Website Translation Cost Calculator

Understanding Website Translation Costs Made Easy

If you’re looking to expand your online presence globally, translating your website is a crucial step. But how much does it cost to make your content accessible in multiple languages? Figuring out the expenses involved doesn’t have to be a headache. With tools like a website translation cost estimator, you can quickly get a sense of your budget before diving into the project.

Factors That Impact Translation Pricing

Several elements play a role in determining the price of translating a website. The volume of content—whether measured in words or pages—is often the starting point. Then, the complexity of the language pair comes into play; niche or less common languages typically cost more due to limited translator availability. On top of that, extras like proofreading or adapting content to fit cultural nuances can add to the bill. A reliable cost calculator simplifies this by breaking down each factor, so you know exactly where your money is going.

FAQs

How accurate are the cost estimates from this tool?

Our calculator uses industry-standard base rates, like $0.10 per word or $50 per page, and applies realistic multipliers for language pairs and additional services. While it’s a close estimate, actual costs can vary slightly depending on the translation provider or specific project needs. Think of this as a solid starting point to plan your budget, and you can always reach out to professionals for a final quote.

Why do costs differ based on language pairs?

Not all languages are equally common or easy to translate. For instance, translating from English to Spanish might have a standard rate, but a rarer language like Icelandic could come with a 1.2x multiplier due to fewer available translators and higher demand. Our tool factors in these differences to give you a realistic picture of what to expect.

Can I use this tool for multiple target languages?

Absolutely! Just select all the target languages you need, and the tool will multiply the base cost by the number of languages. You’ll see a clear breakdown of how each language impacts the total, so there’s no confusion. It’s a handy way to compare costs if you’re debating between translating into two languages or five.

These terms of service govern the use of Heylingo, a service that makes websites multilingual. Heylingo is offered to businesses only.

1. Scope and parties

These terms apply to all contracts for the use of Heylingo between Jermaine J. Ernst, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany, email info@heylingo.io (“we”, “us”) and our customers (“you”).

Heylingo is offered exclusively to entrepreneurs (Unternehmer) within the meaning of § 14 BGB. These are natural or legal persons or partnerships with legal capacity who conclude the contract in the exercise of their commercial or independent professional activity. We do not conclude contracts with consumers within the meaning of § 13 BGB. By concluding a contract, you confirm that you are acting as an entrepreneur. We may ask you to prove this, for example with your VAT ID or an entry in a commercial register.

Your own terms and conditions do not apply, even if we do not expressly object to them, unless we have agreed to them in text form.

2. The service

Heylingo makes your website multilingual. You add one script tag to your website. The script shows a language switcher, selects the visitor’s preferred language, stores the chosen language in the visitor’s browser, sends the page’s text to our translation service and replaces it with the translation.

Text that has not been translated before is translated by AI (a large language model) and stored in a translation memory for your website. Later page views receive the stored translation.

All languages supported by Heylingo are included. The currently supported languages are listed on heylingo.io.

You can correct translations directly on your live website, in an edit mode that only you as the site owner can use. Sentences you have edited manually are never re-translated.

There is no user account or dashboard on heylingo.io. Invoices, your payment method and cancellation are managed in the Stripe Customer Portal.

For the term of the contract, you receive a non-exclusive, non-transferable right to use the Heylingo script on your website. All other rights to Heylingo remain with us.

We may use subcontractors to provide the service, in particular for hosting and AI translation. Subcontractors that process personal data on your behalf are listed in the data processing agreement (section 9). We may develop Heylingo further and change its features, provided the core function described in this section is preserved and the change is reasonable for you.

3. Conclusion of the contract

The description of Heylingo on heylingo.io is not a binding offer.

You sign up through Stripe Checkout, which you reach via the “Start translating” buttons on heylingo.io. By completing the checkout, you make a binding offer to conclude the contract and accept these terms, including the data processing agreement (section 9). We accept your offer by activating your subscription, which normally happens immediately after checkout.

The contract language is English. These terms and the data processing agreement can be viewed, saved and printed on heylingo.io at any time.

4. Prices and billing

Heylingo has one pricing model: pay per use. The price is a monthly price per one million translated characters with a monthly minimum, as listed on heylingo.io (currently EUR 20 per 1,000,000 characters per month and a minimum of EUR 5 per month, which includes the first 250,000 characters). It includes all supported languages.

