OpenL Translate

GDPR overview

There is no GDPR framework at all. The word GDPR appears nowhere: not in the privacy policy, not in the terms of use, not across the 3,028 URLs listed in the sitemap, and not in the seven pages of documentation. The privacy policy is a generic template in the variant that omits the GDPR block, so there is no statement of legal basis, no data subject rights section and no data protection officer. No Article 27 representative is designated, no data processing agreement is offered, and no subprocessor is named. International transfers are mentioned only in generic terms, with no standard contractual clauses or adequacy decision cited. The minimum age is 13, below the 16-year threshold of Article 8, with no reference to national variations. The policy has not been updated since 2 April 2024. The compliance flag is therefore negative because of silence, not refusal.

Who owns the data?

Neither the terms of use nor the privacy policy claims any ownership or licence over the content users submit or the translations produced, which is unusual and works in the user's favour. The only obligation placed on the user is not to upload material that infringes third-party intellectual property. On the vendor's side, the published position is that translation data is not kept at all: it is deleted as soon as the job finishes, and the translation history stays in the local browser rather than on a server. Account data is a separate matter and is governed by the privacy policy. No document states who would own outputs in a dispute, so the question is simply unaddressed.

Reuse rights

Nothing in the published documents restricts what a user may do with a translation produced by the service. No licence is reserved by the vendor, no attribution is required, and no commercial restriction is stated, so outputs can be reused freely without asking permission. The counterpart is that the vendor accepts no responsibility for accuracy: the service is supplied "as is", warranties are disclaimed, and total liability is capped at the greater of 100 USD or the fees paid over the previous twelve months. Users remain responsible for the lawfulness of what they upload. Personal data collected by the site itself is limited to an email address and usage data, used to run the service, manage the account and send related communications.

Data retention & training

Hosting summary

No hosting jurisdiction is disclosed. The privacy policy says only that information is processed at the company's operating offices and wherever the parties involved are located, without naming a single country or region, and it acknowledges that data may be transferred outside the user's own jurisdiction without citing any transfer mechanism. The documentation adds that translations are processed in real time, never stored permanently on the servers, and protected by encryption during processing, but names no protocol and no certification. The domain is served behind Cloudflare on an anycast address, which reveals nothing about where processing actually happens. Public domain records point to a registrant in China, though this describes the domain holder rather than any hosting arrangement. In short, a reader cannot determine which country's law applies to their data.