities may receive information where necessary or legally required.

8. AI processing

Polyverto uses OpenAI to provide Translation and the Support Assistant.

Necessary document content may therefore be transmitted to OpenAI for processing. Messages sent through the support assistant, together with relevant conversation history, may also be transmitted to OpenAI to generate a reply.

The retention and data-use treatment of content sent to OpenAI depends on the account controls, settings and contractual terms applicable to the service. Polyverto does not make a promise here about a particular OpenAI retention or training setting.

Polyverto does not use customer source documents or translated documents to train Polyverto's own AI models.

This Policy does not make a representation about provider-side retention or training beyond the controls and contractual terms that apply to the relevant OpenAI service.

9. International transfers

Some technology providers used by Polyverto may process information outside Estonia or elsewhere outside the European Economic Area.

Where GDPR requires safeguards for a transfer outside the EEA, Polyverto will use an applicable lawful mechanism, such as:

• an EU adequacy decision;
• Standard Contractual Clauses approved by the European Commission; or
• another mechanism permitted by applicable data-protection law.

You may contact privacy@polyverto.com for information about safeguards applicable to a particular transfer.

GDPR requires information about third-country transfers and the applicable safeguards to be included in the transparency information provided to data subjects. EUR-Lex

10. We do not sell your data or use documents for advertising

Polyverto does not sell your personal data.

Polyverto does not use the contents of your documents for behavioural advertising.

Polyverto does not create advertising profiles from documents submitted for translation.

11. Separate optional use of examples for technical improvement

The structured ratings and selected issue phrases described above are stored for Satisfaction Guarantee administration and aggregated service-quality review. They are not displayed to other customers. Separately, if you are dissatisfied with a translation, you may optionally provide examples for a further technical-improvement process.

Your refund does not depend on agreeing to allow those examples to be used for system improvement.

Where you separately consent, Polyverto may temporarily process the examples you provide to derive generalized improvement points.

For example, a specific customer example might be transformed into an abstract engineering instruction such as:

Maintain consistent defined terminology throughout a legal document.

The objective is to retain the general lesson, not the customer's content.

The resulting improvement points may later be used for:

• prompt engineering;
• translation-quality evaluation;
• testing;
• software development;
• architecture decisions;
• internal coding agents; and
• improving Polyverto's translation system.

Polyverto will not intentionally retain in the resulting improvement point:

• source-document passages;
• translated passages;
• names;
• email addresses;
• case numbers;
• medical information;
• identifying details;
• customer secrets; or
• other content capable of linking the improvement point back to a particular customer or document.

Once the generalized improvement point has been created, the source examples submitted for this improvement purpose will be deleted.

If the resulting information has been genuinely anonymised so that it can no longer reasonably identify or be linked to an individual, it is no longer personal data for GDPR purposes.

If it remains identifiable, we continue to treat it as personal data.

12. Consent to improvement processing

Consent to improvement processing must be separate and optional.

It will not be bundled into:

• acceptance of the Terms;
• the translation purchase;
• the right to receive a refund; or
• ordinary use of Polyverto.

You may withdraw consent at any time by contacting:

privacy@polyverto.com

Withdrawal does not affect processing that lawfully occurred before withdrawal.

Once information has already been irreversibly anonymised into a generalized rule that can no longer be linked to you, withdrawal cannot restore an association that no longer exists.

GDPR requires consent to be freely given and distinguishable from other matters, and it must be as easy to withdraw as to give. EUR-Lex

13. Cookie policy

This page explains the cookies and browser storage Polyverto currently uses. We do not use analytics or advertising cookies, and we do not ask you to consent to storage used only to provide features you request. No cookie banner is shown.

This is information about the storage used for the features described here, not a request for consent. No cookie banner is shown.

1. Sign-in and temporary storage

Local storage holds your sign-in token and basic account details until you sign out or clear browser data. The sign-in token expires after 24 hours. Session storage temporarily holds translation form fields and pending actions in this browser tab; translation drafts expire after 30 minutes without activity. Uploaded source files are not stored in browser storage.

