Data Processing Agreement

Last updated: 17 October 2026

This Data Processing Agreement ("DPA") under Article 28 GDPR applies whenever Aylan Technologies LLC processes personal data on behalf of a FlutterLocalisation customer. It forms part of the Terms of Service and takes effect automatically when the customer accepts them. No signature is needed for it to apply.

1. Parties and roles

The customer is the controller, or a processor acting for its own clients ("Customer"). Aylan Technologies LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America is the processor ("Processor"). Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. "GDPR" includes the UK GDPR and the Swiss Federal Act on Data Protection where they apply.

2. Subject matter and duration

The Processor processes Customer personal data only to provide the FlutterLocalisation service described in the Terms. The details are in Annex 1. This DPA lasts as long as the Processor processes Customer personal data.

3. Instructions

The Processor processes Customer personal data only on documented instructions from the Customer, including with regard to international transfers, unless Union or Member State law requires otherwise; in that case the Processor informs the Customer first unless the law forbids it. The Terms, this DPA and the Customer's use and configuration of the service are the Customer's instructions. The Processor tells the Customer without delay if it believes an instruction infringes the GDPR.

4. Confidentiality

Everyone the Processor authorises to process Customer personal data is bound by a duty of confidentiality.

5. Security

The Processor implements the technical and organisational measures in Annex 2 (Article 32 GDPR). The Processor may update them as long as the overall level of protection does not decrease.

6. Subprocessors

The Customer gives general authorisation for the Processor to engage subprocessors. The current list is in Annex 3 and on the subprocessors page. The Processor informs the Customer of any intended addition or replacement at least 30 days in advance by email to the workspace owner and by updating that page. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service and receives a pro rata refund of prepaid fees. The Processor imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible to the Customer for its subprocessors.

Git providers (GitHub, GitLab, Bitbucket, Bitbucket Server) that the Customer connects to a project are chosen and contracted by the Customer and are not subprocessors of the Processor.

7. Assistance

Taking into account the nature of the processing, the Processor helps the Customer with appropriate measures to answer data subject requests (most can be handled directly in the dashboard: export, correction and deletion), and with the Customer's obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations. If a data subject contacts the Processor directly about Customer data, the Processor forwards the request to the Customer.

8. Personal data breaches

The Processor notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided in phases.

9. Deletion and return

The Customer can export its translations at any time from the dashboard. When the Customer deletes its account or workspace, the Processor deletes the related Customer personal data from the production database immediately. Copies in backups are overwritten within 8 weeks. On request the Processor confirms deletion in writing. This does not apply where Union or Member State law requires storage.

10. Information and audits

The Processor makes available all information necessary to demonstrate compliance with Article 28 GDPR, including answers to reasonable security questionnaires. The Processor holds no third-party security certification. The Customer, or an independent auditor bound by confidentiality, may carry out an audit once per year, or after a personal data breach, with at least 30 days' notice, during business hours and without disrupting operations. Each party bears its own costs.

11. International transfers

The Processor is established in the USA. Customer personal data is stored on the Processor's server in France, but because the Processor is a non-EU entity and some subprocessors operate outside the EEA, the transfer is covered as follows:

• The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference: Module Two (controller to processor) where the Customer is a controller and Module Three (processor to processor) where the Customer is a processor.
• For the SCCs: Clause 7 (docking) applies; in Clause 9 Option 2 (general written authorisation, 30 days' notice) applies; the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one determined by Clause 13(a); under Clause 17 the SCCs are governed by the law of France; under Clause 18 disputes are resolved by the courts of Paris, France. Annexes 1 to 3 of this DPA serve as Annexes I to III of the SCCs; the Customer is the data exporter and the Processor the data importer.
• For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies in addition. For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
• Onward transfers to subprocessors outside the EEA rely on the EU-US Data Privacy Framework where the subprocessor is certified, and otherwise on SCCs with the subprocessor.

12. Order of precedence and liability

In case of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms. Liability under this DPA follows the Terms, except where the SCCs or mandatory law provide otherwise.

Annex 1: Details of the processing

Data subjects

The Customer's users and invited team members; any person whose personal data the Customer includes in strings, comments or project data.

Categories of data

Name, email address, role and permissions in the workspace, login and usage metadata (timestamps, IP address of API token use), comments, and any personal data contained in translation keys and strings. The Customer should not upload special categories of personal data (Article 9 GDPR).

Nature and purpose

Hosting, storing, editing, translating (including by AI), exporting, and syncing localisation files to the Customer's Git repositories and apps; user management; support.

Frequency

Continuous for the duration of the contract.

Retention

Until deletion by the Customer or end of the contract; backups up to 8 weeks after that.

Location

Database and API: dedicated server in France, operated by the Processor. Subprocessors: see Annex 3.

Annex 2: Technical and organisational measures

Physical access

• The production server stands in non-public premises in France. Only authorised personnel of the Processor have physical access.

System access

• Administrative access over SSH only with personal keys; password login from the internet and root login are disabled; one named account is allowed; repeated failures are blocked by fail2ban.
• A host firewall is active. The database and the cache listen only on the local machine and are not reachable from the internet.
• Operating system security updates are installed automatically.

Data access

• Access to customer data requires authentication (user session, scoped API token, or the read-only live update key used by shipped apps). Workspace roles and per-project and per-flavor access rights limit what each member can see and change.
• Developer API tokens carry explicit scopes (read strings, write strings, AI translate), can expire and be revoked, and are stored only as SHA-256 hashes. The last use time and IP address of each token are recorded.
• User passwords are stored as salted PBKDF2 hashes.
• Access tokens for connected Git providers are never returned by the API and are deleted when the integration is disconnected. They are stored in the database without additional application-level encryption; we recommend fine-grained tokens limited to the localisation repository.

Transmission

• All public endpoints are served only over HTTPS with TLS certificates from Let's Encrypt. Email is handed to Brevo over SMTP with TLS. Calls to Google and Stripe use TLS.
• Only the strings, keys, placeholders and descriptions needed for a translation are sent to the AI provider, never account data.

Storage

• The server disks are not encrypted at the disk level. Backup files are readable only by the service account.

Availability and recovery

• Nightly database dumps, each verified after it is written, kept 14 days plus 8 weekly copies.
• Backups are currently kept on the same server. They protect against software errors and accidental deletion, not against the loss of the machine.

Separation and logging

• Customer data is logically separated by workspace. Staging and test environments use separate databases.
• Web server access logs are kept 14 days.

Organisation

• Access to production is limited to the Processor's named operator. Personnel are bound to confidentiality.
• Personal data breaches are handled and reported as set out in section 8. Vulnerability reports are welcome under the rules on our security page.

Annex 3: Subprocessors