Privacy Policy

Vaste is operated by [Company legal name] (registry code [Estonian registry code]), [Street, postal code, city], Estonia. Effective 2026-11-13.

Draft. This text has not yet been reviewed by a lawyer and the company details are placeholders; it is published for transparency while the service is in its pre-launch phase.

1. Who is responsible

[Company legal name] ([Street, postal code, city], Estonia) is the controller for the personal data described here when you use Vaste. Where you upload documents that contain personal data about other people, your organization is the controller of that data and we process it on your behalf under our terms.

2. What we collect

Account data: your e-mail address, the name you give, the organizations you belong to and your role in them, sign-in and invitation records, and the time your free trial started.
Content: the documents you upload, the segments extracted from them, machine drafts, your edits and confirmations, translation memory, glossaries, do-not-translate lists and project settings such as subject area and style rules.
Billing data: your plan, subscription status, billing period, words used, the Stripe customer and subscription identifiers and the amount of your last invoice. Card details are entered on Stripe’s pages and never reach us.
Technical data: server logs with IP address, request path, timing and status; model usage records (token counts and cost per request); error reports when error tracking is enabled.

3. Why we process it and on what basis

To provide the service you asked for, including producing translations and remembering your corrections: performance of a contract (GDPR art. 6(1)(b)).
To bill you and keep accounting records: contract and legal obligation (art. 6(1)(b) and (c)).
To keep the service secure, prevent abuse (rate limits, trial limits, blocked disposable e-mail domains) and fix errors: our legitimate interest in running a reliable service (art. 6(1)(f)).
To send you service messages such as sign-in links, invitations, billing notices and changes to these terms: contract. We do not send marketing e-mail without your consent.

4. Who else processes your data

We use the following processors. Each is bound by a contract that limits processing to our instructions.

Processor	Purpose	Location	Safeguard
Anthropic, PBC	Machine translation, review and terminology extraction through the Claude API (text of segments, glossary terms and style rules)	United States	EU Standard Contractual Clauses under Anthropic's Commercial Terms; API inputs and outputs are not used to train models under those terms
Stripe, Inc. / Stripe Payments Europe Ltd.	Subscription payments, invoices, VAT handling; card data is entered on Stripe's pages and never reaches Vaste	Ireland / United States	Stripe's Data Processing Agreement with Standard Contractual Clauses
Zone Media OÜ	Hosting of the application, database and backups; transactional e-mail (sign-in links, invitations)	Estonia	Processing inside the EU
Functional Software, Inc. (Sentry)	Error reporting, only when enabled on the production host (error messages and request metadata, no document text)	European Union (EU data residency)	Processing inside the EU

The application, its database and backups are hosted in the European Union (data centres in Estonia). Text sent to the machine-translation provider is processed in the United States under the safeguards listed above; no other data leaves the EU. We do not sell personal data and we do not use your content to train machine-learning models.

5. How long we keep it

Documents (the uploaded file, its translation and segments): 12 months after their last change, then deleted automatically. Documents and projects you delete yourself are removed immediately from the live database.
Translation memory, glossary terms, corrections and term proposals: for as long as your organization exists.
Account data: for as long as your organization exists. Deleted data disappears from backups within 30 days.
Billing records: for the period required by Estonian accounting law (currently seven years).
Server logs and model usage records: up to 90 days, except aggregated figures without personal data.
After an organization is deleted on request, its data is removed within 30 days, subject to the retention above.

6. Security

Every record is bound to an organization and every database query is scoped to it; an automated isolation test runs on every build. Connections are encrypted in transit, backups are taken nightly and tested, sign-in uses one-time e-mail links or a password you set yourself (stored only as a salted hash, never readable by us), and access to production systems is limited to the people who operate the service. Model requests carry only the text needed for the task.

7. Your rights

You can ask us for access to, correction or deletion of your personal data, for a copy in a portable format, to restrict or object to processing, and you can withdraw consent where processing is based on it. Write to [contact e-mail]. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority of your country.

8. Cookies

Vaste sets only the cookies needed to keep you signed in and to protect forms against misuse. There are no analytics or advertising cookies and no third-party trackers on the application pages.

9. Changes

We update this policy when our processing changes. Material changes are announced by e-mail or in the service before they take effect; the effective date above tells you when the current version started to apply.

Contact

Questions about this document: [contact e-mail]. Postal address: [Company legal name], [Street, postal code, city], Estonia.