The characters counted for a month are the characters of the translated text that Heylingo keeps for your website in its translation memory, across all target languages. Page views and the number of visitors do not affect the price.

For each billing month, you pay the higher of the minimum and the price of the characters counted for that month. If no characters are counted for a billing month, nothing is charged for it. If your subscription started without the minimum, the minimum applies from the date we announce to you by email, at least 30 days in advance.

Billing runs through Stripe as a metered subscription. Your usage is billed monthly in arrears and charged to the payment method you stored with Stripe. Invoices are available in the Stripe Customer Portal.

All prices are net prices. VAT is added where applicable.

We announce price increases by email at least 30 days before they take effect. A new price applies from the first billing month after it takes effect. As you can cancel at any time, you can avoid a price increase by cancelling before it takes effect.

If a payment fails, we may suspend the service after notifying you until the outstanding amount has been paid. During a suspension, your website shows its original language.

5. Your obligations

You must hold all rights needed to have the content of your website translated, stored and displayed, including in translated form.

You grant us a non-exclusive right to process, translate, store and deliver your content and its translations, to the extent necessary to provide Heylingo. This includes the right to have our subcontractors do so. The right is limited to the term of the contract and the deletion period in section 8.

You must not use Heylingo for unlawful content, in particular content that infringes the rights of third parties or violates criminal law.

You are responsible for integrating the script correctly, as described by us, and only on websites that you operate or are authorised to operate.

You must not misuse Heylingo. In particular, you must not:

interfere with or overload the service, or circumvent its security or billing,
send requests to the translation service other than through the Heylingo script integrated as intended,
copy, decompile or reverse engineer the script or the service, except where mandatory law permits this,
use Heylingo to build a competing service.

If a third party asserts claims against us because of content on your website or because you breached these terms, you indemnify us against these claims, including the reasonable costs of legal defence. This does not apply if you are not responsible for the breach.

6. AI translations

Translations are produced automatically by AI. We do not review them before they are shown on your website.

Machine translations may contain errors, omissions or wording that does not fit the context. We provide machine translation, not a reviewed or certified translation. The agreed quality of the translations is that of an unreviewed machine translation. A translation is therefore not defective merely because it contains errors of this kind.

Translations appear on your website as soon as they are produced. The final review of the translations is your responsibility. You must check them yourself, in particular where errors can have legal or financial consequences, such as legal texts, prices, product information and safety notices. You can correct any translation in the edit mode on your website. Content you do not want to review must be excluded from translation, for example with the attribute data-heylingo-skip.

You are responsible for all content published on your website, including its translations.

We are not liable for damage caused by errors, omissions or inaccurate wording in translations. This does not apply in the cases of the first paragraph of section 10 (intent, gross negligence, injury to life, body or health, guarantees, fraudulently concealed defects and product liability). It also does not apply to errors that the machine translation did not cause, for example if a technical fault shows the translation of a different text.

7. Availability

We aim to keep Heylingo available and working, but we do not guarantee a specific availability or uptime. Interruptions can occur, for example due to maintenance, updates or disruptions at our subcontractors.

If Heylingo is unavailable, your website shows its original language. Text that is not translated is not counted towards your price.

We are not responsible for disruptions caused by events beyond our reasonable control, for example natural disasters, epidemics, war, strikes, official orders, failures of public communication networks or attacks on our systems despite appropriate security measures.

8. Term and cancellation

The contract starts when it is concluded and runs for an indefinite period.

You can cancel at any time in the Stripe Customer Portal or by email to info@heylingo.io. Usage up to the effective date of cancellation is billed.

We can cancel the contract with 30 days’ notice by email.

The right of both parties to terminate for good cause without notice remains unaffected. Good cause for us exists in particular if you are in default of payment despite a reminder, use Heylingo for unlawful content or seriously breach your obligations under section 5. In these cases, we may instead suspend the service for your website.

After the contract ends, the script stops translating and your website shows its original language. We delete your website’s translation memory, including manual corrections, 30 days after the contract ends. We recommend removing the script tag from your website.

9. Data protection

When you use Heylingo, we process personal data on your behalf, in particular personal data contained in the content of your website and the technical data of your visitors’ requests. For this processing, you are the controller and we act as your processor (Art. 28 GDPR).

