Privacy Policy

This Privacy Policy explains how IQ Translate — a service operated by Bogdan Sokolov, individual entrepreneur (autónomo) registered in Spain, with fiscal address at Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain (Tax ID: ESZ1894474S) ("IQ Translate", "we", "us") — collects, uses, stores and protects your personal data when you use the translator at iq-translate.com.

The short version: the service is free and has no paid plan. You can translate without signing in, in which case your history belongs to your browser; if you sign in, it is attached to your account. Chats are kept for up to twelve months and you can clear them at any time. The audio you record is never stored — it is transcribed and immediately discarded. The only usage measurement we run is our own, cookieless one: no third-party analytics, no advertising trackers.

We comply with the General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), and the ePrivacy Directive.

1. Data Controller

IQ Translate is operated by Bogdan Sokolov, individual entrepreneur (autónomo) registered in Spain, who is the data controller responsible for your personal data (Tax ID: ESZ1894474S, fiscal address Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain).

For any privacy inquiries, including the exercise of your data subject rights, contact support@iq-translate.com.

2. Data we collect

We collect only the data needed to operate the Service. The categories below cover everything stored in our database.

Account data — if you sign in: your email address. Sign-in is passwordless (an emailed one-time code) or through Google or Apple, which return your email address and its verified status. We never receive your password for any of these providers.

Authentication data — hashed session tokens. The raw token exists only in your browser cookie.

Anonymous identifier — if you use the Service without signing in, your history is attached to a random identifier kept in a first-party cookie in your browser. It is not derived from your IP address, your device or any other signal about you, and it is not linked to a name or an email unless you sign in, at which point the anonymous history is merged into your account and the anonymous identifier is retired.

Translation content — the text you submit, the transcript of what you dictate, the resulting translation, the source and target language, and which language pair each exchange belongs to.

Voice recordings — audio is transmitted for speech recognition and discarded as soon as the transcript comes back. We do not store audio files.

Support — the content of messages you exchange with us by email.

Usage measurement — our own, cookieless. For each visit we store which pages were opened and which actions were taken (an event is a page, an action and a short English label such as "Home / Click / Header pricing"), the interface language, the device type and operating system, the browser's language header, the approximate location (country, region, city) derived from the IP address, and where the visit came from (a "?from=" campaign tag or the search engine that referred it). This is handled by a separate analytics service we also operate in the European Union, which your browser talks to directly rather than through this site's own server. The visit itself is identified by a salted hash of your IP address, browser user agent and language header, computed by that service. The raw IP address and the raw user agent are never stored, and the salt is replaced every day and the old one destroyed — which makes visits from different days impossible to link back together. Because your browser reaches that service directly, ordinary page views and clicks are not linked to your signed-in account; only the one-time sign-in event itself, recorded by our own server, is attributed to your email address.

We do not collect billing data and we never see payment card details, because there is nothing to pay.

3. Legal basis for processing

Each category is processed under one of the legal bases in GDPR Article 6:

Contract performance (Art. 6(1)(b)) — account data, authentication data, translation content and support messages. Required to provide the Service you asked for.

Legitimate interest (Art. 6(1)(f)) — the anonymous identifier and its stored history, the rate-limiting and anti-abuse check, short-term operational logs, and the cookieless usage measurement described above, which keep the Service available and tell us which parts of it people actually use. Balanced against your rights: the measurement stores no direct identifier of a signed-out visitor, builds no cross-site profile and is never shared or sold. You can object at any time by emailing support@iq-translate.com, and we will delete the visits concerned.

4. How we use your data

Provide the Service: transcribe what you say, translate what you submit, and keep the result in your conversation history so you can come back to it.

Authenticate you: validate the sign-in method you chose, manage sessions, and merge the history of the browser you signed in from into your account.

Keep the Service available: rate-limit requests and, for visitors without an account, run a Cloudflare Turnstile anti-abuse check so automated traffic cannot occupy the translation engine.

Communicate with you: service notices and support replies. We do not send marketing emails without your separate consent.

Comply with legal obligations when required.

5. Analytics: our own, cookieless, no advertising

We do not use Google Analytics, PostHog, Facebook Pixel, Hotjar, session recording, retargeting pixels, or any other third-party analytics or advertising tracker. Nothing about your visit is shared with a third party, and no advertising network is told anything about you.

