Privacy Policy

Last updated: September 23, 2026

ImageL10n is owned and operated by StructOCR (“StructOCR”, “we”, or “us”). When you access the ImageL10n website or use our image localization platform, whether as an individual User or professional Client, StructOCR may process your Personal Data.

This Privacy Policy explains our processing activities, including where StructOCR acts as a Data Controller under applicable data protection laws, such as the GDPR and CCPA. It covers ImageL10n; other StructOCR products have their own product-specific privacy notices.

1. General Commitment to Privacy

StructOCR is committed to safeguarding the digital privacy of its global Users. We follow privacy-by-design and data-minimization principles. Opening and editing an image locally does not itself upload its contents. Cloud translation requires sending the image to our storage and AI processing providers. Do not upload content you lack permission to process, and avoid sensitive or confidential material in this early release.

Our infrastructure providers may process data in multiple countries. ImageL10n does not promise that all processing takes place exclusively in the United States. Where applicable, international transfers require appropriate safeguards under applicable law.

2. Purposes and Legal Basis of Processing

• Service Delivery and Performance: Creating and managing accounts, authenticating access, recognizing and translating image text, saving projects and enabling exports. This is necessary to perform our agreement with you.
• Transaction Management: Facilitating purchases through Paddle and maintaining ImageL10n orders, Credit balances and usage records, for performance of our agreement and applicable legal obligations.
• Quality Assurance and Service Continuity: Monitoring job execution, handling failures and supporting users, based on our legitimate interest in providing a functional service.
• Security and Abuse Detection: Administering the Platform, preventing unauthorized access and free-Credit abuse, and protecting infrastructure, based on our legitimate interests.
• Service Performance: Reviewing operational usage and error records to maintain the product. Where configured and with your consent, PostHog and Google Analytics 4 measure visits to public pages to help us improve the website. Optional analytics is separate from necessary service and security records.

3. Categories of Personal Data Collected

• User Identification Data: Email address, account ID, authentication credentials managed by Supabase, and profile information made available by your selected sign-in provider.
• Connection and Technical Data: IP address and request metadata handled by hosting and authentication providers, browser information, timestamps, job status and service usage records.
• Payment Data: Billing details, transaction references, order history and Credit adjustments. Paddle handles payment details; ImageL10n does not store your full payment card details.
• Content Data: Images submitted for cloud translation, recognized text, translations, text coordinates, formatting and edits that you explicitly save. Local-only edits remain in your browser unless you request a cloud operation.

ImageL10n and StructOCR share authentication and account identity through Supabase. ImageL10n maintains separate product usage, purchase and Credit records; it does not share Credit balances with StructOCR OCR or Tools. A shared password change or identity deletion can affect access to both products.

4. Data Recipients and Service Providers

• Cloudflare: Website hosting, API execution and request security. Where enabled, Turnstile processes information needed for abuse prevention.
• Supabase: Shared account authentication and profile identity, ImageL10n database records and private image storage.
• Google Gemini API: Images and requested language information are sent for text recognition and translation. Processing is subject to Google’s applicable API terms and account settings; we do not promise zero provider retention or a particular model-training exclusion without a verified provider configuration.
• Google Sign-In: If you choose Google authentication, Google processes the sign-in request and supplies the permitted account information to our authentication provider.
• Paddle: Merchant of Record for payment processing, taxes, refunds and financial compliance. Paddle processes buyer information under its own Privacy Policy.
• Optional Analytics: PostHog and Google Analytics 4, where configured and enabled with your consent, process public-page visit events and technical connection information. We do not send images, recognized text, translations, account email addresses, authentication URL parameters or document identifiers as analytics event properties. Session recording and automatic form/click capture are disabled. Analytics providers still receive network information such as your IP address when requests reach their services. See PostHog’s Privacy Policy and Google’s Privacy Policy.
• Legal Compliance: We may disclose data when required by law or a valid judicial or administrative request.

5. Data Retention Periods

We retain information for the purposes described above. ImageL10n’s saved-project workflow differs from StructOCR’s transient OCR document processing:

• Account Data: Retained while the shared account is maintained and as necessary for account administration, security and legal obligations. Contact support to request deletion and specify whether your request concerns ImageL10n content or the shared StructOCR identity.
• Cloud Images and Saved Results: Retained to allow you to reopen and edit your work until deletion is requested and processed or the data is otherwise removed. There is currently no automatic 24-hour purge or fixed inactivity-deletion schedule for ImageL10n projects.
• Local Work: Local-only image edits are not cloud backups and may be lost on refresh or closing the page. Files you download remain on your device under your control.
• Usage, Security and Payment Records: Retained as needed to operate Credit balances, investigate failures or abuse, resolve disputes and meet accounting or legal obligations. The current release does not implement a fixed automatic deletion schedule for these records.

Deletion requests are handled through support. Some records may need to be retained for legal obligations or disputes, and copies held by providers or backups are subject to their retention processes. We do not promise immediate, irreversible deletion from every backup.

6. Cookies and Tracking Technologies

Necessary browser storage keeps your ImageL10n sign-in session, a pending-job reference, a checkout retry reference and your analytics preference. Authentication, Paddle checkout and Turnstile, where enabled, may use their own necessary cookies or storage.

Optional PostHog and Google Analytics scripts load only after you choose Allow analytics and the corresponding project IDs have been configured. Google Analytics may set analytics cookies; PostHog is configured with in-memory persistence and no person profiles. Advertising features, session recording and automatic interaction capture are disabled. Browser Do Not Track and Global Privacy Control signals disable optional analytics. Use Privacy settings to decline or withdraw consent; withdrawing prevents subsequent analytics collection but does not delete information already received by providers. Contact support for deletion requests.

You can manage or disable cookies and local storage through your browser settings; however, sign-in, checkout and other features may not function correctly without them. Signing out of ImageL10n locally does not necessarily sign you out of other StructOCR websites.

7. Global Data Subject Rights

Regardless of your location, you may contact StructOCR to exercise the following rights, subject to applicable legal requirements and exceptions:

• Access and Rectification: Request a copy of your data or correction of inaccurate information.
• Erasure: Request deletion of your account and associated personal data.
• Objection: Object to processing based on legitimate interests.
• Data Portability: Request an export of your account data in a structured, machine-readable format.

Where applicable, you may also request restriction of processing, withdraw consent for consent-based processing, or lodge a complaint with the appropriate supervisory authority. We may need to verify your identity before acting on a request.

8. Security

Taking into account the nature of image processing, our safeguards include HTTPS connections, private cloud image storage, expiring image-access links, account-scoped database access controls and server-side handling of service credentials. Payment card processing is delegated to Paddle.

No service can guarantee absolute security. Provider certifications do not mean that ImageL10n itself has been independently certified. Keep your account credentials secure and review content before uploading it.

If you have any questions about this Privacy Policy or wish to request access or deletion, please contact [email protected] and identify ImageL10n in your request.