Privacy Policy
How Pinkbrainlab Ltd (trading as TranslateMax) collects, uses, shares and protects your personal data, and the rights you have over it.
Ce document est publié en anglais. Toute traduction est fournie à titre indicatif uniquement ; en cas de divergence, la version anglaise prévaut.
1. Who We Are and How to Contact Us
Pinkbrainlab Ltd (trading as TranslateMax) is the data controller for the personal data described in this policy. We are registered in England and Wales under company number 16113240.
| Detail | Value |
|---|---|
| Controller | Pinkbrainlab Ltd |
| Trading name | TranslateMax |
| Company number | 16113240 |
| Registered address | 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom |
| Data protection contact | info@translatemax.com |
| Telephone | +44 7391 482 056 |
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
2. Personal Data We Collect
2.1 Data you give us
- Account data — your name, email address and password (stored only as a secure hash).
- Billing data — billing address and country, collected so that your payment can be authorised.
- Order content — the text or documents you submit for translation, and the translations we produce for you. This may contain personal data about you or about other people, depending on what you send us.
- Correspondence — the content of emails, support requests and messages you type into our website chat widget.
2.2 Data we generate or receive
- Order and transaction records — order numbers, word counts, language pairs, service options, prices and order status history.
- Payment metadata — the amount, currency, date, outcome and the last four digits of the card used. We never receive or store your full card number.
- Technical and session data — your IP address and browser user-agent, recorded against your login session for security purposes.
PDFs you upload are read in your own browser to count the words. The file itself is never transmitted to or stored on our servers — only the filename and the resulting word count are saved. Text you paste into the calculator is submitted with your order and is stored as part of the order record.
3. Why We Process It, and Our Lawful Basis
We only process personal data where we have a lawful basis under Article 6 of the UK GDPR. The table below sets out each purpose, the data involved and the basis we rely on.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and administering your account | Account data | Article 6(1)(b) — performance of a contract |
| Providing the translation services you ordered | Order content, order records | Article 6(1)(b) — performance of a contract |
| Taking payment and preventing payment fraud | Billing data, payment metadata | Article 6(1)(b) — contract; Article 6(1)(f) — legitimate interests in preventing fraud |
| Sending service emails (verification, password reset, order and payment confirmations) | Account data, order records | Article 6(1)(b) — performance of a contract |
| Responding to support enquiries and the chat widget | Correspondence | Article 6(1)(f) — legitimate interests in supporting our customers |
| Keeping your login session secure | Technical and session data | Article 6(1)(f) — legitimate interests in securing our platform |
| Keeping accounting, tax and transaction records | Order records, payment metadata, billing data | Article 6(1)(c) — compliance with a legal obligation |
| Handling complaints, refunds, chargebacks and legal claims | Order records, payment metadata, correspondence | Article 6(1)(f) — legitimate interests in defending our position; Article 6(1)(c) where a scheme rule applies |
We do not sell your personal data, we do not share it with third parties for their own marketing, and we do not carry out behavioural advertising.
3.1 Special category data
Documents sent for translation — medical records, court papers, immigration files — may contain special category data as defined in Article 9. We process such data only as necessary to perform the translation you have asked us to carry out, on the basis of Article 9(2)(a) (your explicit consent, given when you submit the document for that purpose) or Article 9(2)(f) where it relates to legal claims. Do not send us special category data about other people unless you are entitled to do so.
4. How Long We Keep It
We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires.
| Category | Retention period | Why |
|---|---|---|
| Account data | While your account is open, and for a reasonable period after closure | To let you reopen your account and to resolve any outstanding matters |
| Order content (source text and translations) | While your account is open, so that you can re-download your deliverables. Removed following account closure, or earlier if you ask us to | Contract performance and your convenience |
| Order records, payment metadata and billing address | 6 years from the end of the financial year in which the transaction took place | Statutory accounting and tax record-keeping, and card-scheme dispute windows |
| Session records (IP address, user-agent) | Until the session expires | Security of your account |
| Support correspondence and chat logs | For as long as needed to handle the matter and any follow-up, typically no more than 24 months | To handle follow-up queries and complaints |
You can ask us to delete your order content at any time, including before these periods elapse, by emailing info@translatemax.com. We will do so unless we are required to retain a record for accounting or legal reasons — in which case we retain the transaction record, not the document content.
5. Who We Share It With
We share personal data only with those who need it to deliver the service, and only to the extent necessary.
- Our linguists, editors and language-service partners, who receive the material needed to complete your order and are bound by confidentiality obligations.
- The sub-processors listed in section 6, who provide the technical infrastructure we run on.
- Professional advisers (lawyers, accountants, auditors) where necessary and under a duty of confidence.
- Law enforcement, regulators or courts, where we are legally required to disclose.
- A purchaser or successor, if our business or its assets are acquired — in which case this policy continues to apply to your data.
Card payment details are collected directly by our PCI-DSS compliant payment processor on their own hosted payment page. We do not see, receive or store your full card number at any point.