What we do run is our own measurement of how the Service is used, described in section 2, on a separate analytics service we also operate in the European Union. It works without cookies and without any identifier stored on your device: a visit is recognised by a hash that service recomputes from the request itself, using a secret that is thrown away and replaced every day. That is also its limit — after a day, visits can no longer be connected to one another. Because it is reached directly rather than through this site's own server, it also cannot connect an ordinary page view to your signed-in account.

It does not follow you across other websites, it is never used for advertising or for automated decisions about you, and no profile of your behaviour is built anywhere.

We do not sell, rent or share your personal data with anyone for their own purposes, and your translations are never used to train AI models.

6. Cookies and local storage

The Service sets only strictly necessary cookies, which do not require consent under Article 5(3) of the ePrivacy Directive — hence no cookie banner. Our usage measurement deliberately sets none: it stores nothing on your device at all, not a cookie, not a local-storage entry, not a device identifier.

The cookies we use:

• translator_session — keeps you signed in

• iqt_signed_in — a yes/no flag, readable by the page so the header renders in the right state; it carries no credential

• iqt_anon — the random identifier that owns the history of a browser that has not signed in; it is retired when you sign in

• iqt_pair — remembers the last language pair you used

• NEXT_LOCALE — remembers the language you used

• iqt_ts_pass — a short-lived pass issued after a successful anti-abuse check, so you are not challenged on every message

Your browser additionally stores your last chosen target language, so the widget reopens where you left it. That stays on your device.

7. Where data is stored

All data — your account, conversations and translations — is stored in one place: our own database on a server operated for us by Hetzner Online GmbH, Nuremberg, Germany, under our direct control. Primary storage does not leave the European Union.

Data is encrypted in transit using TLS, and backups are kept in the same EU region.

8. Service providers

A small number of providers are technically necessary to deliver the Service:

No provider receives your text or your audio: translation and speech recognition both run on our own machine (self-hosted language and speech models, reached over an encrypted private channel from our server). Your content is not sent to any external AI service and is not used to train anything.

Google and Apple (Sign-In) — only if you choose to sign in that way (standard OAuth: your email address and its verified status).

Brevo — delivers the one-time sign-in code to your email address when you sign in with email.

Cloudflare — the Turnstile anti-abuse check shown to visitors without an account, and DNS for the domain. Turnstile is designed to work without profiling visitors.

Hetzner Online GmbH, Nuremberg, Germany — hosts our server. A data processor under a Data Processing Agreement; cannot access database contents in normal operation.

9. International data transfers

Our own storage stays within the European Union. If you choose to sign in with Google or Apple, those providers process your email address as part of the sign-in; any transfer outside the EU is covered by the EU-US Data Privacy Framework or by Standard Contractual Clauses.

10. How long we keep your data

Conversations and translations — kept for up to twelve months from your last use of that language pair, then automatically deleted. You can also clear any pair's history from the widget at any time, without waiting.

Voice recordings — not retained at all: discarded as soon as the transcript is produced.

Account data — for as long as your account exists. You can ask us to delete your account and its data at any time (see section 11); we remove it within 30 days and backups are overwritten within 90 days.

Usage measurement (visits and events) — kept for 12 months, then deleted. The daily salt that produced a visit's hash is destroyed after a day, so older visits cannot be traced back to a device even by us.

Support messages — retained for 24 months after the last reply.

11. Your rights

Under the GDPR you have the right to:

Access — request a copy of the personal data we hold about you.

Rectification — correct inaccurate or incomplete data.

Erasure ("right to be forgotten") — request deletion of your data; we will comply unless retention is required by law.

Restriction — pause processing while a complaint is investigated.

Portability — receive your data in a structured, machine-readable format.

Object — object to processing based on legitimate interest. Email support@iq-translate.com.

Lodge a complaint — file a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or with the authority of your own country.

You can clear the history of any language pair yourself in the widget. For access, export or erasure of everything else, email support@iq-translate.com; we respond within 30 days. If you used the Service without signing in, the history is attached to an identifier stored only in your browser, so clearing it from the widget (or clearing your browser storage) removes it for good.

12. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will remove it.

13. Security

We apply technical and organizational measures appropriate to the risk: TLS for all traffic, hashed session tokens, rate limiting, an anti-abuse check in front of the translation endpoints, automated backups, restricted server access, and regular dependency updates. No system is 100% secure; if we become aware of a personal-data breach affecting you, we will notify you and the AEPD within 72 hours as required by GDPR Article 33.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after a change constitutes acceptance.

15. Contact

Questions, complaints, or requests regarding this Privacy Policy can be sent to support@iq-translate.com. We respond within 30 days.