Who is responsible for your data
The data controller is MB Devsolutely, registration code 304756667, VAT number LT100013459817, Kauno g. 3A, Vilnius, LT-03001, Lithuania.
For anything in this policy, including a request about your own data, write to [email protected].
What we collect about you
Your email address, which is required — it is both your account name and how you sign in. A display name if you give one.
Credentials you choose to set: a password, which is stored only as a hash, and a second-factor secret if you turn two-factor authentication on. API keys are stored only as hashes, which is why we cannot show you one twice.
Where your signup came from, when your browser tells us — the referring site, the page you first landed on, and any campaign parameters on the link you arrived through.
Ordinary technical records created by running a web service: request logs, which include IP addresses, and error reports, which have IP addresses, request contents and email addresses removed before they are sent.
If somebody invited you and you never signed up
When a customer invites a colleague, we store that person’s email address, and their name if the inviter gave one, so the invitation can be sent and accepted. This is personal data we hold about somebody who did not give it to us and may never become a user.
It is kept only for as long as the invitation is useful, and the same rights below apply to it. If you have been invited to a workspace and would rather we did not hold your address, write to [email protected] and we will remove the invitation.
What you put into LocalizeMe
The translation keys, values, languages, comments and screenshots you and your team add, and the workspaces and projects they sit in.
This is your content, not our data about you. We process it to run the service for you and to show it to the people you have given access. We do not mine it, sell it, or use it to train anything.
Screenshots deserve naming separately: they are images of your product, and they may contain whatever was on screen when you took them. Only upload what you are content to store here.
Why we are allowed to hold it
To perform our contract with you: running your account, storing your content, sending sign-in links, invites and notices about your plan.
For our legitimate interests: keeping the service secure and working, understanding aggregate usage, and knowing when somebody signs up or pays.
To meet legal obligations: invoices and VAT records have to be kept whether or not you would like them to be.
The invitation case above rests on legitimate interests rather than a contract, because there is no agreement with somebody who has not signed up — ours in running a product people can invite colleagues to, and the inviter’s in being able to.
Who else handles it
Stripe processes payments. Card details go to Stripe and never reach us; we hold only the fact of a payment, its amount and currency.
Postmark sends transactional email — sign-in codes, invites and plan notices. Postmark retains the content of those messages for 45 days.
Heroku hosts the application and its database. Cloudflare serves the domain, stores uploaded screenshots, and keeps the nightly database backups in a bucket restricted to the EU.
Sentry (Functional Software, Inc., USA) receives error reports from our servers and the website. Request bodies, headers, IP addresses and variable values are removed and email addresses masked before a report is sent.
Plausible provides website analytics. It is cookieless and aggregate, and does not track individuals across sites.
Google Workspace carries our own business email, which is where notices about signups and payments arrive.
If you choose to sign in with Microsoft, Microsoft confirms your identity to us. We receive your email address, whether your organisation has verified the domain it belongs to, and the directory identifier Microsoft uses for you — which we keep so a later change of address still reaches your own account. Nothing else, and only when you use that button.
If you choose to sign in with Google, Google confirms your identity to us. We receive your email address, whether Google has verified it is yours, and the account identifier Google uses for you — which we keep so a later change of address still reaches your own account. Nothing else, and only when you use that button.
If you connect an AI assistant
You can let an AI assistant or coding agent — Claude, Cursor, ChatGPT and the like — read and change your projects through our MCP server. It acts as you: it reaches only the projects you can, and each connection is read only or read & edit, whichever you chose when you approved it.
For each connection we keep the name the assistant gives itself, the access level you approved, when you connected it and when it was last used. Its access and refresh tokens are stored only as hashes. Access tokens expire after an hour and refresh tokens after 30 days without use, and disconnecting it in Developer access revokes both at once. An assistant using an access key instead is recorded against that key, with the name and version it reports when it connects.
We receive what the assistant sends to carry out a request — a project, a key, the text of a file to import — and nothing more. The rest of your conversation, the assistant’s memory and your chat history never reach us.
What we send back — your strings, screenshots and exported files — is then in the assistant’s hands, and its provider processes it under its own terms; for Claude, that is Anthropic. Connecting one is your choice, and we do not send your content to any AI provider otherwise.
Changes an assistant makes appear in the project’s history under your name, as if you had made them in the dashboard.
Where your data is stored
The LocalizeMe application and its database run in Heroku’s EU region, which is hosted in Ireland. Your account and everything you put into the product live there, and so do the nightly backups of that database.
Not all of it stays inside the EU, and it would be misleading to say otherwise. Some of the providers listed above operate outside the European Union — in particular the ones that send our email, take payments and serve uploaded images.
Where data reaches them, the transfer relies on the safeguards in their own data processing terms, which for each of them means the European Commission’s standard contractual clauses.
How we protect it — encryption, backups and how we tell you about a breach — is set out at localizeme.app/security.
For the personal data you put into LocalizeMe, and for your app users’ data sent by our SDKs, we act as your processor under the Data Processing Agreement at localizeme.app/dpa. This policy covers what we hold as controller.
How long we keep it
Account and content data is kept while the account exists. Delete a workspace, or your account from Edit profile, and it goes, apart from what we must keep.
What we must keep is billing records, for as long as tax and accounting law requires.
The database is backed up every night to storage in the EU, and each backup is deleted after seven days, so deleted data is gone from our backups within a week. Heroku also keeps its own continuous copy for disaster recovery, in the same region, which nobody at LocalizeMe can restore from.
Sign-in links and codes expire after ten minutes, and the messages carrying them leave Postmark after 45 days.
Your rights
You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and object to processing we do on the basis of legitimate interests.
You do not need to ask us for your content: export is available on every plan, in JSON, PO, iOS .strings and .xcstrings, Android XML, XLIFF 1.2, Flutter .arb, Java .properties, CSV and YAML, for one language or all of them.
Write to [email protected] and we will answer within a month.
If you think we have handled your data wrongly you can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), or to the supervisory authority where you live.
Changes to this policy
If this policy changes we will update the page and the date at the top, and tell account holders by email where the change is significant.