Last updated: May 13, 2026
TranslateInDesign is operated by One Day Build, located in Goa, India. One Day Build is the data controller for personal data processed through translateindesign.co (“the Service”).
For privacy inquiries and data requests: privacy@translateindesign.co
TranslateInDesign is built on a privacy-first architecture. Your files are never retained beyond what is strictly necessary to complete translation and give you time to download your output. This policy explains exactly what we collect, how we use it, your rights, and what we do not do.
When you upload an IDML file, it is received by our servers for processing only. Your file:
If you create an account or make a payment, we collect:
We collect minimal technical metadata to operate the Service:
We do not log the text content of your files at any point.
For users in the EU/EEA and UK, we process personal data on the following bases under GDPR Article 6:
| Processing Activity | Lawful Basis |
|---|---|
| Processing uploaded files for translation | Art. 6(1)(b) — performance of a contract |
| Account management | Art. 6(1)(b) — performance of a contract |
| Payment processing | Art. 6(1)(b) — performance of a contract |
| Transactional emails | Art. 6(1)(b) — performance of a contract |
| Usage analytics (aggregate) | Art. 6(1)(f) — legitimate interest (service reliability) |
| Marketing communications | Art. 6(1)(a) — consent (opt-in only) |
| Financial record retention | Art. 6(1)(c) — legal obligation |
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Anthropic Claude API | Machine translation | File text content (ephemeral) | USA |
| Supabase | Database and authentication | Account data, job metadata | USA |
| Paddle | Payment processing | Name, email, billing details | UK |
| Resend | Transactional email | Email address | USA |
| Railway | Application hosting | Encrypted data in transit | USA |
| Google Analytics | Usage analytics (aggregate) | Anonymised usage data | USA |
We will update this table if we add new subprocessors. We do not share your data with any parties not listed here.
| Data Type | Retention Period |
|---|---|
| Uploaded IDML files | 30 days post-completion, then permanently deleted |
| Translation output files | 30 days post-completion, then permanently deleted |
| Failed/cancelled job files | 48 hours, then permanently deleted |
| Payment records | 7 years (legal requirement) |
| Account data | Until account deletion requested |
| Usage metadata | 90 days (aggregate only) |
After the 30-day window closes, we cannot recover your files. Download your translated output promptly.
All data is transmitted over TLS. Files are processed in isolated, ephemeral containers. We do not store encryption keys alongside your data. Access to production systems is restricted to authorised personnel.
Depending on your location, you may have rights over your personal data. EU/EEA/UK users have the following rights under GDPR:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of personal data we hold about you |
| Rectification (Art. 16) | Correct inaccurate personal data |
| Erasure (Art. 17) | Request deletion of your personal data (see below) |
| Restriction (Art. 18) | Request we limit processing of your data |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest |
| Withdraw consent (Art. 7(3)) | Withdraw consent for marketing at any time |
To exercise any of these rights, email: privacy@translateindesign.co
You also have the right to lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority).
To request deletion of your account and all associated personal data:
What we delete: account record, translation job history, uploaded files (if not already purged), translation outputs (if not already purged), waitlist entry, and marketing consent records.
What we cannot delete: payment transaction records are retained for 7 years under applicable financial law. We will flag your account as deleted in our payment processor but cannot erase legally required billing records.
We use cookies and similar technologies as described below. You can manage your cookie preferences via the banner shown on your first visit.
| Category | Purpose | Can be declined? |
|---|---|---|
| Strictly Necessary | Session management, authentication, security | No — required for the Service to function |
| Analytics | Understanding aggregate usage patterns (no cross-site tracking) | Yes — does not affect Service functionality |
| Marketing | Not currently used | N/A |
One Day Build is based in India. Our subprocessors are primarily based in the USA. Data transfers from the EU/EEA to these providers are covered by Standard Contractual Clauses (SCCs) and provider-specific data processing agreements where applicable.
We are exempt from the requirement to appoint an EU/EEA representative under GDPR Article 27(2). Our processing of EU personal data is occasional, does not include special category data as defined in GDPR Article 9, and is unlikely to result in a risk to the rights and freedoms of natural persons.
EU supervisory authorities may contact us directly at privacy@translateindesign.co.
The Service is not directed to children under 13. We do not knowingly collect personal information from children.
We will update this page with a revised “Last updated” date if this policy changes. We will not retroactively apply less protective practices to data collected under prior versions.
One Day Build
Goa, India
For privacy questions, data requests, or to exercise your GDPR rights: privacy@translateindesign.co
We respond to all requests within 3 business days.