1. Controller
zappmedia GmbH, Hohe Ähren 8B, 14195 Berlin, Germany. Privacy enquiries: datenschutz@zappmedia.de; telephone: +49 30 252 96 541.
2. Data we process
We process your email address, optional name, account and team membership, permissions, order details, uploaded documents, working copies, translations, credit and payment references, and support messages. Access generates technical data such as IP address, time, browser information and security logs. Data comes from you, people inviting you or sharing orders, and processing activities. Documents may contain other people’s data.
3. Purposes and legal bases
Access, document checks, quotations, translation, billing and order-related support serve pre-contractual steps and contract performance (Article 6(1)(b) GDPR). For a business customer’s employees, and for security and abuse prevention, Article 6(1)(f) applies: legitimate interests in providing and protecting the service. Statutory records rely on point (c); separately given consent on point (a). An email address and pilot approval are required for access, a document and language selection for document checks, and your acceptance for a paid order. Without these details we cannot provide the relevant service. Document checks, pricing and quality checks are automated; we do not create personal creditworthiness or advertising profiles.
4. Your documents and AI processing
Document content is processed during the document check and subsequently for translation and checks and, if you select it, for preparing the source text. We do not use customer data to train AI or translation models. Commissioned AI services are also prohibited from using it for training or model improvement. When translating personal data on a business customer’s instructions, we act as a processor; a separate agreement under Article 28 GDPR is required. This notice does not replace it. Before uploading, establish your authority and any additional requirements for sensitive data, such as health information.
5. Recipients
Hosting, storage and AI services, and authorised operations and support personnel receive data as necessary. For preliminary analysis, translation, revision and checks, we use AI language models from OpenAI Ireland Ltd., Google Cloud EMEA Limited (Google Cloud Vertex AI) and Anthropic, PBC (USA). Which provider handles a step depends on the model configured for it; an order may use several providers. zappmedia operates email and support itself; our support contact is localizer-support@zappmedia.de. Team order permissions apply: administrators see all orders; members see their own and orders shared with the team.
Requests for human additional services. If you send a request in the portal for follow-up work by humans, we pass on your contact details (name, email address, company, phone number if you wish), the details of your request (requested services, subject area, target audience, desired date, message, callback request), the orders concerned with their names and numbers, and the files you selected (source files and results, with file names) to the project management of zappmedia GmbH. There they are used in strict confidence and only for the quotation and the handling of your request. We provide larger files through a download link that cannot be guessed, expires after 14 days and ends when the order is deleted; we log calls without the link itself (time, result, shortened identifier of the network address). The legal basis is Art. 6(1)(b) GDPR. The portal stores your message and contact details only until delivery, at most seven days; we delete the content-free details of the request (reference number, selected services, times) after 180 days. The team administration of your account receives the confirmation in copy. The privacy policy of zappmedia GmbH applies to further processing: https://www.zappmedia.de/office/datenschutz.html
Subject-matter research
We use web search provided by OpenAI Ireland Ltd. to check terminology and factual matters. This involves processing order-related search terms, questions and limited contextual information, which may contain personal data. OpenAI may involve additional search and content providers in this research and transmit search queries to them. We limit the information transmitted through technical rules and filters; complete anonymisation is not guaranteed.
AI processing and research may involve processing data outside the EU and the European Economic Area, particularly in the United States. We transfer data directly to Anthropic, PBC in the United States. Our agreements with OpenAI, Google and Anthropic provide for EU Standard Contractual Clauses or a European Commission adequacy decision for this. Information and copies of applicable safeguards are available from our privacy contact. We do not promise exclusively European processing.
6. Payments
The pilot uses only the Stripe sandbox. During checkout, Stripe processes payment, billing and, where applicable, tax data. The portal stores references, amounts, currencies and statuses for credit, receipts and refunds, but no full card details. Before enabling real payments, we will add the final payment parties, their roles and data flows.
7. Retention, export and deletion
Account and order data is retained for account use, processing and access to results; documents are not currently all deleted automatically after delivery. You can export available sources and results as a ZIP under Settings → My account. You can delete eligible orders and close your personal account; only administrators can close an entire team account. Deletion immediately ends access. Online content and working files are deleted no earlier than 24 hours after the request, and only after required operations finish and connected systems confirm. Content-free deletion records remain for 180 days; completed notification metadata for 30 days. Our backups expire no later than 90 days after the operational data has been deleted; retention periods of service providers follow their own terms. Necessary financial, security and legal records remain for their purpose and statutory periods. Further log, support and provider retention periods still require confirmation. Connections and private document storage are encrypted; processing systems must be able to decrypt content.
8. Cookies and browser storage
Sign-in uses a necessary session cookie valid for at most twelve hours; signing out ends the session. Sign-in links expire after 15 minutes. Your chosen language and carousel display preference are stored locally until you change them or clear browser storage. These functions provide the requested service and your settings (section 25(2)(2) TDDDG). We do not use advertising trackers or analytics tools in the portal.
Files from Google Drive. Your browser loads Google’s scripts for choosing files from Google Drive only when you move to the corresponding button in the portal with your mouse or keyboard, or click it. Sign-in, consent and file selection then take place directly between your browser and Google, using your own Google Account; Google receives technical data such as your IP address and browser information. We request only the “drive.file” permission: the portal gets access exclusively to the files you choose, not to the rest of your Google Drive, and does not change existing files there. With “Save to Google Drive”, your browser creates a finished translation, at your request, as a new file in the folder you choose in Google’s file selection, or in “My Drive”. To do so, your browser fetches the translation from the portal and transfers it directly to Google, using the same “drive.file” permission, which also covers the file created this way. The portal does not change or overwrite existing files. For the order, we only store whether the source came from Google Docs, Google Sheets, Google Slides or Google Drive, so that we can suggest the matching format; we do not store identifiers of your Google files. Your browser downloads the chosen files from Google, exporting Google Docs, Sheets and Slides as Office files, encrypts them and transfers them like a normal upload; from then on, this notice applies to them as to any uploaded document, including the processing described in sections 4 and 5. Only your browser uses Google’s short-lived access token; we do not store Google sign-in data such as passwords or access tokens. Google is an independent controller for your Google Account (Google Ireland Limited in the EEA and Switzerland); for an account managed by your organisation, its agreements with Google also apply. You can disconnect in the portal with “Disconnect from Google” or in your Google Account under “Linked apps”. The legal bases in section 3 apply; loading Google’s scripts is necessary for the function you requested (section 25(2)(2) TDDDG).
9. Messages and sharing
Sign-in and invitation emails provide access. You enable and disable optional order notifications in settings. They contain an order reference and protected link, not document text or attachments. Configured webhooks send these details to your selected service. If you create a sharing link for a subject-matter question, people with that link can view and answer the question and see the text excerpt provided for it. Share links only with intended recipients; delivered messages are also subject to recipients’ retention practices.
10. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability (Articles 15–20 GDPR). You may withdraw consent at any time for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation (Article 21); we will then continue only where legally permitted. Contact datenschutz@zappmedia.de. For data in a business customer’s documents, we assist that customer in handling your request. You may complain to a supervisory authority, particularly where you live or work. The authority for our registered office is the Berlin Commissioner for Data Protection and Freedom of Information; contact details are linked below.