Privacy Policy

Effective date: 8 October 2026

1. Data Controller

The Service is operated by WHIZY, SASU with share capital €1,000, SIREN 938 696 143, VAT FR58938696143, registered office: 12 rue de la Part-Dieu, 69003 Lyon, France. WHIZY acts as data controller for the processing described in this Policy.

Contact: support@itranslator.app — Discord: discord.itranslator.app.

2. What We Process

We do not create local user accounts. We rely on Discord OAuth. We process:

  • Discord account data received when you log in to the dashboard: user ID, username, avatar, email address and the list of servers you belong to.
  • Discord identifiers used by the bot: user, server (guild), channel, category, role and message IDs.
  • Server configuration set by administrators (languages, channels, roles, text-replacement rules, custom bot profile, members excluded from translation).
  • Language settings, including the language of your Discord client, recorded when you use the bot.
  • Usage statistics per server, channel and user (number of messages and characters translated, voice usage), used for quotas and for the statistics shown in the dashboard.
  • Votes for the bot on bot lists such as Top.gg: vote date, vote streak and your reminder preference.
  • Ephemeral translation / transcription / generation content: processed in memory only (not stored), except a temporary in-memory cache (no link to a user) so identical texts aren't translated twice.
  • Billing data: payments are handled directly by Stripe, which collects your name, billing address, optional VAT number and payment details. We pass Stripe your Discord user ID, email address and the ID of the server the subscription applies to, plus, where applicable, an affiliate code and the Google Ads click identifier (only if you accepted advertising cookies). We receive status and metadata (plan, amounts, taxes, billing country), never full card details.
  • Contact form: first and last name, email address, optional server invite, member count and estimated volume, and your message.
  • Support tickets (deleted after resolution).
  • Optional feedback: your answer to the survey shown after subscribing, and the reason or comment you give when cancelling a subscription.
  • Acquisition data: the affiliate link, campaign or website button that led to the bot being added to a server or to a subscription, linked to the server ID and, for payments, to the subscription.
  • Public server showcase: the name, icon and approximate member count of some of the largest servers using the bot (as provided by Discord) may be displayed on our website's homepage. No user data is involved, and server administrators can opt out at any time from the dashboard (Configuration page).

Members of servers using the bot: once administrators add the bot to a server, it processes the messages of that server's members according to the server's configuration, even if they never use the bot themselves. Their messages are translated as described above, and translations can be reposted under the author's display name and avatar. When voice transcription is started in a voice channel, the audio of every participant is transcribed, together with their display names, by our transcription provider (see Section 5).

We do not store IP addresses or device/User-Agent ourselves. To prevent spam, the contact form only keeps your IP address in memory, for up to one hour.

3. Purposes & Legal Bases

We process personal data for the following purposes:

  • Provide the Service (Discord bot features). Legal basis: performance of the contract for the users and administrators who use the bot; legitimate interest (ours and the server's) for the other members of servers where it is installed.
  • Payment / invoicing. Legal basis: contract and legal obligation (accounting).
  • Technical operation, security, abuse prevention (logs, rate‑limit). Legal basis: legitimate interest.
  • Service improvement (optimisation, translation cache, statistics, optional feedback). Legal basis: legitimate interest.
  • Contact requests (questions, Enterprise quotes). Legal basis: steps taken at your request before entering into a contract, and legitimate interest.
  • User requests (support / deletion). Legal basis: legitimate interest / legal obligation.
  • Affiliate commissions and acquisition statistics (knowing which affiliate, campaign or website button brought a server or a subscription). Legal basis: legitimate interest (see Section 4 for the related cookie).
  • Promotion of the Service (public showcase of the largest servers using the bot on our homepage). Legal basis: legitimate interest; server administrators can opt out from the dashboard.
  • Audience measurement (Google Analytics 4 with anonymised IP, Google Consent Mode V2). Legal basis: your consent.
  • Advertising measurement (Google Ads conversion tracking, when enabled, including a subscription that follows a click on one of our ads). Legal basis: your consent.

We do not run marketing emails. Audience and advertising measurement are only activated after you accept them via our consent banner, and you can withdraw your consent at any time (see Section 4).

4. Cookies & Similar Technologies

Our website (https://itranslator.app) uses three categories of cookies and similar storage.