The OAuth cookies are HTTP-only, Secure, and limited to the sign-in flow. They expire after three minutes and are removed when sign-in completes.

2. Preferences

Local storage remembers your selected language and light or dark display preference across visits. These preferences remain on the device after sign-out. You can clear them through your browser settings.

3. Analytics and advertising

Polyverto does not currently use analytics or advertising cookies or similar browser storage. If we introduce non-essential storage that requires consent, we will explain its purpose and provide a real choice before it is used.

4. Managing browser storage

You can manage or clear browser storage through your browser settings. Signing out removes your sign-in data and translation draft from this browser tab. On a shared device, sign out and close the tab when you finish.

14. Payment information

The current checkout uses a mock payment provider for testing. It simulates successful payment in the application; no real external payment processor processes a charge.

No real payment provider currently collects card or bank information through this checkout.

Polyverto's financial service may record information such as:

• whether payment succeeded;
• transaction identifier;
• amount;
• currency;
• payment status; and
• refund status.

15. Your GDPR rights

Subject to the conditions and limitations in applicable law, you may have the right to:

• obtain confirmation whether we process your personal data and receive access to it;
• correct inaccurate data;
• request deletion;
• restrict processing;
• receive eligible data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

Your rights under GDPR include rights of access, objection and safeguards relating to certain automated decision-making. EUR-Lex

To exercise a right, contact:

privacy@polyverto.com

We may need to verify your identity before acting on a request.

Some information cannot immediately be deleted where retention is required by law, such as applicable accounting records.

16. Automated processing

Translations are generated through automated software and artificial-intelligence systems.

However, Polyverto does not intend to use personal data to make solely automated decisions about you that produce legal effects or similarly significantly affect you within the meaning of GDPR Article 22.

The fact that the translation itself is generated automatically does not mean Polyverto is making a legal or eligibility decision about you.

17. Security

Polyverto uses technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Measures may include, as appropriate:

• encryption in transit;
• access controls;
• authentication controls;
• restricted administrative access;
• security monitoring;
• data minimisation; and
• short retention of document content.

No information system can be guaranteed to be completely secure.

If a personal-data breach occurs, Polyverto will comply with applicable GDPR notification obligations to supervisory authorities and affected individuals where those obligations apply.

18. Children

Polyverto's paid service is intended for users aged 18 or older.

We do not knowingly offer paid translation services directly to children.

If we learn that personal data has been provided in violation of this restriction, we will take appropriate steps consistent with applicable law.

19. Information concerning other people

A document you submit may contain personal information belonging to someone else.

You are responsible for ensuring that you are lawfully entitled to provide that information to Polyverto for translation.

This is particularly important for:

• medical records;
• employee information;
• customer databases;
• legal files;
• financial records; and
• confidential third-party documents.

Business customers that submit personal data under their own authority may have independent obligations as controllers under GDPR.

20. Data-processing agreements for business customers

Where a business customer acts as controller of personal data contained in documents and Polyverto processes that information solely on the customer's instructions, GDPR may require a processor agreement under Article 28.

Polyverto should make a Data Processing Agreement (DPA) available to such customers before offering production use for that scenario.

This Privacy Policy does not replace a DPA where one is legally required.

21. Complaints

You may first contact us at:

privacy@polyverto.com

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

Polyverto's Estonian supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Depending on GDPR jurisdiction rules, you may also be entitled to contact the supervisory authority in the EU/EEA country where you live, work, or where the alleged infringement occurred.

22. Changes to this Privacy Policy

We may update this Privacy Policy where our service, providers, technology or legal obligations change.

We will publish the current version and effective date on polyverto.com.

Where a change materially affects how we process personal data and applicable law requires additional notice or consent, we will provide that notice or obtain that consent.

We will not use an updated Privacy Policy as a mechanism to retroactively obtain consent for a materially different processing purpose.

23. Contact

Questions about privacy or personal-data requests should be sent to:

Polyverto OÜ Ruunaoja tn 3 11415 Tallinn Estonia

privacy@polyverto.com

legalContent.accountClosureHeading

legalContent.accountClosureText