Privacy Policy
Effective date: 5 November 2026
This Privacy Policy explains how Eachlang handles personal data when we decide why and how it is processed (as a "controller"). It covers our website eachlang.com, our app, our support channels and our business communications.
When we process data on behalf of our customers, for example the content of a customer's website or data about that website's visitors, we act as a processor for the customer. In that case the customer's own privacy policy applies, and our role is governed by our Data Processing Agreement. Section 9 summarises what happens to visitor data.
1. Who is responsible
The controller is Senem Can, an individual (natural person) resident in Türkiye, operating the Service under the name Eachlang, Tepebaşı, Eskişehir, Türkiye. Privacy contact: privacy@eachlang.com
2. What we collect and why
| Data | Examples | Purpose | Legal basis (GDPR / UK GDPR; KVKK m.5) | Retention |
|---|---|---|---|---|
| Account data | name, email, password hash or sign-in provider ID, team membership, role | create and run your account, authenticate you, let you invite team members and clients | performance of a contract (Art. 6(1)(b); KVKK m.5/2-c) | while the account is active, then deleted within 30 days of closure |
| Acquisition data | campaign tags (utm), referring site domain and landing page, stored with your account when you sign up | understand which channels bring customers | legitimate interests (Art. 6(1)(f); KVKK m.5/2-f) | for the life of the account, then anonymised |
| Project data | project domains, DNS and verification records, settings, language choices, and private previews of a few pages of the website you enter, created before domain verification | provide the Service | contract | while the project exists; previews are deleted after 24 hours |
| Billing data | plan, subscription status, country, invoices; Paddle holds card and payment details | manage your subscription | contract; legal obligation for records we must keep (Art. 6(1)(c); KVKK m.5/2-ç) | for the period required by tax and accounting law, typically up to 5 years |
| Usage and technical data | log-in times, features used, error logs, IP address, browser type | security, abuse prevention (including the fair-use rules), troubleshooting, product improvement using aggregated statistics | legitimate interests in running a secure, reliable Service (Art. 6(1)(f); KVKK m.5/2-f) | logs up to 30 days; aggregated statistics without personal data may be kept longer |
| Support data | messages, emails, chat transcripts with our AI support assistant | answer questions and fix problems | contract; legitimate interests | up to 24 months after the conversation ends |
| Marketing site analytics | pages viewed, referrer, approximate country, campaign tags | understand how people find us | legitimate interests; we use Cloudflare Web Analytics, which is cookieless (Section 6) | aggregated; raw events up to 12 months |
| Business contact data | name, work email, company, public website information; if we send you a link to a comparison report about your website: the link's token, the times the report page was opened and the number of opens; for each report, an evidence file (raw HTML, response headers and screenshots of the public pages compared, measurement data and date) | contact businesses that may benefit from the Service, keep a record of opt-outs, show you the report and know whether it was opened, and be able to show how the figures in a report were obtained | legitimate interests (Art. 6(1)(f)); where the law requires prior consent, we do not send unsolicited emails | contact data: until you object or after 12 months without interaction; opt-out records kept so we do not contact you again. Report page and its open records: 14 days (the page can be withdrawn earlier). Evidence file: 12 months; it is not public |
We do not collect special categories of personal data on purpose, and the Service is not directed to children.
The report page does not show your name or other personal data about you. The emails we send to business contacts do not contain tracking pixels or images loaded from our servers; an image, if any, is embedded in the message itself.
3. Where the data comes from
Mostly from you, when you sign up and use the Service. Some technical data is generated automatically. Billing data comes from Paddle. Business contact data may come from public sources such as company websites and professional directories.
4. Who we share data with
- Service providers (processors) that help us run the Service: hosting and edge network, database, AI translation providers, email delivery, analytics and support tools. They are listed with locations in our Subprocessor List and may only use the data on our instructions.
- Paddle.com, our Merchant of Record, which processes your purchase as an independent controller under Paddle's privacy notice.
- Professional advisers (such as accountants and lawyers), under confidentiality.
- Authorities, where we are legally required to disclose data or to protect our rights.
