Privacy policy

Last updated: 5 November 2026

In a nutshell

• Without an account, your projects never leave your browser. They are stored on it and Subtradia doesn't receive your texts.
• Your videos and audio are never uploaded. The browser opens them locally, even with an account.
• With an account we store your email and your projects (texts, translations, memories, glossaries and notes) on the server so you have them on any device and can share them.
• We don't use advertising or tracking cookies, and we don't sell your data.
• We count which parts of the website are used (for example, “new project from a .docx” or “CPS tool used”), without cookies and without the content of your files, to know what to improve. See “Usage statistics”.
• Projects on the server aren't end-to-end encrypted: the server can read them in order to offer sharing, automatic backups and the other features.
• You can download everything and delete your account yourself from Settings.

Data controller

Carlos Andrés Vázquez Vicente
Contact for any question about your data: support@subtradia.com

What data we process

If you don't have an account

Only what's essential to serve you the page (see “Technical data”) and some anonymous usage statistics (see “Usage statistics”) reach our server. Your projects, your preferences and the keys of the services you connect stay in this browser (see “Cookies and local storage”). If you clear the browser's data, they're lost: that's why it's worth downloading backups.

If you create an account

• Account data: email address, password (we only store an irreversible hash, never the password), whether the email is confirmed, plan, sign-up date and last sign-in. If you sign in with Google, also the identifier Google assigns to your account; we receive nothing else from your Google account (no contacts, files or photo).
• Session: a necessary cookie that keeps you signed in (see “Cookies”). Only a hash of it's stored on the server.
• Your projects: name and file name, languages, the source and translated texts with their status and comments, translation memories, glossaries, saved versions, notes and project settings. While you work, the server keeps automatic backups of the blocks you change so you can go back (at most one every 10 minutes per block, the latest 24 and up to 45 days).
• If you share a project: the email of the people you give access to and their permission, the links you create (we store a hash of the link, not the link), the review notes and who has the editing turn at any moment.
• Service emails: if the server has email set up, we send account confirmation, password recovery and email change messages. We don't send advertising.

If you send us a problem report

With “Report a problem” (Help menu, home page and Settings) we store what you write, the email address you leave if you want a reply and, only if you leave the box ticked, technical data you see before sending: the page (without project identifiers), the version, the browser and the last error. Your projects, texts and videos are never sent. We use them only to fix the problem and reply to you; we keep them for one year at most, and if you were signed in they are deleted when you delete your account.

Usage statistics

To know which parts of Subtradia are used and which to improve, the server keeps a log of actions: which page is viewed, that a project is created or opened (with its type, the file extension and the language pair), which free tool is used, which format is downloaded, whether the AI or machine translation is used (and with which service), theme or language changes, account sign-ups, sign-ins and deletions, when each thing happens and the language of the page.

• It never stores your texts, the names of your files or projects, or anything of their content.
• If you're signed in, the actions are linked to your account, and they're deleted when you delete it.
• If not, you're an anonymous visitor: the server computes a hash of your IP and your browser with a key that changes every day and is then deleted, so it can't know who you are or follow you from one day to the next. We don't use cookies or store anything in your browser for this.
• If your browser asks not to be tracked (“Do Not Track” or “Global Privacy Control”), nothing is sent.
• Only whoever runs Subtradia sees it, and it isn't shared with anyone.

Technical data

Like any web server, the service and its hosting provider may log the IP address and technical data of each request (date, path, browser) so that it works, to detect abuse and to fix faults. To stop repeated sign-in attempts, the server temporarily counts requests per IP address in memory; that counter isn't stored.

What for and why

• Providing the service to you (saving your projects, letting you sign in, sharing, automatic backups, account emails). Legal basis: performance of the service you request when you create the account (Art. 6(1)(b) GDPR).
• Sign in with Google. Legal basis: your consent when you click the button and choose your account (Art. 6(1)(a)). You can stop using it at any time by creating a password in Settings.
• Security and abuse prevention (rate limiting, technical logs). Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).
• Knowing how Subtradia is used in order to improve it (usage statistics). Legal basis: legitimate interest in understanding what is used and what fails, with no content and with visitors without an account kept anonymous (Art. 6(1)(f)). You can object by turning on “Do Not Track” or “Global Privacy Control” in your browser, or by writing to us.
• Handling your problem reports and reply to you. Legal basis: your request when you send them (Art. 6(1)(b)) and, for the optional technical data, your consent when you tick the box (Art. 6(1)(a)).
• Legal obligations, if a competent authority requires it (Art. 6(1)(c)).

