1. Who we are

Babel Automata Ltd (the company behind Polytxt) is a UK-based AI-assisted document translation service. Our registered office is in Edinburgh, Scotland. For any privacy enquiry contact us.

2. What data we collect

We hold three categories of data:

• Account data — email address, password hash, role, and account preferences. Only collected if you register an account; the free AI preview works without one.
• Document data — the documents you upload, their extracted text from OCR, our AI drafts, and any human-certified translations.
• Audit data — an append-only log of every action taken on a job (upload, language detection, AI invocation, human review, sign-off, download). Audit data is metadata only and contains no document content.

3. Why we collect it

We hold account data to authenticate you and personalize your experience. We hold document data to translate the documents you uploaded. We hold the audit log so every translation is defensible and traceable — a requirement for certified translation work.

4. How long we keep it

Guest uploads (no account) are held for 30 days, then automatically purged by a nightly retention task. Documents saved to an account (claimed after sign-up) are retained for as long as the account is active. Audit-event metadata (no document content) is retained for a longer compliance window per our retention policy, and is what we use to defend a translation if a UK authority queries it.

5. Who can see your documents

Documents are processed by:

• Polytxt systems running in UK data centers — OCR, language detection, structural analysis.
• Our AI translation provider — we send the extracted text to the AI provider via their secure API. The provider operates under a Data Processing Agreement that prohibits use of your data for training their models.
• Qualified human translators — only if you request the human-certified upgrade. Each translator is contractually bound by NDA and processes documents inside our reviewer portal under audit.

We do not share your documents with advertisers, marketers, AI-training datasets, or any third party not listed above.

6. Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have:

• Right of access — request a copy of the data we hold on you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your data (subject to retention obligations).
• Right to restrict processing — ask us to pause processing.
• Right to data portability — request your data in a portable format.
• Right to object — object to specific uses of your data.
• Right not to be subject to automated decision-making — we don’t make legal decisions about you with AI.
• Right to lodge a complaint — with the UK Information Commissioner’s Office at ico.org.uk.

To exercise any of these rights email us. We respond within 30 days as UK GDPR requires.

7. Cookies and tracking

We use only first-party cookies essential to authentication and session management (e.g. the secure polylingo_guest cookie that ties your guest preview to your browser). We do not use third-party advertising cookies, social-network tracking pixels, or behavioural-analytics scripts.

8. Data transfers outside the UK

Document content is processed inside the UK. Our AI translation provider may process the extracted text in their own infrastructure, which may include the United States or European Union. All such transfers are covered by the UK’s Standard Contractual Clauses or an equivalent UK-recognised adequacy mechanism.

9. Children’s privacy

Polytxt is not directed at children under 13 and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, email us and we will delete it.

10. How to contact us

For any privacy enquiry, exercise-of-rights request, or complaint:

• Email: via the contact form
• You can also lodge a complaint with the UK ICO at ico.org.uk.

11. Changes to this policy

If we change this policy materially, we’ll notify registered account holders by email 30 days before the change takes effect, and post a notice on the dashboard. Routine non-material updates (clarifications, typo fixes) are made without notice. The last updated date at the top of this page is always accurate.

12. Anti-abuse protections for anonymous use

The free anonymous preview is open to anyone without registration. To protect the service from abuse and unbounded automated use, we apply two transparent measures to anonymous submissions:

Anti-abuse fingerprint. When you upload a document anonymously, we compose a per-visitor identifier from four request headers your browser sends with every HTTP request: User-Agent, Accept-Language, Accept-Encoding, and your IP address. This identifier is used solely to count submissions per visitor per day (we cap free anonymous use at 20 submissions per day) and to detect abuse. We do not record which documents you uploaded against this identifier, what languages you chose, or any other content metadata. The lawful basis for this processing is UK GDPR Article 6(1)(f) — legitimate interest in preventing service abuse — and you have the right under Article 21 to object to this processing by contacting us. The identifier is purged 30 days after your most recent visit.

Page-count cap for anonymous previews. Anonymous translations are capped at the first 10 pages of any uploaded document. If your document has more pages, the preview will show a notice and prompt you to register to translate the full document. Registered users are not subject to this cap.

We do not use any active client-side fingerprinting techniques (canvas fingerprinting, audio context probing, WebGL feature detection, font enumeration, WebRTC IP discovery). The identifier is built only from HTTP headers your browser sends by default.

Shared-link tracking. When you click “Share” on a translation preview, we generate a public read-only URL. If you send that URL to a friend, every time they (or anyone with the link) opens it, we count the open and the friend’s anti-abuse fingerprint (same four signals as above) so we can show you how many distinct people viewed the preview. We do not link the friend’s fingerprint to any account, name, or contact detail; we do not tell you who specifically opened the link — only the count. If the friend signs up for a Polytxt account within an hour of viewing your shared preview, we attribute the sign-up to the share so we can report a conversion rate internally; we do not tell you the new account’s identity. Shared previews and their tracking data are deleted alongside the original translation at the 30-day retention horizon.