Gleef

GDPR overview

GDPR treatment is stated in concrete terms. The privacy policy, effective 1 May 2024, sets out the categories collected, gives users rights of access, rectification and deletion, and names a Data Protection Officer reachable at dpo@gleef.eu who is described as ensuring GDPR compliance. The security documentation goes further: GDPR compliant processing and storage, data minimisation, privacy by design, regular privacy impact assessments, and a Data Processing Agreement available upon request. All data is declared to be processed and stored on EU-based servers. Gleef SAS is established in Paris, so no Article 27 representative is required and none is named. One caveat: the Customer Business Agreement declares its own scope as the A/B testing Chrome extension, so contractual guarantees read narrower than the product range.

Who owns the data?

The Customer Business Agreement keeps intellectual property with each side: Gleef reserves its own rights and takes only a limited right to use Customer Data in order to run the service. For the translation memory, the security documentation is explicit that embeddings are stored as vector representations rather than raw text, that they are accessible only by your company, and that they are neither shared nor used for any training. On termination, Gleef undertakes to delete Customer Data in its possession on the customer's written request, within a commercially reasonable time, unless the law requires it to be kept. Full export and selective deletion are offered at any point.

Reuse rights

Customers keep the working material they put into Gleef and can take it back out: the platform advertises full data export, selective key deletion and complete removal on request, and the CLI pulls translations straight back into the customer's own repository as ordinary JSON, XML, YAML or .strings files. Nothing in the published terms restricts what the customer then does with those translated strings inside its own product. On Gleef's side, use is bounded. The security documentation states that embeddings are not shared and are not used for any model training. The privacy policy separately describes anonymous usage and technical data, collected through Microsoft Clarity and Microsoft Advertising, that is used to analyse and improve the website; that instrumentation concerns the marketing site rather than the translation workspace.

Data retention & training

Hosting summary

Gleef states that all data is processed and stored on EU-based servers. No country and no hosting provider is named, so the declaration is regional rather than specific. Translation memory is not held as raw text: the documentation says embeddings are stored as vector representations in secure, encrypted vector databases, that access is controlled through authentication tokens, and that regular backups are taken for durability. Embeddings are described as accessible only by the customer's own company, and as neither shared nor used for any training. Access controls include end-to-end encryption, multi-factor authentication, single sign-on, role-based access, IP whitelisting and audit logging. No subprocessor list is published. Separately, the marketing website itself is served by Framer from a content delivery network, which says nothing about where the platform's data sits. Gleef SAS is established in Paris, so French and EU law applies, and the terms give jurisdiction to the courts of Paris.