Our data processing agreement (DPA, in German: Auftragsverarbeitungsvertrag, AVV) under Art. 28 GDPR is part of these terms. It can be viewed at heylingo.io/dpa at any time. When you accept these terms, you also conclude the data processing agreement. No separate signature is needed. If these terms and the data processing agreement conflict on the protection of personal data, the data processing agreement prevails.

We process personal data that we need for our own purposes, in particular to conclude, perform and bill the contract with you, as a controller in accordance with the GDPR and our privacy policy.

You are responsible for meeting your own data protection obligations towards the visitors of your website, in particular for having a legal basis for the processing and for informing them about the use of Heylingo in your privacy policy.

10. Liability

We are liable without limitation for intent and gross negligence, for injury to life, body or health, for defects we have fraudulently concealed, where we have given a guarantee, and under the German Product Liability Act (Produkthaftungsgesetz).

For slight negligence, we are liable only for breach of an essential contractual obligation. This is an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment you may regularly rely. In that case, our liability is limited to the damage that is typical for this type of contract and foreseeable when the contract was concluded.

In the cases of the previous paragraph, our total liability per contract year is also limited to EUR 5,000 or, if higher, to the fees you paid us in the twelve months before the event that caused the damage.

Otherwise, liability for slight negligence is excluded. Strict liability for defects that already existed when the contract was concluded (§ 536a(1) BGB) is also excluded. For errors in translations, section 6 also applies.

Claims for damages against us become time-barred one year after the start of the statutory limitation period. This does not apply in the cases of the first paragraph of this section.

These limitations also apply in favour of our employees, vicarious agents and subcontractors. They also apply to claims under the data processing agreement and to claims between you and us under Art. 82(5) GDPR, as far as permitted by law. Mandatory liability towards third parties, in particular towards data subjects under Art. 82 GDPR, remains unaffected.

11. Changes to these terms

We may change these terms for a valid reason, in particular because of changes in the law or case law, or changes to Heylingo. We will notify you of changes by email at least 30 days before they take effect.

You can object to the changes within this period. If you do not object, the changed terms are deemed accepted. We will point this out specifically in our notice. If you object, the contract continues on the previous terms, and we may cancel it in accordance with section 8.

This procedure does not apply to changes to the main obligations of either party. Price changes are governed by section 4, changes to the service by section 2.

12. Final provisions

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

If you are a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or if you have no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from this contract is the competent court for Fellbach, Germany. We may also bring an action at your general place of jurisdiction.

If any provision of these terms is or becomes invalid, the remaining provisions remain valid. The invalid provision is replaced by the statutory provisions.

Last updated 16 October 2026

This data processing agreement (“DPA”, in German: Auftragsverarbeitungsvertrag, AVV) governs how we process personal data on behalf of our customers when they use Heylingo, in accordance with Art. 28 of the EU General Data Protection Regulation (GDPR). It forms part of our terms of service.

1. Parties, conclusion and scope

This DPA is concluded between you, the customer, as controller (“you”), and Jermaine J. Ernst, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany, as processor (“we”, “us”).

This DPA becomes part of your contract for Heylingo automatically when you accept the terms of service, normally by completing the Stripe Checkout. No separate signature is needed. The DPA is concluded in electronic form (Art. 28(9) GDPR). You can view, save and print it at heylingo.io/dpa at any time.

This DPA applies to all personal data that we process on your behalf when we provide Heylingo (“customer data”). The details of the processing are set out in Annex 1, our technical and organisational measures in Annex 2 and the approved sub-processors in Annex 3.

This DPA does not apply to personal data that we process as a controller for our own purposes, in particular to conclude, perform and bill the contract with you (for example your name, checkout email address, billing details and our correspondence with you), to operate heylingo.io and to meet our legal obligations. Our privacy policy covers this processing. Stripe processes payment data as an independent controller and is not our sub-processor.

2. Subject matter and duration

The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

The processing lasts for the term of the contract under the terms of service and ends once we have deleted the customer data in accordance with section 12.

3. Your instructions

We process customer data only on your documented instructions, including with regard to transfers to a third country, unless EU or member state law requires us to process it. In that case, we inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Your instructions are documented in the terms of service, this DPA and the way you use and configure Heylingo, for example the pages on which you integrate the script, the languages you choose and the corrections you make.

