Privacy Policy

This Privacy Policy explains how IQ Translate — a service operated by Bogdan Sokolov, individual entrepreneur (autónomo) registered in Spain, with fiscal address at Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain (Tax ID: ESZ1894474S) ("IQ Translate", "we", "us") — collects, uses, stores and protects your personal data when you use the translator at iq-translate.com.

The short version: your conversations live in our own database on our own server in the European Union, the audio you record is never stored — it is transcribed and immediately discarded — and the only usage measurement we run is our own, cookieless one: no third-party analytics, no advertising trackers, and nothing stored on your device.

We comply with the General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), and the ePrivacy Directive.

1. Data Controller

IQ Translate is operated by Bogdan Sokolov, individual entrepreneur (autónomo) registered in Spain, who is the data controller responsible for your personal data (Tax ID: ESZ1894474S, fiscal address Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain).

For any privacy inquiries, including the exercise of your data subject rights, contact support@iq-rest.com.

2. Data we collect

We collect only the data needed to operate the Service. The categories below cover everything stored in our database.

Account data — if you sign in: the email address of the Google account you use. Sign-in is passwordless; we never receive your Google password and request nothing beyond your email address and its verified status.

Authentication data — hashed session tokens. The raw token exists only in your browser cookie.

Anonymous usage identifier — if you use the Service without signing in, we derive a technical fingerprint from your request (IP address, browser user agent, language header), store it as a hash, and count characters and voice seconds against it. This exists solely to stop the free allowance from being reset endlessly; it is not linked to a name or an email.

Translation content — the text you submit, the transcript of what you dictate, the resulting translation, the source and target language, and the conversation ("topic") each of them belongs to.

Voice recordings — audio is transmitted for speech recognition and discarded as soon as the transcript comes back. We do not store audio files.

Billing data — if you subscribe: your plan, its status, the renewal date and your Stripe customer and subscription identifiers. Payment cards are handled entirely by Stripe; we never see or store card details.

Support — the content of messages you exchange with us by email.

Usage measurement — our own, cookieless. For each visit we store which pages were opened and which actions were taken (an event is a page, an action and a short English label such as "Home / Click / Header pricing"), the interface language, the device type and operating system, the browser's language header, the approximate location (country, region, city) derived on our server from the IP address, and where the visit came from (a "?from=" campaign tag or the search engine that referred it). The visit itself is identified by a salted hash of your IP address, browser user agent and language header. The raw IP address and the raw user agent are never stored, the salt is replaced every day and the old one destroyed — which makes visits from different days impossible to link back together — and once you sign in the visit is attributed to your email address so we can see how the product is actually used.

3. Legal basis for processing

Each category is processed under one of the legal bases in GDPR Article 6:

Contract performance (Art. 6(1)(b)) — account data, authentication data, translation content, billing data, support messages. Required to provide the Service you asked for.

Legitimate interest (Art. 6(1)(f)) — the anonymous usage identifier, the anti-abuse check, short-term operational logs, and the cookieless usage measurement described above, which protect the free allowance and the availability of the Service and tell us which parts of it people actually use. Balanced against your rights: the measurement stores no direct identifier of a signed-out visitor, builds no cross-site profile and is never shared or sold. You can object at any time by emailing support@iq-rest.com, and we will delete the visits concerned.

Legal obligation (Art. 6(1)(c)) — invoicing data we are required to retain by Spanish tax law.

4. How we use your data

Provide the Service: transcribe what you say, translate what you submit, and keep the result in your conversation history so you can come back to it.

Authenticate you: validate Google sign-in and manage sessions.

Enforce quotas: count characters and voice seconds against your account or, without an account, against the anonymous identifier described above.

Prevent abuse: an anti-abuse check (Cloudflare Turnstile) is shown to visitors without an account, so automated traffic cannot drain the free allowance.

Bill you: process subscription payments through Stripe.

Communicate with you: service notices and support replies. We do not send marketing emails without your separate consent.

Comply with legal obligations: tax records and regulatory reporting when required.

5. Analytics: our own, cookieless, no advertising

We do not use Google Analytics, PostHog, Facebook Pixel, Hotjar, session recording, retargeting pixels, or any other third-party analytics or advertising tracker. Nothing about your visit leaves our server, and no advertising network is told anything about you.

