Privacy Policy

01 Who We Are

Comvi is a translation management platform operated by Yevhen Balabai, a sole proprietor registered in Ukraine. While our legal entity is based in Ukraine, all user data is stored and processed within the European Union.

02 What We Collect

account information

When you create an account, we collect your name, email address, and password (stored securely using industry-standard hashing). If you sign in with Google, we receive your name, email, and profile picture from Google — we don't get access to your Google password.

your content

We store the translations, projects, and other content you create while using Comvi. You own this content — we just store it for you.

usage analytics

On this website we use Umami (EU-hosted) — cookieless, anonymous visit statistics that store nothing in your browser and are not used to track you across other websites.

Inside the Comvi app we use PostHog (EU-hosted) for product analytics — also cookieless (nothing is stored in your browser). Usage events are linked to your account so we can understand how people use Comvi and improve the product; we process this on the basis of our legitimate interest in improving Comvi, and it is never used to track you across other websites.

error tracking

We use Sentry to automatically detect and diagnose errors in our application. When an error occurs, Sentry may collect technical information like browser type, operating system, and the sequence of actions that led to the error — but not your translation content.

security logs

For security purposes, we log IP addresses and browser information when permission-related actions occur (like inviting team members or changing access levels). This helps us detect and prevent unauthorized access.

03 How We Use Your Data

• Provide the service — store and deliver your translations
• Communicate with you — send transactional emails (password resets, team invites)
• Improve Comvi — analyze usage patterns to make the product better
• Keep things secure — detect and prevent fraud or abuse

04 Legal Basis for Processing

Under GDPR, we process your data based on the following legal grounds:

• Contract — to provide you with the service you signed up for: storing translations, managing projects, and delivering features.
• Legitimate interests — for security monitoring, fraud prevention, and product improvement, where our interests don't override your rights.
• Consent — for marketing emails. You can withdraw consent anytime by unsubscribing.

05 Who We Share Data With

We use trusted third-party services to operate Comvi. Here's who has access to what:

machine translation services

When you use machine translation features, your content is sent to the translation provider you select:

• Google Translate — neural machine translation
• DeepL — neural machine translation
• Azure Translator — neural machine translation

ai-assisted translation

When you choose AI-powered translation, your content is processed by large language models:

• OpenAI (GPT) — AI language model, US-based
• Anthropic (Claude) — AI language model, US-based

These providers have their own data handling policies. Please review their privacy policies for details.

06 Where Your Data Lives

Your primary data (account info, translations, projects) is stored on servers located inFrankfurt, Germany — within the European Union.

Some of our service providers are based in the US. For these transfers, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The providers' commitments to data protection

07 Your Rights

You have the right to:

• Access — see what data we have about you
• Export — download all your data in a portable format
• Correct — fix any inaccurate information
• Delete — request deletion of your account and data
• Object — opt out of certain data processing

To exercise any of these rights, email us athello@comvi.io. We'll respond within 30 days.

California residents — under CCPA, you also have the right to know what personal information we collect and to request its deletion. We do not sell personal information.

08 Data Retention

soft deletion

When you delete content or your account, we use soft deletion — your data is marked as deleted but retained in our systems for 90 days. This allows us to restore your data if you accidentally delete something or change your mind. After 90 days, soft-deleted data is permanently erased.

Want permanent deletion? Just ask. Contact us athello@comvi.ioand we'll permanently erase all your data from our systems.

09 Children's Privacy

Comvi is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us and we will delete it.

10 Changes to This Policy

We may update this privacy policy from time to time. We'll notify you of significant changes by email or by posting a notice on our website. Your continued use of Comvi after changes means you accept the updated policy.

11 Contact Us

Questions about this privacy policy? We're here to help.