- A successor operator, if the Service is transferred (for example to a company formed to operate it), subject to this Policy.
We do not sell personal data and we do not share it for cross-context behavioural advertising. We do not use your data or your website content to train AI models.
5. International transfers
We are based in Türkiye, and our providers process data in the European Union, the United States and other countries where their networks operate. Türkiye does not currently have an adequacy decision from the European Commission or the UK.
- From the EEA, UK and Switzerland: when you give us personal data, or our customers give us data to process, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), the UK International Data Transfer Addendum and the Swiss adaptations, and on our providers' own data processing agreements and transfer mechanisms (including the EU-U.S. Data Privacy Framework where a provider is certified).
- From Türkiye: some of the data described in Section 2 is transferred abroad to the providers listed in our Subprocessor List, in the countries stated there, so that we can provide the Service (hosting and edge network, database, AI translation, email delivery, analytics and support). These transfers are subject to Article 9 of Law No. 6698 (KVKK). Providers with which we have signed a standard contract announced by the Personal Data Protection Board and notified it to the Personal Data Protection Authority are marked in the Subprocessor List. For other providers, our relationship relies on the provider's own data processing terms.
You can ask us about these transfers, and for a copy of any safeguards that apply, at privacy@eachlang.com.
6. Cookies
- Our app uses strictly necessary cookies to keep you signed in and protect against fraud. These do not need consent.
- Our marketing website uses Cloudflare Web Analytics, which does not use cookies or store identifiers on your device. We therefore do not show a cookie banner.
- Translated customer websites: the Service may store your visitor's chosen language in a strictly necessary cookie or local storage on the customer's domain. The Service does not add advertising or tracking cookies to customer websites.
- Paddle checkout may set its own cookies; see Paddle's notice.
7. Security
We use encryption in transit (TLS), encryption at rest offered by our providers, access controls with multi-factor authentication for administrative access, least-privilege access, and logging. No system is perfectly secure; if a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires. More detail is in Annex II of our Data Processing Agreement.
8. Your rights
Depending on where you live, you have the right to:
- access your personal data and get a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict or object to processing, including objecting at any time to direct marketing;
- data portability;
- withdraw consent where we rely on consent;
- not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions);
- complain to a supervisory authority: in the EU, the authority in your country; in the UK, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Authority (KVKK).
Residents of Türkiye have the rights in Article 11 of the KVKK, including learning whether your data is processed, the purpose of processing, the third parties to whom it is transferred in Türkiye or abroad, and requesting correction, deletion and compensation. You can apply in writing to Tepebaşı, Eskişehir, Türkiye, or by email to privacy@eachlang.com from the email address registered with us, or by any other method permitted by the Communiqué on the Procedures and Principles of Application to the Data Controller; we will respond within 30 days.
California and other US state residents have rights to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising your rights. You may use an authorised agent.
To exercise any right, email privacy@eachlang.com. We respond within one month (GDPR/UK GDPR), 30 days (KVKK) or 45 days (CCPA), and may extend where the law allows. We may need to verify your identity.
If your request concerns data we process for a customer (for example, you visited a website that uses Eachlang), please contact that website's owner. We will forward your request to them and assist them.
9. Visitors of websites that use Eachlang
When you visit a translated page of a website that uses Eachlang, your request passes through our edge network so we can deliver the translated page. Processing is limited to what is needed to deliver the page, protect the Service and count usage: IP address, request URL, browser and language headers, and timestamps. Cookies and form submissions that you send to the website pass through our edge network to the website's own server in transit; we do not store them or use them for any other purpose. Form submissions, and the content of pages you view while signed in to the website, are not sent to our AI translation providers. Request logs are kept for up to 30 days. We do not build profiles of visitors and do not track them across websites. The website owner is the controller for this processing.
10. Changes
We will post updates on this page and change the "Effective date". For material changes we will notify account holders by email or in the app before they take effect.
11. Contact
Senem Can, Tepebaşı, Eskişehir, Türkiye · privacy@eachlang.com
Questions about this page? Write to hello@eachlang.com.