What we do run is our own measurement of how the Service is used, described in section 2. It works without cookies and without any identifier stored on your device: a visit is recognised by a hash that our server recomputes from the request itself, using a secret that is thrown away and replaced every day. That is also its limit — after a day, visits can no longer be connected to one another unless you are signed in.

It does not follow you across other websites, it is never used for advertising or for automated decisions about you, and no profile of your behaviour is built anywhere.

We do not sell, rent or share your personal data with anyone for their own purposes, and your translations are never used to train AI models.

6. Cookies and local storage

The Service sets only strictly necessary cookies, which do not require consent under Article 5(3) of the ePrivacy Directive — hence no cookie banner. Our usage measurement deliberately sets none: it stores nothing on your device at all, not a cookie, not a local-storage entry, not a device identifier.

The cookies we use:

• iqt_session — keeps you signed in

• iqt_signed_in — a yes/no flag, readable by the page so the header renders in the right state; it carries no credential

• NEXT_LOCALE — remembers the language you used

• iqt_ts_pass — a short-lived pass issued after a successful anti-abuse check, so you are not challenged on every message

Your browser additionally stores your last chosen target language and the last conversation you had open, so the widget reopens where you left it. That stays on your device.

7. Where data is stored

All data — your account, conversations, translations, quota counters — is stored in one place: our own database on a server operated for us by Hetzner Online GmbH, Nuremberg, Germany, under our direct control. Primary storage does not leave the European Union.

Data is encrypted in transit using TLS, and backups are kept in the same EU region.

8. Service providers

A small number of providers are technically necessary to deliver the Service:

Google (Gemini API) — performs the speech recognition and the translation itself. The audio and text you submit are sent to this API to produce the transcript and the translation, and are not used to train models. Privacy: https://policies.google.com/privacy

Google (Sign-In) — only if you choose to sign in (standard OAuth: your email address and its verified status).

Stripe — payment processing for paid plans. Receives your billing email and the amount and product of each transaction. Privacy: https://stripe.com/privacy

Cloudflare — the Turnstile anti-abuse check shown to visitors without an account, and DNS for the domain. Turnstile is designed to work without profiling visitors.

Hetzner Online GmbH, Nuremberg, Germany — hosts our server. A data processor under a Data Processing Agreement; cannot access database contents in normal operation.

9. International data transfers

Our own storage stays within the European Union. The speech recognition and translation performed by Google, and the payment processing performed by Stripe, may involve processing outside the EU; those transfers are covered by the EU-US Data Privacy Framework or by Standard Contractual Clauses.

Because the content you submit is processed by an external AI provider, do not submit material you are not permitted to share with a third-party processor.

10. How long we keep your data

Conversations and translations — until you delete them. You can delete a single conversation or clear your whole history from the widget at any time; they are also removed when your account is deleted.

Voice recordings — not retained at all: discarded as soon as the transcript is produced.

Account data — for as long as your account exists. Within 30 days of account deletion all personal data is permanently removed from our database, and backups are overwritten within 90 days.

Anonymous quota counters — kept for as long as the lifetime free allowance they track applies. They contain no name or email.

Usage measurement (visits and events) — kept for 12 months, then deleted. The daily salt that produced a visit's hash is destroyed after a day, so older visits cannot be traced back to a device even by us.

Invoicing data — retained for 6 years as required by Spanish tax law (Ley General Tributaria).

Support messages — retained for 24 months after the last reply.

11. Your rights

Under the GDPR you have the right to:

Access — request a copy of the personal data we hold about you.

Rectification — correct inaccurate or incomplete data.

Erasure ("right to be forgotten") — request deletion of your data; we will comply unless retention is required by law.

Restriction — pause processing while a complaint is investigated.

Portability — receive your data in a structured, machine-readable format.

Object — object to processing based on legitimate interest. Email support@iq-rest.com.

Lodge a complaint — file a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or with the authority of your own country.

To exercise any of these rights, email support@iq-rest.com. We respond within 30 days.

12. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will remove it.

13. Security

We apply technical and organizational measures appropriate to the risk: TLS for all traffic, hashed session tokens, quota and rate limiting, an anti-abuse check in front of the endpoints that cost money, automated backups, restricted server access, and regular dependency updates. No system is 100% secure; if we become aware of a personal-data breach affecting you, we will notify you and the AEPD within 72 hours as required by GDPR Article 33.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after a change constitutes acceptance.

15. Contact

Questions, complaints, or requests regarding this Privacy Policy can be sent to support@iq-rest.com. We respond within 30 days.