You may give further instructions in text form (for example by email). They must stay within the scope of the service described in the terms of service and must be technically feasible and reasonable for us. Section 11 applies to the costs. If we cannot reasonably carry out an instruction, we will tell you; you may then terminate the contract.

If we believe that an instruction infringes data protection law, we will inform you without undue delay. We may suspend carrying out the instruction until you confirm or change it. We are not obliged to carry out a comprehensive legal review of your instructions.

4. Your responsibilities as controller

You are responsible for the lawfulness of the processing of customer data and for safeguarding the rights of data subjects. In particular, you are responsible for:

having a legal basis for the processing, including the transfer of your website’s text to us and our sub-processors,
informing the visitors of your website and other data subjects about the processing, in particular in your privacy policy, including the use of Heylingo, our sub-processors and transfers to third countries,
assessing whether storing the chosen language in the visitor’s browser requires consent under the rules that apply to you, for example § 25 TDDDG,
the content of your website, including any personal data it contains,
responding to requests from data subjects.

You decide which pages and content Heylingo translates. You must not have the following data translated with Heylingo and must exclude it from translation:

special categories of personal data (Art. 9 GDPR) and personal data relating to criminal convictions and offences (Art. 10 GDPR),
passwords, access data, payment card or bank account details, official identification numbers and similar confidential data,
personal data that your website shows only to individual logged-in users, for example in customer accounts, order details or messages.

You can exclude content by not integrating the script on a page, or by marking the content with the attribute translate="no", the class notranslate or the attribute data-heylingo-skip.

You must inform us without undue delay if you notice errors or irregularities in the processing of customer data.

5. Confidentiality

We ensure that all persons authorised to process customer data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation continues after their work for us ends.

6. Security of processing

We implement the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR).

The measures are designed for the processing of website content as described in Annex 1. It is your responsibility to check, before you use Heylingo, whether these measures are appropriate for the customer data you have translated. If you need a higher level of protection for certain data, you must not have that data translated with Heylingo.

The measures are subject to technical progress and development. We may adapt them, provided the level of security is not reduced. Annex 2 always describes the current measures.

7. Sub-processors

You give us general authorisation to engage sub-processors (Art. 28(2) GDPR). The sub-processors listed in Annex 3 are approved.

We inform you by email at least 30 days in advance of any intended addition or replacement of a sub-processor. You may object to the change in text form within this period on reasonable grounds relating to data protection. If you do not object in time, the change is deemed approved. We will point this out specifically in our notice.

If you object, we will try to find a solution. If we cannot offer one that is reasonable for both parties, either party may terminate the contract with effect from the date the change takes effect.

If a sub-processor has to be replaced at short notice for reasons beyond our control, for example because it stops providing its service, or for urgent security reasons, we may engage a new sub-processor immediately. We will inform you without undue delay. Your right to object then applies accordingly, and the period starts when you receive our notice.

We engage sub-processors only under a contract that imposes on them data protection obligations that offer the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). Where a sub-processor offers only standard terms, we engage it only if these terms meet the requirements of Art. 28 GDPR.

We are responsible to you for our sub-processors’ compliance with their data protection obligations (Art. 28(4) GDPR). Section 14 applies to our liability.

Services that we use as ancillary services, for example telecommunications services, postal services or the maintenance of hardware or software where no access to customer data is intended, are not sub-processing within the meaning of this section.

8. Transfers to third countries

The translation service and the translation memories run on servers in Germany.

Some sub-processors process customer data in countries outside the European Union and the European Economic Area, as shown in Annex 3. You instruct us to make these transfers. We and our sub-processors make them only if the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified recipients (Art. 45 GDPR), or of the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

If the legal basis for a transfer ceases to apply, we will switch to another legal basis or another sub-processor within a reasonable period. If this is not possible, either party may terminate the contract.

9. Data subject rights

Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures, where possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR.

Heylingo does not create profiles of the visitors to your website. You can correct translations yourself in the edit mode on your website. At your request, we delete specific entries or the entire translation memory of your website.

If a data subject contacts us directly with a request that relates to your website, we forward it to you without undue delay. We do not respond to the request ourselves unless you instruct us to.

10. Further assistance and personal data breaches

Taking into account the nature of the processing and the information available to us, we assist you in meeting your obligations under Art. 32 to 36 GDPR (security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority).