Strictly necessary (no consent required):

  • Session cookie (JSESSIONID, Discord OAuth): up to 365 days.
  • CSRF protection token: session lifetime.
  • Language preference (lang): the interface language you pick from the language selector, so pages you open later stay in that language — 12 months.
  • Consent preference (privacy_prefs cookie — 12 months — and privacy_prefs_v2 in localStorage): stores your choice so we do not prompt you again, and tells our server whether it may set the Google Ads click identifiers below.

Affiliate and campaign attribution (no consent required):

  • utm_source — 90 days: the affiliate, partner or campaign code of the link that brought you (e.g. ?ref= or /invite/<code>), so we can pay our affiliates and know which campaigns work. It holds only that code, no identifier of you or your device, and is never used for advertising or shared with advertising partners.

Subject to your consent (off by default):

  • Google Analytics 4 (measurement ID G-6SC5LWPBD3): audience measurement and aggregated traffic statistics. Cookies _ga, _ga_* — up to 13 months.
  • Google Ads (conversion tracking, when enabled): measure conversions from advertising campaigns. Cookies _gcl_* — up to 90 days.
  • Google Ads click identifiers: cookies gclid, wbraid, gbraid — 90 days. If you subscribe after clicking one of our ads, the click identifier is sent to Google Ads to count the conversion.

None of these cookies is set until you click Accept all on our banner. We use Google Consent Mode V2: no measurement signal is sent before you accept; if you click Reject all, Google receives anonymous, cookieless pings used only for aggregated modelling — no identifier is stored on your device.

Withdrawing or changing your choice: you can re-open the consent banner at any time using the Manage cookies link in the footer of every page. Your new choice takes effect immediately, and rejecting deletes the Google Ads click identifiers already set.

5. Processors / Recipients

We use providers to operate the Service:

  • Hosting / infrastructure: OVH (France/EU), Hetzner (EU), Hostkey (France/EU).
  • Payment: Stripe.
  • Platform integration: Discord (also used to deliver contact-form requests and feedback to our private staff channels).
  • AI / LLM APIs: OpenAI. Some requests are handled by our own models, running on our own servers without any third-party AI provider.
  • Audience & advertising measurement (after consent): Google Ireland Ltd. (Google Analytics 4, Google Ads).
  • Internal analytics / backups: our EU infrastructure.

We do not sell your data.

6. International Transfers

Some providers are located outside the EEA (e.g. OpenAI, Stripe group, Discord, Google LLC for some measurement infrastructure). Transfers rely on EU Standard Contractual Clauses, the EU–US Data Privacy Framework where applicable, or equivalent safeguards, and we minimise the data sent (mainly identifiers and ephemeral content).

7. Retention

  • Discord IDs & preferences: kept while you use the Service (deleted on request).
  • Technical logs (no IP): 12 months.
  • Ephemeral content: processed in RAM only, then discarded; translation cache kept in memory for a limited time.
  • Payment / invoices: retained by Stripe and for legal accounting periods.
  • Support tickets: deleted after resolution.
  • AI provider processing: inputs sent to external AI providers may be retained briefly by those providers under their own policies (typically up to 30 days for abuse monitoring). We do not control these retention periods.

8. Security

We apply reasonable measures: restricted staff access, TLS encryption in transit, provider‑level encryption at rest, monitoring and backups. No method of transmission or storage is 100% secure.

9. Your Rights

You may request access, rectification, deletion, restriction, portability, or object to processing by emailing support@itranslator.app or reaching us on our Discord server at discord.itranslator.app. We answer within one month and may verify your identity via your Discord account or email.

10. Children

The dashboard and paid plans are intended for users aged 15 or older (French digital consent threshold) who also meet Discord’s own minimum age requirement. Where local law sets a higher age, the stricter rule applies. Because the bot works on whole servers, it may process the messages of any member of a server where it is installed, including younger Discord users, as described in Section 2; we do not knowingly collect any other data about them.

11. Complaints

You can lodge a complaint with the French supervisory authority (CNIL) at www.cnil.fr.

12. Changes

We may update this Policy. The latest version is posted on our website. Continued use after changes means you accept the updated Policy.

Questions? Email support@itranslator.app or join our Discord at discord.itranslator.app.