Privacy Policy

Last updated: 17 October 2026

This policy explains what personal data we process when you visit flutterlocalisation.com, use the FlutterLocalisation dashboard (app.flutterlocalisation.com), its API, CLI or MCP server, or contact us, and which rights you have under the EU and UK General Data Protection Regulation (GDPR).

1. Controller

Aylan Technologies LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States of America. Authorised representative: Mounir Tajaouart. Email: support@flutterlocalisation.com. More details in the imprint.

For the content customers put into FlutterLocalisation (translation strings, project data, the accounts of their team members) we act as a processor on behalf of the customer. That processing is governed by our Data Processing Agreement, and the customer is the controller.

2. Where your data is stored

The FlutterLocalisation API and its PostgreSQL database run on a dedicated server in France (EU) that we operate ourselves. No third-party cloud provider hosts the database. The website and the dashboard are static files delivered by Google Firebase Hosting. The services that receive personal data from us are listed in section 6 and on the subprocessors page.

3. What we process, why, and on which legal basis

3.1 Visiting this website

When you load a page, Firebase Hosting receives your IP address, the requested URL, the time, referrer and browser user agent so it can deliver the page. Legal basis: our legitimate interest in delivering and securing the website (Art. 6(1)(f) GDPR). We do not combine these logs with other data.

3.2 Analytics and advertising measurement (only with consent)

If you click Accept in the cookie banner, this website loads Google Tag Manager, Google Analytics 4 and the Google Ads conversion tag. They set cookies (for example _ga, _ga_*, _gcl_*) to count visits, see which pages are useful and measure which ads lead to sign-ups. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). If you click Reject or make no choice, none of these scripts is loaded and no analytics cookie is set. Google consent mode is set to "denied" by default. You can change your choice at any time with the Cookie settings link at the bottom of every page; withdrawing consent removes the analytics cookies we can reach and stops loading the tags.

The dashboard (app.flutterlocalisation.com) is a separate web app with its own consent banner. It loads Google Analytics 4 only after you click Allow there, to count page views and see which features are used. Without consent nothing is loaded. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your choice at any time under Cookie settings in the dashboard sidebar.

3.3 Support chat on this website

The chat button is provided by Widget-Chat, our own support chat service, hosted on Render in the USA. When the page loads, the chat stores a random visitor identifier in your browser's local storage so a conversation can continue across pages. If you write a message, it is stored with that identifier and answered with the help of the Google Gemini API. Do not share secrets in the chat. Legal basis: our legitimate interest in answering questions quickly (Art. 6(1)(f) GDPR), and pre-contractual steps where you ask about buying (Art. 6(1)(b) GDPR).

3.4 Newsletter

If you subscribe, we store your email address, the date and the page you subscribed from, and send you Flutter localisation tips. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time by writing to us. To keep bots out, Google reCAPTCHA v3 is loaded only when you submit the form (see 3.7).

3.5 Your account and use of the service

To provide FlutterLocalisation we process: your name and email address, a salted hash of your password, workspace, project and team membership data, invitations, your settings, the translation keys and strings you upload or create, comments, a log of the system emails we send you (address, type, date, delivery status), API tokens (we store only a SHA-256 hash of each token, its prefix, scopes, creation date, last use and last IP address), and, if you connect a Git provider, the access token and repository details needed to sync. Legal basis: performance of the contract with you or your employer (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure and preventing abuse (Art. 6(1)(f) GDPR).

If you are invited to a workspace by a customer, the customer decides about your account in that workspace and we process your data as their processor.

3.6 AI translation

When you or your team ask for AI translation, we send the source strings, key names, placeholders and any description you attached to the Google Gemini API or Google Vertex AI and store the returned translation in your project. We do not send your name, email or other account data with these requests. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.7 Sign-up protection

The sign-up form in the dashboard and the newsletter form use Google reCAPTCHA v3, which evaluates your IP address and browser signals at submission to tell people from bots. Legal basis: our legitimate interest in preventing fake accounts and spam (Art. 6(1)(f) GDPR).

3.8 Payments and invoices

Paid plans are billed by Stripe. Stripe collects your payment method directly; we never see or store full card or bank details. We store the Stripe customer and subscription identifiers, plan, billing status, billing name, address and VAT ID needed for invoices. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations under tax and commercial law (Art. 6(1)(c) GDPR).

3.9 Email we send

Account emails (address verification, password reset, invitations, billing and service notices) are sent through Brevo. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.10 Contacting us

If you email us or use the support form in the dashboard, we process your message, your contact details and anything you attach in order to answer. Our mailbox is hosted by Google Workspace. Legal basis: performance of the contract or pre-contractual steps (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR).

4. Cookies and similar storage on this website

Fonts are served from our own domain, so no font provider receives your IP address.

5. Who receives your data

We do not sell personal data and do not share it for advertising beyond the consent-based Google tags described above. We share data only with the service providers below, who process it on our instructions under a data processing agreement, with Git providers you connect yourself (GitHub, GitLab, Bitbucket, or your own Bitbucket Server; their own terms apply), and with authorities where the law requires it.

6. Service providers (processors)

We announce changes to this list on the subprocessors page.

7. International transfers

Aylan Technologies LLC is a company in the USA, and several providers above process data outside the EU and EEA. Where a recipient is certified under the EU-US Data Privacy Framework (Google, Stripe), the transfer relies on the European Commission's adequacy decision of 10 July 2023. Otherwise, and in addition, transfers rely on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914). For customers, the transfer to us is covered by the Standard Contractual Clauses in our DPA. The FlutterLocalisation database itself stays on our server in France. You can ask us for a copy of the relevant safeguards.

8. How long we keep data

• Account and project data: for as long as your account exists. When you delete your account in the dashboard, your user, your workspaces and everything in them (projects, translations, members, tokens, integration tokens) are deleted from the live database at once and any active subscription is cancelled. The log of system emails sent to your address, support requests and newsletter subscriptions are stored separately; we delete them on request.
• Database backups: one copy per night on the same server, readable only by the service account, kept 14 days, plus one Sunday copy per week kept 8 weeks. Deleted data therefore disappears from backups within 8 weeks at the latest.
• Web server access logs on our server: 14 days. Application logs are rotated automatically and kept only as long as needed for debugging and security.
• Invoices and billing records: as long as tax and commercial law requires, up to 10 years.
• Newsletter: until you unsubscribe.
• Support emails and chats: up to 3 years after the last message, unless needed longer for a contract or a legal claim.
• Google Analytics data: according to the retention set in Google Analytics, at most 14 months.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Write to support@flutterlocalisation.com; we answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where the alleged infringement took place.

You can export your translations at any time from the dashboard (ARB files) and delete your account yourself in the account settings.

10. Automated decisions

We do not make decisions with legal or similarly significant effects based solely on automated processing. reCAPTCHA scores are only used to block obvious bots.

11. Children

FlutterLocalisation is a tool for businesses and developers and is not directed at children under 16.

12. Security

See our security page for the technical and organisational measures we apply.

13. Changes

We update this policy when our processing changes. The date at the top shows the current version. For material changes affecting customers, we notify account owners by email.