We notify you without undue delay after becoming aware of a personal data breach affecting customer data. Our notification contains the information under Art. 33(3) GDPR that is available to us at that time. We provide further information as soon as it becomes available. We take reasonable measures to contain the breach and mitigate its possible consequences. A notification is not an acknowledgement of fault or liability.

We send notifications to the email address you gave at checkout or that you have given us later in text form. You must keep this address up to date.

11. Costs

We may charge reasonable compensation for our effort in assisting you under sections 9 and 10, for carrying out further instructions under section 3 and for inspections under section 13, as far as the effort goes beyond what is minor. We will tell you the expected costs in advance.

This does not apply to notifications of personal data breaches, or where the assistance is necessary because we have breached this DPA or data protection law.

12. Deletion and return

After the contract ends, we delete the customer data 30 days after the end of the contract, as set out in section 8 of the terms of service, unless EU or member state law requires us to keep it.

Until then, you can ask us in text form to return the customer data instead. We then provide your website’s translation memory, including your corrections, in a common machine-readable format of our choice and delete it afterwards. The original text of your website remains available to you on your website.

Customer data in backups and logs is deleted when these are overwritten or deleted in the regular cycle. Until then, it remains protected under this DPA and is not actively used.

At your request, we confirm the deletion in text form.

13. Information and inspections

We make available to you all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, and we allow for and contribute to audits, including inspections, by you or an auditor mandated by you.

We primarily demonstrate compliance through this DPA, the description of our measures in Annex 2, written information on request and, where available, certificates and audit reports of our sub-processors, for example ISO 27001 certificates or SOC 2 reports.

If this information is not sufficient in a specific case, you may carry out an inspection under the following conditions:

you notify us in text form at least 30 days in advance, stating the reason, scope and proposed date,
the inspection takes place during normal business hours, without disrupting our operations, and no more than once per calendar year, unless there are concrete indications of a breach of this DPA or a supervisory authority requires it,
the inspection is carried out by you or by an independent auditor who is bound to confidentiality and is not our competitor,
the inspection is limited to the processing of customer data and does not cover data of other customers or our trade secrets.

As our servers are operated by sub-processors in their data centres, inspections generally take place by reviewing documentation, configurations and processes, and may take place remotely. Inspections of sub-processors are governed by the audit rights in their contracts, which we exercise on your behalf where necessary.

You bear your own costs of an inspection. Section 11 applies to our costs, unless the inspection reveals a material breach of this DPA by us.

14. Liability and indemnity

Liability towards data subjects is governed by Art. 82 GDPR.

Between you and us, our liability under or in connection with this DPA is governed by section 10 of the terms of service (Liability). This also applies to claims between the parties under Art. 82(5) GDPR, as far as permitted by law. This DPA does not create any separate or additional liability.

You indemnify us against claims by third parties, in particular by data subjects, and against the reasonable costs of our legal defence, including in proceedings before supervisory authorities, as far as these are based on your breach of this DPA or of your obligations as controller under data protection law. Examples include processing without a legal basis, insufficient information to data subjects, unlawful instructions and content that you must exclude from translation under section 4. This does not apply if you are not responsible for the breach.

15. Term

This DPA applies for as long as the contract under the terms of service is in force and, after that, until we have deleted or returned all customer data. It cannot be terminated separately. Sections 5, 12 and 14 continue to apply after the end of the DPA as far as necessary.

16. Changes to this DPA

We may change this DPA in accordance with section 11 of the terms of service. Changes to Annex 2 are governed by section 6 and changes to Annex 3 by section 7 of this DPA.

We may also change this DPA without that procedure where the change is necessary to comply with mandatory law, a decision of a court or supervisory authority, or new standard contractual clauses, and does not reduce the protection of customer data. We inform you of such changes by email.

17. Final provisions

If this DPA and the terms of service conflict on the protection of personal data, this DPA prevails. In all other respects, the terms of service apply, in particular their provisions on liability, governing law and place of jurisdiction.

Notices and instructions under this DPA must be given in text form, for example by email. Our address for this is info@heylingo.io.

If any provision of this DPA is or becomes invalid, the remaining provisions remain valid. The invalid provision is replaced by the statutory provisions.

