This privacy policy explains which personal data we process when you visit heylingo.io, contact us or buy heylingo. It also explains how data is handled when one of our customers uses the heylingo translation service on their own website.
Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
Jermaine J. Ernst
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Email: info@heylingo.io
Please use this address for any question about data protection and to exercise your rights.
Overview
heylingo.io is a static website. When you browse it:
- we set no cookies,
- we use no analytics or tracking tools,
- fonts are delivered with the website itself, so no external font service is contacted.
Personal data is processed only in the cases described below: delivery of the website by our host, images in blog posts, YouTube videos you choose to play, contact by email and the purchase of heylingo through Stripe. A separate section covers the heylingo translation service.
Hosting and server logs
heylingo.io is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Each time you open a page, Cloudflare processes the following server log data:
- IP address
- date and time of the request
- requested URL
- referrer (the page you came from)
- user agent (browser and operating system)
Cloudflare uses this data to deliver the website to you and to protect it from attacks and misuse. We do not use it to identify you or to create user profiles.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable delivery of our website.
Cloudflare may process data outside the European Union, including in the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are based on the adequacy decision of the European Commission (Art. 45 GDPR). Where the Data Privacy Framework does not apply, transfers are based on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
More information: Cloudflare privacy policy.
Blog images and videos
Images
Images in our blog posts are loaded from assets.seobotai.com, an external image host. When you open a blog post, your browser requests these images directly from that host. The host thereby receives your IP address and the technical information that is part of every request, such as the requested file, the address of our website and your browser’s user agent.
The host needs your IP address to deliver the images. We have no influence on how the host processes this data.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is showing images in our blog posts.
YouTube videos
Some blog posts contain YouTube videos. They are not loaded when you open the page. No data is sent to YouTube until you click “play”. Only then is the video loaded from youtube-nocookie.com.
YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Once the video is loaded, Google receives at least your IP address and the address of the page. Google may also store information on your device or read it from your device, for example cookies, and may process data about how you use the video. Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.
The legal basis is your consent, which you give by clicking “play” (Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 25(1) of the German Telecommunications and Digital Services Data Protection Act, TDDDG).
Your consent applies only to the video you start. You can withdraw it at any time with effect for the future: do not start any further videos and close or reload the page. You can delete cookies set by Google in your browser settings.
More information: Google privacy policy.
If you email us, we process your email address, your message and any other information you provide, such as your name or company. We use this data only to answer your request.
If your request relates to a contract with us or to concluding one, the legal basis is Art. 6(1)(b) GDPR. Otherwise the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering requests sent to us.
We delete the data once your request has been fully dealt with, unless statutory retention obligations apply (see “Retention”).
Purchasing heylingo via Stripe
You sign up for heylingo through Stripe Checkout, which you reach via a payment link on heylingo.io. Invoices, your payment method and cancellation are managed in the Stripe Customer Portal. There is no user account on heylingo.io.
The payment provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes the data you enter during checkout and in the customer portal. This includes your name, email address, billing address, company name and VAT ID if you provide them, your payment details, and transaction and invoice data.
You enter your payment details directly with Stripe. We do not receive your full card or account details.
We receive from Stripe the data we need to manage your subscription and bill your usage, such as your name, email address, billing details and payment status. To bill you, we report your usage (the number of translated characters) to Stripe.
The legal basis is Art. 6(1)(b) GDPR, because the processing is necessary to conclude and perform the contract. We keep invoices and accounting records to meet our retention obligations under German commercial and tax law. The legal basis for this is Art. 6(1)(c) GDPR.
Stripe also processes some data under its own responsibility, for example to prevent fraud and to meet its legal obligations as a payment provider. Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework.
More information: Stripe privacy policy.
The heylingo translation service
This section is for our customers and for visitors to websites that use heylingo.
Our role
heylingo makes a customer’s website multilingual. When a customer uses heylingo, we process the content of the customer’s website on the customer’s behalf. For any personal data of visitors to that website, the customer is the controller and we act as a processor (Art. 28 GDPR).
If you visit a website that uses heylingo, please read that website’s privacy policy and send requests about your data to its operator.
Customers can request a data processing agreement under Art. 28 GDPR at info@heylingo.io.
In the visitor’s browser
The customer adds the heylingo script to their website. The script shows a language switcher and picks the visitor’s preferred language. It stores the chosen language in the visitor’s browser (localStorage) so the website appears in that language on later visits. The script sets no cookies.
The entry stays in the browser until the visitor deletes it. Storing it is limited to what is strictly necessary for the language function the visitor uses (§ 25(2) no. 2 TDDDG).
Translation
To translate a page, the script sends the page’s text to our translation service. Because the visitor’s browser connects to the service, the service also receives the visitor’s IP address and the technical information that is part of every request.
Page text usually contains no personal data. If a page does contain personal data, for example names on a team page or text shown only to a logged-in user, this text is sent to us as well. The customer decides on which pages the script runs.
Text that is translated for the first time is translated by AI. For this we use a large language model of Anthropic PBC, USA, through its API, as a sub-processor. Transfers to Anthropic are based on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
Each translation is stored in a translation memory for that website. Later visitors receive the stored translation, so the same text is not sent to the AI provider again.
The translation service and the translation memories run on servers of netcup GmbH in Germany.
Inline editing
Customers can correct translations directly on their live website. This edit mode can only be used by the site owner. Corrected sentences are stored in the translation memory and are never re-translated.
Deletion
When a customer cancels, the script stops translating and the website shows its original language. The website’s translation memory, including manual corrections, is deleted 30 days after the cancellation takes effect.
Retention
We keep personal data only as long as it is needed for the purpose it was collected for, unless a statutory retention obligation applies. While such an obligation applies, we use the data only for that purpose.
- Server log data is processed by Cloudflare only as long as needed to deliver the website and defend it against attacks.
- Emails are deleted once your request has been dealt with, unless they must be kept as business correspondence.
- Contract and billing data is kept for the duration of the contract. Invoices, accounting records and business correspondence are kept for the statutory periods under German commercial and tax law (§ 257 HGB, § 147 AO), which range from six to ten years.
- Translation memories are kept until 30 days after the cancellation takes effect.
Your rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR): you can ask whether we process your data and receive a copy of it.
- Rectification (Art. 16 GDPR): you can have incorrect data corrected and incomplete data completed.
- Erasure (Art. 17 GDPR): you can have your data deleted, unless we are required to keep it.
- Restriction of processing (Art. 18 GDPR): you can have the processing of your data restricted, for example while its accuracy is being checked.
- Notification (Art. 19 GDPR): we inform recipients of your data about any rectification, erasure or restriction, unless this is impossible or involves disproportionate effort.
- Data portability (Art. 20 GDPR): you can receive data you provided to us in a structured, commonly used and machine-readable format, or have it sent to another controller.
- Withdrawal of consent (Art. 7(3) GDPR): you can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing before the withdrawal.
To exercise your rights, email info@heylingo.io. If your request concerns a website that uses heylingo, please contact the operator of that website first, as it is the controller. We support our customers in answering such requests.
Right to object
Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing your data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is Der Landesbeauftragte fĂĽr den Datenschutz und die Informationsfreiheit Baden-WĂĽrttemberg (the State Commissioner for Data Protection and Freedom of Information of Baden-WĂĽrttemberg).
No automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The AI used by heylingo translates text; it does not make decisions about people.
Changes to this policy
We update this policy when our services or the legal requirements change. The current version is always available on heylingo.io. The date of the last update is shown at the end of this policy.
Last updated 10 October 2026