Babilim Privacy Policy

DRAFT — not yet published. Items marked [OWNER] need a decision before publication.

Last updated: [OWNER: date of publication]

This policy explains what the Babilim translation service ("the Service", operated by [OWNER: legal name of the operator], "we") receives, why, how long it is kept, and who processes it. The Babilim WordPress plugin's readme lists, item by item, exactly what the plugin sends; this policy covers what the Service does with it.

1. Nothing before consent

The plugin sends nothing until a site administrator presses "Enable Babilim". "Disable Babilim" stops all further requests.

2. What we receive

About your site (at registration and on each sync): the site's URL; WordPress, PHP and plugin versions; the site's locales; a public key generated for the site; and, for every installed plugin and theme, its slug, version, text domains, whether it is listed on WordPress.org and which translations are installed; plus short diagnostic codes. We do not receive the content of your posts, pages, comments or media, user names, e-mail addresses or administrator accounts.

When you act: translation requests (component, version, locale), downloads (which build), and problem reports — including any original text, translation, suggestion, note and screen address you choose to fill in.

Source uploads (only after you confirm, for components not on WordPress.org): the whole plugin or theme directory as a zip. If it contains keys, logs or customer data, they are uploaded too; we remove common sensitive files but cannot guarantee we find everything.

Payments: Paddle, our merchant of record, processes payments under its own privacy policy (https://www.paddle.com/legal/privacy); we never see card or bank details. From Paddle we keep the transaction identifier, the amount and currency, and the payment status, so that a license can be traced to its payment. We do not store the buyer's name or e-mail address. Restore codes are stored only as one-way hashes.

Technical data: like any web service, our servers and our network provider see the IP address of each request, and our server logs record requests for operation and security.

3. Why we use it

To verify that you control the site, provide compatible translation files, decide which translations a site may use (free allowance or license), translate components that have no translation yet, keep translations up to date, investigate reported problems, process licenses and payment reversals, and protect the Service from abuse.

We do not sell data, show advertising, or use it for profiling.

4. Sharing and processors

• AI model providers process the original text of components (from WordPress.org or from your upload) to produce translations. They do not receive data about your site.
• Translations are shared: the original text and translations of a component version are provided to every site that installs the same version. Data about your site is never shared with other sites.
• Paddle (merchant of record) processes payments and issues receipts under its own privacy policy.
• Infrastructure providers host the Service, store files (Wasabi object storage) and carry network traffic (Cloudflare).

[OWNER: confirm whether the AI providers and hosting provider should be named individually, and their regions.]

5. How long we keep it

• Site registration and sync data: while the site is connected, and afterwards as long as needed for licensing and abuse prevention. [OWNER: choose a period after which disconnected sites are deleted, if any.]
• Source uploads: kept so that later versions and corrections can be translated, until you ask us to delete them.
• Translations: kept indefinitely, so that sites can roll back and so that results can be audited.
• Payment records: as long as required for accounting and tax purposes.
• Server logs: for a limited period. [OWNER: confirm period.]

6. Your choices and rights

You can stop all requests with "Disable Babilim". Uninstalling the plugin with "Delete all Babilim data on uninstall" ticked removes the plugin's data from your site. To ask what we hold about your site, to have it corrected or deleted, or to have an upload deleted, contact [OWNER: privacy e-mail]. Deleting a site's data may end a paid license bound to it. Depending on where you live, you may also have the right to object, restrict processing, or complain to a data protection authority.

7. Security

Connections use HTTPS. Each site authenticates with its own access token; the site's private key never leaves the site. Restore codes and checkout links are stored only as hashes.

8. Changes and contact

We will update this page when what we collect changes; the date above shows the latest version. Questions: [OWNER: privacy e-mail].