Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the LocalizeMe Terms of Service (the "Terms") between the customer that has accepted the Terms (the "Customer", acting as controller) and MB Devsolutely, registration code 304756667, VAT LT100013459817, Kauno g. 3A, Vilnius, LT-03001, Lithuania ("LocalizeMe", acting as processor).

It applies when, and only to the extent that, LocalizeMe processes personal data on the Customer’s behalf in providing the service.

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 ("GDPR"). "Customer Personal Data" means the personal data described in Annex I that LocalizeMe processes on the Customer’s behalf. "Sub-processor" means a third party LocalizeMe engages to process Customer Personal Data.

2.1 For Customer Personal Data, the Customer is the controller and LocalizeMe the processor.

2.2 LocalizeMe is a separate controller for the personal data it processes to run its own business: account and sign-in data of the Customer’s users, billing, and security logs. That processing is governed by the LocalizeMe privacy policy, not this DPA.

2.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

3.1 LocalizeMe processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the service (including the consent level it sets in the SDKs) are the Customer’s complete instructions.

3.2 LocalizeMe will tell the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law, unless that law prohibits it.

3.3 If Union or Member State law requires LocalizeMe to process Customer Personal Data otherwise, it will tell the Customer before processing, unless that law prohibits it.

LocalizeMe ensures that every person it authorises to process Customer Personal Data is bound by confidentiality, by contract or by law.

5.1 LocalizeMe implements the technical and organisational measures in Annex II.

5.2 LocalizeMe may update those measures, provided the overall level of protection is not reduced.

6.1 The Customer gives general authorisation for LocalizeMe to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex III.

6.2 LocalizeMe will tell the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the workspace owner and by updating Annex III. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro rata refund of prepaid fees for it.

6.3 LocalizeMe imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to the Customer for each Sub-processor’s performance.

7.1 Customer Personal Data is hosted in the European Union (Heroku EU region, Ireland).

7.2 Some Sub-processors may process Customer Personal Data outside the EEA (see Annex III). Where they do, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the Sub-processor is certified) or the European Commission’s standard contractual clauses in the Sub-processor’s terms.

8.1 Data subject requests. Taking into account the nature of the processing, LocalizeMe assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects. Much of this is self-service: the Customer can export translation content at any time on every plan, and edit and delete it in the dashboard on every plan and through the API and CLI on plans that include them. If LocalizeMe receives a request directly, it will refer the data subject to the Customer.

8.2 Other obligations. LocalizeMe assists the Customer, taking into account the information available to it, with security of processing, breach notification, data protection impact assessments and prior consultation (Art. 32–36 GDPR).

LocalizeMe will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. LocalizeMe will provide further information as it becomes available.

10.1 During the term the Customer can export all translation content at any time.

10.2 When the Customer deletes a project or workspace, or the Terms end, LocalizeMe deletes Customer Personal Data within 30 days, unless Union or Member State law requires it to keep it. SDK install records and reports are additionally deleted automatically on the schedule in Annex I.

10.3 Uploaded screenshots are deleted from the image store when they are deleted in LocalizeMe; failed deletions are retried by a daily job and followed up by hand if they keep failing.

10.4 The database is backed up daily and each backup is retained for seven days, so deleted Customer Personal Data leaves the backups within seven days of deletion.

11.1 LocalizeMe makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR, including this DPA, its annexes and the security page at localizeme.app/security, and answers reasonable written questions.

11.2 Where that is not enough, LocalizeMe allows audits by the Customer or an auditor it mandates, no more than once a year, on at least 30 days’ written notice, during business hours, at the Customer’s cost, and subject to confidentiality. Audits of Sub-processors are satisfied by their own certifications and reports.

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the GDPR or other applicable law does not allow liability to be limited.

13.1 This DPA lasts as long as LocalizeMe processes Customer Personal Data.

13.2 If this DPA conflicts with the Terms on data protection, this DPA prevails.

13.3 This DPA is governed by Lithuanian law, and the courts of Lithuania have jurisdiction, as in the Terms.

Subject matter: providing the LocalizeMe translation management service and its iOS and Android SDKs.

Duration: the term of the Terms, plus the deletion period in section 10.

Nature: storage, organisation, retrieval, transmission and deletion.

Purpose: hosting and editing the Customer’s translation content; delivering strings to the Customer’s apps; showing the Customer install statistics and SDK reports.

A. Translation content. Data subjects: any person the Customer chooses to name in its content or screenshots (LocalizeMe does not expect personal data here, but cannot exclude it). Data: whatever personal data the Customer puts into strings, key descriptions, comments and uploaded screenshots. Retention: until the Customer deletes it, then section 10.

B. SDK data (end users of the Customer’s apps). Data subjects: end users of the Customer’s iOS and Android apps. Data: IP address (transport and rate limiting only, not stored with the other items); at full consent only, a random install id generated by the SDK, app version and build, OS version, the language the app is rendering, SDK error reports and, if the Customer enables them, missing-key reports. Not collected: advertising id, device id, name, email, location, contacts, in-app behaviour. Retention: install records 90 days after the last check-in; error and missing-key reports 30 days after they were last received; daily request counters (no install ids) 400 days; deleted by a daily job. Special categories: none.

Access control. Role-based access per workspace (owner, admin, developer, translator) and per project (admin, editor, viewer); workspace membership does not grant access to every project. Sign-in by emailed link or six-digit code, optional password, optional two-factor authentication (TOTP) on every plan; workspaces can require two-factor for changes. Sign-in requests rate limited per address and per caller; links and codes expire after ten minutes. API keys stored only as SHA-256 hashes; OAuth access tokens expire after an hour and refresh tokens after 30 days unused, both stored as hashes. Deactivated users’ keys, tokens and export links stop working.

Transmission. HTTPS on every request; plain HTTP redirected. Secure cookies; configured CORS origins and CSRF protection.

Integrity and traceability. Edits to a translation are recorded with the previous value and the user who made them, including edits through the API, CLI and MCP. File imports are recorded as one event per file.

Hosting and operations. Application and managed PostgreSQL on Heroku (Salesforce), EU region (Ireland). Database encrypted at rest (Heroku disk encryption). Daily database backups, stored in the EU and each retained for seven days. Website dependencies monitored for published vulnerabilities (GitHub Dependabot); server dependencies audited when upgraded. Secrets held in environment configuration, never in the code repository. Error reports (Sentry) have request bodies, headers, IP addresses and variable values removed, and email addresses masked, before they are sent. Payment card data handled only by Stripe, never by LocalizeMe’s servers.

Data minimisation. SDK consent levels let the Customer limit what the SDK sends (full, strings only, off). Automatic deletion of SDK data on the schedule in Annex I.

Heroku (Salesforce, Inc.): application hosting and database. Data: all Customer Personal Data. Location: EU (Ireland).

Cloudflare, Inc.: domain and network proxy; Cloudflare Images stores uploaded screenshots, served by signed URLs; Cloudflare R2 stores the daily database backups in a bucket restricted to the EU. Data: request metadata including IP address; screenshots; database backups (all Customer Personal Data, EU only). Location: global network, USA company (Cloudflare Images has no region option).

Postmark (ActiveCampaign, LLC): transactional email. Data: recipient email address, message content (kept 45 days). Location: USA.

Functional Software, Inc. (Sentry): error monitoring. Data: stack traces and error messages, which can contain fragments of Customer content. Location: USA.

Stripe, Inc. / Stripe Payments Europe: payments. Data: billing data (the Customer’s own, not end users’). Location: EU / USA.