We don't make automated decisions about you or build profiles.

Who they are shared with

We don't sell or hand over your data for commercial purposes. These providers are involved, each one only for what is stated:

• Hosting (Railway): runs the server and the database where accounts and projects are stored.
• Google, only if you use “Continue with Google”: when the button is shown your browser loads Google's script, which may receive technical data (such as your IP address) and use its own cookies according to its policy. We only receive your email address and your Google identifier.
• Email service (Resend): receives your email and the text of the message in order to send it to you, if the server has email set up.
• The people you share a project with see its content according to the permission you give them (read, review, edit in turns). You decide and can remove access whenever you like.
• AI and machine translation services you connect (for example Claude, OpenAI, Gemini, DeepSeek, xAI, Azure, DeepL, Google Translate or Microsoft Translator, or a local model). It's optional. The text you choose to translate or look up is sent to that provider, with your own key, and is governed by its terms: before using it with confidential texts, check that its policy works for you. The keys are stored only in your browser and we never receive them. The technical exception is DeepL, which doesn't accept calls from the browser: the request goes through our server, which forwards it and stores neither the key nor the text.

Some of these providers may process data outside the European Economic Area. In that case they do so with the safeguards they themselves declare (adequacy decisions or standard contractual clauses).

How long we keep them

• The account and its projects, until you delete it.
• Automatic block backups, up to 45 days (and the latest 24 per block).
• Problem reports, up to one year.
• Usage statistics, up to 13 months.
• The session, up to 30 days from when you sign in; confirmation links, 48 hours; password recovery links, 2 hours.
• To deletion of the account from Settings your account, your projects with their backups, the people with access, the links and the sessions are deleted immediately. Notes you wrote in other people's projects remain without your name. Technical copies held by the hosting provider may take a limited time to disappear.
• What you store in your browser is in your hands: you delete it yourself from Settings or from the browser.

Your rights

You can request access, rectification, erasure, objection, restriction y portability of your data, and withdraw your consent where it was given. You can exercise many of them yourself:

• Settings → “Download all my projects (.zip)”: you take everything with you in files you can open again.
• Settings → change your email or password, sign out of other devices and “Delete my account”.
• For any other request, write to support@subtradia.com. We reply within one month.

If you think your data isn't being handled as it should, you can complain to the Spanish Data Protection Agency (AEPD) (aepd.es), although you're welcome to contact us first.

Security

• Passwords are stored with a slow key-derivation function (scrypt); nobody, not even us, can see yours.
• The session is kept in a cookie the page's code can't read, and accounts are isolated: each one only sees its own projects and the ones shared with it.
• The server limits repeated attempts to sign in and to change account details.
• The service must always be used over HTTPS. Bear in mind that projects on the server aren't end-to-end encrypted: if you work with texts subject to strict confidentiality, use the no-account mode (everything stays in your browser) or check with your client first.

Cookies and local storage

• One necessary cookie (subtradia_session): your session cookie, only if you sign in. It lasts up to 30 days and isn't used to track you. As it's essential for the service you request, it doesn't require consent.
• Browser storage (these aren't cookies and aren't sent to the server): your projects without an account, preferences (theme, text size, editor layout, filters, templates), the keys and settings of the AI and translation services you connect, an emergency copy if a save fails, and access to folders and videos you authorise so they can be found again.
• We don't use analytics or advertising cookies. Google may use its own when its sign-in button is shown.

Minor

The service isn't aimed at children under 14 and we don't knowingly collect their data. If you think a child has created an account, write to us and we'll delete it.

Changes to this policy

If what we do with data changes, we'll update this page and its date. Important changes will also be announced inside the app.