6. Sub-processors
The following organisations process personal data on our behalf, under written terms that require them to protect it and to act only on our instructions.
| Category of recipient | Purpose | Data involved |
|---|---|---|
| Payment processing | Authorising card payments and screening them for fraud | Name, email, billing address, transaction amount. Card details are collected directly by the processor and never reach us |
| Cloud hosting and managed database | Running the platform and storing your account and order data | All account, order and transaction data held by the platform |
| Transactional email delivery | Sending verification, password reset, order and payment emails | Name, email address, order reference |
| AI language model provider | Generating replies in the website chat widget | The content of messages you type into the chat widget |
| Internal operational alerting | Notifying our team when orders and payments occur | Name, email address, order number, transaction amount |
| Content delivery network | Serving the in-browser PDF reader used to count words on your own device | Your IP address and browser user-agent, as with any web request |
We review this list when we change providers, and this page is updated when it changes. If you need further detail about a specific processor — for example to complete your own data-protection assessment — contact us at info@translatemax.com.
7. Artificial Intelligence and Automated Processing
Our website chat widget is powered by a third-party large language model provider. Anything you type into that widget is transmitted to that provider in order to generate a reply, and is recorded in our server logs.
Please do not enter confidential information, document contents, or personal data about other people into the chat widget. Use it for general questions about our services; send anything sensitive to us by email or through your account instead.
Translation work itself is performed by human linguists, in line with our published delivery model.
We do not make decisions producing legal or similarly significant effects about you by automated means alone, within the meaning of Article 22 of the UK GDPR. Automated checks — such as country-based sanctions screening at checkout and payment fraud screening by our payment processor — may cause an order to be declined; you can always contact us to have this reviewed by a person.
8. International Transfers
Some of the processors listed in section 6 are located outside the United Kingdom. Where personal data is transferred outside the UK, we rely on one of the following safeguards under Chapter V of the UK GDPR:
- An adequacy decision made by the UK government in respect of the destination country.
- The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Our linguists and language-service partners may also be located outside the United Kingdom. Where they are, the same safeguards apply, alongside contractual confidentiality obligations.
You may request a copy of the safeguards we rely on for any specific transfer by emailing info@translatemax.com.
9. Your Rights
Under the UK GDPR you have the following rights over your personal data:
| Right | What it means |
|---|---|
| Access | Obtain confirmation that we process your data, and a copy of it (Article 15) |
| Rectification | Have inaccurate data corrected and incomplete data completed (Article 16) |
| Erasure | Have your data deleted where there is no continuing reason to hold it — the "right to be forgotten" (Article 17) |
| Restriction | Have us pause processing while a dispute about accuracy or lawfulness is resolved (Article 18) |
| Portability | Receive the data you gave us in a structured, machine-readable format, or have it sent to another controller (Article 20) |
| Objection | Object to processing carried out on the basis of our legitimate interests (Article 21) |
| Withdraw consent | Withdraw consent at any time, where we rely on consent. This does not affect processing carried out before withdrawal (Article 7(3)) |
9.1 How to exercise your rights
Email info@translatemax.com with the details of your request. We may ask you to verify your identity before we act, to make sure we do not disclose your data to someone else.
We will respond within one month. If your request is complex or you have made several requests, we may extend that by up to two further months and will tell you if we do. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.
10. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at info@translatemax.com so that we have the chance to put it right.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at any time. ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. Website: ico.org.uk.
If you are resident in the European Union, you may instead complain to the supervisory authority in your country of residence.
11. How We Protect Your Data
- All traffic between your browser and our servers is encrypted in transit using TLS.
- Passwords are stored only as salted hashes; we cannot read them.
- Card data never reaches our systems — it is collected directly by our PCI-DSS compliant payment processor.
- Access to production data is limited to personnel who need it to operate the service.
- Payment webhooks are cryptographically signature-verified before they are accepted.
- Sessions expire automatically and are bound to the device that created them.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will inform you directly where the risk is high.
13. Children
Our services are intended for business and adult use. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.
If you believe a child has provided us with personal data, contact info@translatemax.com and we will delete it.
14. Links to Other Websites
Our site may link to websites we do not control. This policy does not apply to them. We are not responsible for their content or their privacy practices, and we encourage you to read their privacy notices before providing them with personal data.
15. Changes to This Policy
We may update this policy to reflect changes to our services, our sub-processors or the law. The version number and date at the top of this page always show the current version.
Where a change materially affects how we use your personal data, we will notify registered users by email before it takes effect.
16. Contact Us
- Data protection enquiries and rights requests: info@translatemax.com
- General enquiries: info@translatemax.com
- Telephone: +44 7391 482 056
- Post: Pinkbrainlab Ltd, 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom
- Support hours: Monday to Friday, 09:00–18:00 GMT, excluding UK bank holidays
Questions ou Préoccupations?
Si vous avez des questions sur ce document ou avez besoin de clarifications sur certains termes, notre équipe d'assistance est là pour vous aider.
© 2026 TranslateMax. Tous droits réservés