Privacy Policy

This policy applies to the StringsOS website at stringsos.com (the "Website") and to the StringsOS application at app.stringsos.com, including our Figma plugin, GitHub integration and MCP server (together, the "Service"). "StringsOS", "we" and "us" mean the operator of the Service.

We act in two different roles. For information about you and your use of StringsOS (account, billing, website visits, enquiries), we are the controller and this policy applies directly. For the translation content your team stores in a workspace, we act as a processor on your behalf, and our Data Processing Agreement applies.

Information you give us

• Account details: your name, work email address and sign-in credentials, and your role within a workspace.
• Workspace content: source text, translations, keys, comments, glossary and review activity that you or your team add, import, or sync from Figma and GitHub.
• Billing details: your plan, billing contact and invoices. Card details are entered on Stripe and never reach our servers.
• Invitations: the email addresses of people you invite to a workspace.
• Enquiries: your name, email, company, topic and message when you use our contact form or email us.

Information collected automatically

• Product usage and service data: features used, actions taken, request logs, error reports, browser and device type, and IP address, used to run and secure the Service.
• Website analytics: page views, referrers, approximate location, device information and, through Clarity, interaction data such as clicks, scrolling and session replays. This only happens if you accept analytics cookies (see Cookies and analytics).

Information from connected services

When you connect GitHub or Figma, we receive only what is needed for the integration you set up, such as repository and file names, the files you choose to sync, design text you send to StringsOS, and your account identifier at that service. You choose what to connect and can disconnect at any time.

We do not knowingly collect personal information from children under 16, and the Service is not directed at them.

We use personal information to:

• provide, maintain and support the Service, including drafting, reviewing and syncing translations;
• create and manage accounts, workspaces, permissions and invitations;
• process payments, issue invoices and manage subscriptions;
• generate AI suggestions when you request them (see AI features below);
• keep the Service secure, prevent abuse and fraud, and keep an audit history of changes;
• respond to enquiries and send service messages such as invitations, security notices and billing emails;
• understand how the Website and product are used so we can improve them, where you have consented;
• comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not use it for third-party advertising.

Where data protection law requires a legal basis, we rely on:

• Contract: to provide the Service you signed up for, including accounts, workspaces and billing.
• Legitimate interests: to secure and improve the Service, prevent abuse and communicate about it, balanced against your rights.
• Consent: for analytics cookies and session replays. You can withdraw consent at any time.
• Legal obligation: to meet tax, accounting and other legal requirements.

StringsOS drafts translations with AI only when you or a member of your workspace requests them. To generate a suggestion, the relevant source text and any instructions or context you provide (such as glossary terms or notes) are sent to the AI model provider configured for your workspace, which returns a draft.

• AI never applies a change on its own. Suggestions become drafts that your team reviews and approves.
• We record each suggestion and whether it was accepted, rejected or edited, so your history stays auditable.
• We do not use your workspace content to train our own or third-party AI models.
• Avoid putting sensitive personal data into text you send for translation.

The Website and application use essential storage that is needed to work, such as keeping you signed in and remembering your cookie choice. This does not require consent.

With your consent, we use Google Analytics for aggregated usage reporting and Microsoft Clarity for behavioural insight, including heatmaps and session replays. These services set cookies and similar identifiers, and Clarity may share data with Microsoft. Advertising storage, ad user data and ad personalisation are set to denied, so analytics data is not used for advertising.

Neither service loads until you choose "Accept analytics". You can change your mind at any time using Cookie settings in the footer; rejecting stops these tools from loading on your next page view. To learn how these providers handle data, read the Microsoft Privacy Statement and the Google Privacy Policy.

We share personal information only as described below. We require service providers to protect it and to use it only to provide their service to us.

• Cloud hosting and infrastructure providers, to run the Service and store data.
• Stripe, to process payments and manage subscriptions and invoices.
• AI model providers, to generate suggestions you request.
• Email delivery providers, to send contact-form enquiries and service emails (we use Resend).
• Analytics providers, Google and Microsoft, only if you accept analytics cookies.
• GitHub and Figma, when you connect them, to send and receive the content you choose to sync.
• Other members of your workspace, who can see workspace content and member details according to their role.
• Professional advisers, and authorities where required by law or to protect rights, safety and security.
• A successor, in connection with a merger, acquisition or sale of assets, with notice to you where required.

A current list of sub-processors that handle customer content is available on request and is provided with our Data Processing Agreement.

We and our service providers may process information in countries other than your own. Where personal information is transferred out of the EEA, UK or other regions that restrict transfers, we use appropriate safeguards such as Standard Contractual Clauses or an equivalent mechanism.

We keep personal information only as long as needed for the purposes in this policy:

• Account and workspace content is kept while your account is active. You can export your data as JSON at any time.
• When you ask us to delete your account or workspace, we delete or de-identify the related data, except where we must retain it for legal, tax, security or dispute purposes. Backups are overwritten on their normal cycle.
• Billing records are kept for as long as tax and accounting law requires.
• Contact enquiries are kept for as long as needed to respond and follow up.
• Analytics data is retained according to the settings of Google Analytics and Microsoft Clarity.

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit and at rest, role-based access controls, activity logging for supported workflows, and restricting internal access on a need-to-know basis. Integrations use authorised sign-in flows, so you never need to copy keys or tokens into the Figma plugin.

No system is completely secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law. To report a vulnerability, email support@stringsos.com.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your information, or restrict or object to certain processing;
• receive your data in a portable format (workspace content can be exported as JSON);
• withdraw consent at any time, without affecting earlier processing;
• opt out of the sale or sharing of personal information (we do neither);
• not be discriminated against for exercising your rights;
• complain to your local data protection authority.

To exercise a right, email us using the details below. We may ask you to verify your identity and will respond within the time required by law. If you are a member of a workspace, requests about workspace content may be referred to your organisation, which controls that content.

We may update this policy as the Service or the law changes. We will change the effective date above and, for material changes, notify you by email or in the product before they take effect.

For privacy questions, data requests or complaints, email hello@stringsos.com or support@stringsos.com, or use our contact page.