1. Controller
zappmedia GmbH, Hohe Ähren 8B, 14195 Berlin, Germany. Privacy enquiries: datenschutz@zappmedia.de; telephone: +49 30 252 96 541.
2. Data we process
We process your email address, optional name, account and team membership, permissions, order details, uploaded documents, working copies, translations, credit and payment references, and support messages. Access generates technical data such as IP address, time, browser information and security logs. Data comes from you, people inviting you or sharing orders, and processing activities. Documents may contain other people’s data.
3. Purposes and legal bases
Access, document checks, quotations, translation, billing and order-related support serve pre-contractual steps and contract performance (Article 6(1)(b) GDPR). For a business customer’s employees, and for security and abuse prevention, Article 6(1)(f) applies: legitimate interests in providing and protecting the service. Statutory records rely on point (c); separately given consent on point (a). An email address and pilot approval are required for access, a document and language selection for document checks, and your acceptance for a paid order. Without these details we cannot provide the relevant service. Document checks, pricing and quality checks are automated; we do not create personal creditworthiness or advertising profiles.
4. Your documents and AI processing
Document content is processed during the document check and subsequently for translation and checks. We do not use customer data to train AI or translation models. Commissioned AI services are also prohibited from using it for training or model improvement. When translating personal data on a business customer’s instructions, we act as a processor; a separate agreement under Article 28 GDPR is required. This notice does not replace it. Before uploading, establish your authority and any additional requirements for sensitive data, such as health information.
5. Recipients
Hosting, storage and AI services, and authorised operations and support personnel receive data as necessary. zappmedia operates email and support itself; our support contact is localizer-support@zappmedia.de. Team order permissions apply: administrators see all orders; members see their own and orders shared with the team.
Subject-matter research
We use web search provided by OpenAI Ireland Ltd. to check terminology and factual matters. This involves processing order-related search terms, questions and limited contextual information, which may contain personal data. OpenAI may involve additional search and content providers in this research and transmit search queries to them. We limit the information transmitted through technical rules and filters; complete anonymisation is not guaranteed.
AI processing and research may involve processing data outside the EU and the European Economic Area, particularly in the United States. Our agreement with OpenAI provides for Standard Contractual Clauses or a European Commission adequacy decision for onward transfers covered by that agreement. Information and copies of applicable safeguards are available from our privacy contact. We do not promise exclusively European processing.
6. Payments
The pilot uses only the Stripe sandbox. During checkout, Stripe processes payment, billing and, where applicable, tax data. The portal stores references, amounts, currencies and statuses for credit, receipts and refunds, but no full card details. Before enabling real payments, we will add the final payment parties, their roles and data flows.
7. Retention, export and deletion
Account and order data is retained for account use, processing and access to results; documents are not currently all deleted automatically after delivery. You can export available sources and results as a ZIP under Settings → My account. You can delete eligible orders and close your personal account; only administrators can close an entire team account. Deletion immediately ends access. Online content and working files are deleted no earlier than 24 hours after the request, and only after required operations finish and connected systems confirm. Content-free deletion records remain for 180 days; completed notification metadata for 30 days. Portal database backups expire after 90 days; this does not apply universally to all providers or backups. Necessary financial, security and legal records remain for their purpose and statutory periods. Further log, support and provider retention periods still require confirmation. Connections and private document storage are encrypted; processing systems must be able to decrypt content.
8. Cookies and browser storage
Sign-in uses a necessary session cookie valid for at most twelve hours; signing out ends the session. Sign-in links expire after 15 minutes. Your chosen language and carousel display preference are stored locally until you change them or clear browser storage. These functions provide the requested service and your settings (section 25(2)(2) TDDDG). We do not use advertising trackers or analytics tools in the portal.
9. Messages and sharing
Sign-in and invitation emails provide access. You enable and disable optional order notifications in settings. They contain an order reference and protected link, not document text or attachments. Configured webhooks send these details to your selected service. If you create a sharing link for a subject-matter question, people with that link can view and answer the question and see the text excerpt provided for it. Share links only with intended recipients; delivered messages are also subject to recipients’ retention practices.
10. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability (Articles 15–20 GDPR). You may withdraw consent at any time for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation (Article 21); we will then continue only where legally permitted. Contact datenschutz@zappmedia.de. For data in a business customer’s documents, we assist that customer in handling your request. You may complain to a supervisory authority, particularly where you live or work. The authority for our registered office is the Berlin Commissioner for Data Protection and Freedom of Information; contact details are linked below.