Annex 1: Details of the processing

Subject matter and nature

Heylingo translates the content of your website(s) as described in section 2 of the terms of service. The processing comprises receiving page text and technical request data from the browsers of your website’s visitors, translating new text with AI, storing translations in a translation memory for your website, delivering translations to visitors, storing your corrections, limiting excessive use, transferring data to sub-processors and deleting data.

Purpose

Providing Heylingo to you under the terms of service, including the security and stability of the service and the prevention of misuse. Your usage is measured as the number of translated characters, which contains no personal data.

Types of personal data

Website content: personal data contained in the text of your website that is translated, for example names, job titles, contact details, quotes or reviews of people mentioned on your website.
Request data of visitors: IP address, date and time, the address of the page and technical information sent by the browser, such as the user agent and the preferred language. In our databases, IP addresses are stored only as a one-way hash and only for the current day, to limit excessive use.
Language choice: the language chosen by the visitor, which the Heylingo script stores in the visitor’s browser.
Your authorised users: email address, login and session data (such as time of login and browser) and the corrections made in edit mode, with time stamps.

No special categories of personal data are processed. You must not have them translated (section 4).

Categories of data subjects

visitors to your website(s),
persons mentioned in the content of your website(s), for example your employees, customers, business partners or authors,
your authorised users, such as the site owner and editors.

Duration

The term of the contract plus the deletion period (section 12).

Places of processing

Germany (translation service and translation memories), Cloudflare’s global network (delivery of the script, API, database and email) and the USA (AI translation). Details are listed in Annex 3.

Annex 2: Technical and organisational measures

Confidentiality

Physical access control: all systems run in the data centres of our sub-processors (Annex 3), which have their own physical access controls. We do not operate any servers on our own premises.
System access control: the server of the translation service accepts no incoming connections other than SSH. SSH access requires a personal key; password logins and logins as root are disabled. Login attempts are rate-limited, and repeated failed attempts are blocked. Web traffic reaches the server only through an encrypted Cloudflare Tunnel that the server opens outbound and that is protected by Cloudflare Access.
Data access control: the translation service only accepts requests from our edge service, authenticated with a secret token. The deployment account accepts only the key of the automated deployment and has restricted rights. Edit mode is available only to authorised users of the respective website. Login codes and session tokens are stored only as hashes. Secrets are kept outside the source code.
Separation: customer data is stored per website and processed only for that website. Development and testing take place in separate environments.
Pseudonymisation and data minimisation: the script sends only the text to be translated and the technical data needed for the request. It sets no cookies and creates no visitor profiles. IP addresses are stored only as a hash and only for the current day. Translations are stored in the translation memory, so text that has already been translated is not sent to the AI provider again. Under its commercial terms, the AI provider does not use the transmitted data to train its models.

Integrity

Transfer control: all transfers over public networks are encrypted (HTTPS/TLS): between visitors’ browsers and Cloudflare, between Cloudflare and the translation service (Cloudflare Tunnel) and to the AI provider.
Input control: corrections made in edit mode are logged with the user, the time and the previous and new value. Changes to our systems are deployed through a versioned, automated deployment process.

Availability and resilience

Protection against overload and attacks through Cloudflare’s network, including DDoS protection.
Automatic installation of security updates for the server’s operating system.
Limits on excessive use per website and per network.
If the translation service is unavailable, your website shows its original language and remains available.

Regular review

We review the measures regularly and whenever the service changes significantly, and adapt them to technical progress.
We select sub-processors with regard to their data protection and security measures.
Persons with access to customer data are committed to confidentiality.
Personal data breaches are assessed, documented and reported in accordance with section 10.

Annex 3: Sub-processors

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Service: delivery of the Heylingo script, edge service and API, database for website settings and edit mode, sending emails with login codes, protection against attacks, encrypted tunnel to the translation service
Location: global network, including the USA
Transfer safeguard: EU-U.S. Data Privacy Framework (Art. 45 GDPR); otherwise standard contractual clauses (Art. 46(2)(c) GDPR)

netcup GmbH

Karlsruhe, Germany

Service: server for the translation service and the translation memories
Location: Germany
Transfer safeguard: not required (processing in the EU)

Anthropic PBC

San Francisco, USA

Service: AI translation of text that is not yet in the translation memory
Location: USA
Transfer safeguard: standard contractual clauses (Art. 46(2)(c) GDPR)