Privacy
Short version: an e-mail address so you can sign in, a name so we can address you, and counts of what the plugin has translated. In our own e-mails we see whether they are opened and which links are clicked. If you agree to it, we tell Google and Meta whether one of our adverts led you here. No profiling, and none of your content.
Last updated 6 October 2026
Who is responsible
Brandforward, trading as WPGlotty (Hoofdveste 10, 3992 DG Houten, the Netherlands), is the controller for the personal data described here. You can reach us at [email protected].
This page covers the website at wpglotty.com and the licence server the WPGlotty plugin talks to. It does not cover your own WordPress website, where you are the controller, or your AI provider, with whom you have your own relationship.
What we collect, and why
| What | Why | On what basis |
|---|---|---|
| E-mail address | Signing in, and telling you about the plugin you use | Performing our agreement with you |
| First and last name | Addressing you as a person rather than an address | Performing our agreement with you |
| IP address of a sign-in attempt | Rate limiting, so nobody can use the form to send mail at strangers | Our legitimate interest in a service that is not abused |
| Licence key, and the domain it is activated on | Deciding whether a site may translate | Performing our agreement with you |
| Text your site sends on WPGlotty credits | Translating it and sending the translation back. For one hour we keep the translation, so a repeated request is answered without charging it twice. For 90 days we keep a fingerprint of each text, so we can check that no text is charged twice. We never keep the text itself | Performing our agreement with you |
| Whether you open our e-mails, and which links in them you click | Seeing which e-mails help you and which do not, so we send fewer of the ones that do not. We see this per e-mail, not what you do anywhere else. You can switch tips and offers off at the bottom of such an e-mail or in your account | Our legitimate interest in sending e-mails that are useful |
| Counts reported by the plugin | Showing you what your sites have done, and telling us whether the product works | Our legitimate interest in knowing whether it is used |
The counts are strings found, strings translated, words sent, dollars spent, which provider and model did the work, and the plugin and WordPress versions. Nothing about a visitor to your site, and nothing about a person.
What we never receive
- Your content, your source text, or any translation of it, unless your site translates on WPGlotty credits (see below)
- URLs beyond the domain the licence is already activated on
- Your WordPress users, your customers, or anybody who visits your site
- Your API keys for Claude, DeepL, Gemini, Google Translate or OpenAI, unless you ask us to keep them (see below)
On your own key, translation happens between your server and the provider you chose. It does not pass through us, and we could not read it if we wanted to.
On WPGlotty credits, your site sends the text to translate to us, and we have it translated by one of the three translation processors listed below, one at a time, the next only when one is unavailable. We use it for nothing else. We never store the text itself, and the translation is deleted from our side after an hour. The processors we use do not train their models on it.
Provider keys, if you ask us to keep them
There is an optional store on your licence page for your Claude, DeepL, Gemini, Google Translate or OpenAI key, so that several sites can collect one key instead of you pasting it into each. It is off unless you use it, and nothing about the plugin needs it.
If you do use it: the key is strongly encrypted before it is stored. It is tied to your account, so a stored key cannot be moved to somebody else's, and it is never shown again to anybody, including us. Your page shows the provider, the last four characters and the date.
Collecting it takes two things: a site on one of your licences, and a code you get from your account page that lasts fifteen minutes. Every collection and every refusal is listed there and e-mailed to you. Delete the key and it is gone from our side immediately; sites that already collected it keep their own copy, which they store encrypted in WordPress.
Cookies
Two are strictly necessary and neither is used to follow anybody: a session cookie that keeps you signed in, and a cookie holding the single fact that somebody is signed in, so that a page built in advance can offer a dashboard link instead of a sign-up button. Those are set whether you agree or not, because without them you cannot sign in.
Beyond those we use Google Tag Manager for two things, and neither happens until you say so. Statistics tell us which pages get read and where people give up. Advertising tells us whether an advert we paid for led anybody here.
Both start switched off. We use Google's consent mode, so the tag is present but measures nothing until you choose, and if you choose only what is necessary, it stays that way. You can change your mind at any time through , and your choice is remembered in your own browser rather than on our servers.
If you say yes to advertising, Meta's pixel loads as well. When you then create an account, activate a site or buy something, our server tells Google and Meta that it happened, with your e-mail address hashed so that it cannot be read back. Meta also gets your name and the town, postcode and country of your billing address, hashed in the same way. If you say no, Meta hears nothing about you from us, and Google only learns that one of its adverts led to a sign-up or a sale, without your address.
When you arrive through one of our adverts, we keep the advert's click code in a cookie of our own for 90 days. Only our own server reads it, so that we can tell which advert worked once you have an account.
Who else sees it
These are the only parties that process personal data on our behalf.
| Who | For what | Where |
|---|---|---|
| Supabase | Accounts, licences and usage counts | Ireland (EU) |
| Cloudflare | Serving the site, blocking abuse, and storing the plugin download | EU and United States, under the EU standard contractual clauses |
| Elastic Email | Sending the sign-in link and account e-mail | EU and United States, under the EU standard contractual clauses |
| Stripe | Taking payments and holding the card details | Ireland (EU) and United States, under the EU standard contractual clauses |
| Moneybird | Invoices and bookkeeping | Netherlands (EU) |
| Anthropic | Translating text sent on WPGlotty credits | United States, under the EU standard contractual clauses |
| OpenAI | Translating text sent on WPGlotty credits | United States, under the EU standard contractual clauses |
| Translating text sent on WPGlotty credits, and measuring visits and adverts if you agree to it | EU and United States, under the EU standard contractual clauses | |
| Meta | Measuring whether our adverts work, only if you agree to it | Ireland (EU) and United States, under the EU standard contractual clauses |
We do not sell personal data, and we do not share it with anybody for their own purposes.
How long we keep it
- An account that was created but never confirmed is deleted an hour later
- An account you delete is gone immediately, along with its licences and its statistics
- Statistics for a site are deleted when that site is released from a licence
- Sign-in attempt records, which hold an e-mail address and an IP, are kept briefly for rate limiting
- An account whose free licence is never used is removed: ninety days if it was never activated on a site, twelve months if it was activated and then went quiet. We write to you once, fourteen days before
- Anything we are required to keep for tax or accounting is kept for as long as that requires
What you can ask for
You may ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to hand it over in a portable form, and to object to processing we base on a legitimate interest. You can delete your own account from your account page without asking anybody.
Write to [email protected] and you will hear back within a month. If you think we have it wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
There are no passwords here. You sign in with a link sent to your e-mail address, so there is nothing to steal and no password of yours for us to lose. Administrative access requires a second factor. Data is encrypted in transit and at rest by our hosting providers.
If we ever suffer a breach that puts your rights at risk, we will tell you and the authority, as the law requires.
Changes
When this document changes in a way that matters, the date at the top changes and we e-mail account holders. Older versions are in the site's public repository history.