Privacy Policy

This Privacy Policy explains how Jokai ("we", "us") collects, uses, and protects your personal data when you use our Service. It is written to comply with the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller responsible for your personal data is the publisher of Jokai (jokaitranslate.com), an individual publisher. In application of the LCEN (art. 6, III, 2°), their identity details are lodged with the hosting provider and disclosed on request via the contact page.

• Contact: contact page

2. Data we collect

Account data

• Name, email address, and password (hashed).
• Account preferences (interface language, theme, translation settings).

Billing data

• We do not store full card numbers. Payment is processed by our payment provider (Paddle), which collects transaction data. We store your subscription plan, status, and a transaction history (amounts, dates), but not your card details.

Content you upload

• Images, documents, and translation data you process through the Service.

API keys (BYOK)

• If you provide your own translation API keys, they are encrypted at rest (AES-256-GCM) and never exposed to the browser or logs. They are used only to make translation calls on your behalf.

Technical & usage data

• IP address, browser type, device information, and usage logs (for security and reliability).

3. Purposes & legal bases

• Providing the Service (contract, Art. 6(1)(b)) — account, processing your Content, billing.
• Security & fraud prevention (legitimate interest, Art. 6(1)(f)) — logs, rate limiting, abuse detection.
• Communication (consent or legitimate interest) — transactional emails, service notices.
• Legal compliance (legal obligation, Art. 6(1)(c)) — retaining invoices and records as required by law.

4. Retention

• Account data: kept while your account is active; deleted within 30 days of account closure.
• Content: kept until you delete it or close your account.
• Billing records: retained as required by tax/accounting law (typically 10 years).
• Logs: rotated and deleted after a few months.

5. Recipients & processors

Your data is processed by Jokai and the following sub-processors:

• Paddle — payment processing.
• Resend — transactional email delivery.
• Cloud infrastructure / hosting — netcup GmbH (Germany).
• Translation & OCR engines — depending on your configuration: Google Cloud Vision, DeepL, OpenRouter, or your own custom OpenAI-compatible provider (such as OpenAI, Gemini, xAI, DeepSeek, or a self-hosted endpoint). Content you translate is sent to the relevant engine. If you use BYOK, your Content is sent to the provider you chose, under your own agreement with them.

We never sell your personal data.

6. International transfers

Some of the processors listed above are located outside the European Economic Area (for example in the United States). When we transfer personal data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses, or on your explicit consent where applicable. You may request a copy of these safeguards via our contact page.

7. Security

We implement industry-standard measures to protect your data, including encryption in transit (TLS) and at rest, hashed passwords, and encrypted API keys. No method of transmission or storage is completely secure, but we work to protect your data using reasonable technical and organizational measures.

8. Your rights (GDPR & CCPA)

Under the GDPR, you have the following rights regarding your personal data:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, for processing based on consent.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete it, and the right not to be discriminated against for exercising these rights. We do not sell personal information.

To exercise these rights, contact us through our contact page. You may also lodge a complaint with your local data protection authority.

9. Cookies

We use essential cookies for authentication and session management, and a local preference cookie for your theme. Non-essential cookies (such as analytics) are only set after your consent. For details, see our Cookie Policy.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected a child's data, please contact us and we will delete it.

11. Changes

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app before they take effect.

12. Contact

For any privacy-related questions or requests, reach us through our contact page.