Privacy Policy

Optume Translations ("we", "us") provides certified human and AI-assisted document translation. This policy explains what personal information we collect when you use optranslations.com or our translation API, why we collect it, who it is shared with, and what you can ask us to do about it.

It covers our website, the instant quote workspace, our contact forms, and our machine-accessible translation API. It does not cover third-party websites we link to.

For the purposes of Canadian privacy law we are the organization accountable for the personal information described here. You can reach our privacy contact at contact@optranslations.com.

When you request a quote, we collect your email address, the language pair, turnaround and certification options you select, the estimated price, the total word count, any notes you type into the request, and for each uploaded file its original filename, size and word count.

When you upload a document, we receive the document itself and store it. We also derive and keep the detected dominant language, the word count and a complexity score.

When you use our contact form, we collect your first name, last name, email address, subject and message.

When you call our paid API, we record the paying wallet address, the amount, the endpoint called, your IP address, your browser or client user agent, the referring URL, and the country inferred from the request. This applies to programmatic API callers, not to visitors requesting a quote through the website.

For staff and administrator accounts we store the account email, name, role, permissions and the IP address of the most recent sign-in.

We do not ask for or intentionally collect payment card numbers, government identification numbers, or health information as separate data fields. Your documents may of course contain such information, which is why they are treated as confidential throughout.

Uploaded documents are stored in Google Cloud Storage in a private bucket. They are not public and are not indexed by search engines. Each object is given a random identifier, though the original filename is preserved as part of the stored object name.

When you submit a quote request, our translation desk receives an email containing your email address, your notes, the pricing details, and a time-limited download link for each document. Those links are valid for seven days from the moment the email is sent. The email is delivered through Google Workspace and remains in our team's mailbox according to our internal mail retention.

Where you use our AI-assisted legal translation pipeline, the text of your document is divided into clauses and those clauses are stored alongside their draft and final translations so that a human translator can review, correct and audit the work. This is what allows a certified translator to stand behind the result.

We use Google's Gemini models as a subprocessor for AI-assisted translation, terminology analysis and quality evaluation. Where you use that pipeline, the text of your document is transmitted to Google's Generative Language API for processing. This is a genuine disclosure and not a formality: your document text leaves our systems and is processed by Google under their terms for that API.

Language detection, word counting and complexity scoring run entirely on our own infrastructure and do not involve a third-party model.

We maintain a translation memory: recurring source phrases and their approved translations are retained and reused to improve consistency and reduce cost on later work. That memory is not partitioned per customer, so an approved phrase from one project can inform another. If you do not want your content contributing to it, tell us before submitting work and we will handle your project outside the shared memory.

No decision that affects you legally or significantly is made by automated means alone. A certified human translator reviews and is accountable for certified output, and the price shown by the quote workspace is an estimate rather than a binding contract.

To prepare quotes and to deliver the translation you asked for. This is the core purpose and it is why we need your documents and your email address.

To communicate with you about your request, including confirmations and questions from the translator.

To keep the service working and defensible: rate limiting to prevent abuse, an audit trail of administrative actions, and quality records showing who translated and approved what.

To meet our accounting, tax and professional obligations, including records required of certified translators.

To understand aggregate website usage. We do not use your document contents for advertising, and we do not sell personal information.

We are being direct about this because the honest answer matters more than a reassuring one: we do not currently operate an automatic deletion schedule. Uploaded documents, quote records, contact submissions and translation records are retained indefinitely unless you ask us to delete them, or until we complete the retention programme described below.

We are implementing a defined retention schedule with automatic deletion of uploaded source documents after a fixed period following delivery, and shorter retention for quote requests that never become orders. Until that is in place, deletion is performed manually on request.

Some records are kept regardless of a deletion request where the law requires it, in particular accounting and tax records, and the certification records a professional translator must be able to produce. Where we must keep such a record we will keep the minimum and tell you what it is.

Short-lived technical data expires on its own: rate-limiting counters expire within minutes, and cached processing state expires within 24 hours.

We do not sell your personal information and we do not share your documents with anyone outside the parties below.

Google Cloud Platform, for hosting, database, storage and email. This includes Cloud Storage for your documents, Cloud SQL for our database, and Google Workspace for correspondence.

Google's Gemini API, as described in section 4, where AI-assisted translation is used.

Coinbase Developer Platform, which verifies and settles payments for our paid API. It receives payment authorization data such as the wallet address, amount and signature. It does not receive your documents or your email address.

Certified translators and reviewers assigned to your project. They are bound by written non-disclosure obligations and are given access only to the work they are performing.

Google Analytics, for website measurement on our public pages, as described in section 8.

A competent authority where we are legally compelled to disclose, and a successor entity in the event of a merger or acquisition, in which case this policy continues to apply until replaced.

We use one cookie of our own: a signed, httpOnly session cookie named admin_session, set only when a staff member signs in to the administration console. It lasts one hour. Ordinary visitors are never issued this cookie.

We use Google Analytics 4 to understand aggregate traffic. It sets its own cookies and can associate activity with an identifier Google controls. We do not serve advertising on this site and we run no advertising network tags. We use a consent management platform, CookieYes, to present cookie choices and to block non-essential tags.

Being straightforward about a limitation: our consent banner's blocking behaviour is configured in the consent platform rather than enforced by our own application code, so we cannot promise from our own systems that no analytics tag ever loads before you choose. If that matters to you, use your browser's tracking protection, and you can also contact us and we will confirm the current configuration.

Analytics is never applied to the contents of your documents. The quote workspace and the document pipeline carry no analytics instrumentation of your file contents.

Our application database and our translation backend run in Google Cloud's Montreal region, in Canada. Uploaded documents are stored in Google Cloud Storage.

Our website front end is served from Google infrastructure in the United States, and our email, analytics and AI subprocessors are operated by Google, which processes data in multiple countries including the United States.

This means your information can be processed outside Quebec and outside Canada, and while it is outside Canada it may be accessible to foreign authorities under the laws of those countries. We rely on the contractual and technical protections our providers offer. If you would like the specifics of a given transfer, ask us.

If you are in the European Economic Area or the United Kingdom and we process your information, we do so on the basis of performing our contract with you, our legitimate interests in operating and securing the service, and your consent where consent is required.

Documents are encrypted in transit over TLS and encrypted at rest by our cloud provider. Our storage bucket is private, and download links issued to our team are cryptographically signed and expire.

Access to the administration console requires a verified account with an explicit administrative role. Privileged actions are recorded in an audit log that survives deletion of the account that performed them. Administrative sessions expire after one hour.

Our translators and staff are bound by non-disclosure agreements, and access is limited to the people working on your project.

No system is perfectly secure. If a breach occurs that presents a real risk of serious harm, we will notify affected individuals and the relevant regulator as required by law, and we will tell you what happened rather than minimise it.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for a particular purpose, and ask for it in a portable format. Depending on where you live you may also have the right to withdraw consent, to object to certain processing, and to complain to a regulator.

Send requests to contact@optranslations.com with enough detail for us to find your records, for example the email address you used and the approximate date. We may need to confirm your identity before acting, so that we do not disclose your documents to somebody else.

We will acknowledge your request within five business days and respond substantively within 30 days. If we need longer we will tell you why before the 30 days are up. These requests are currently handled manually by our team rather than through an automated self-service tool, which is why we commit to a timeframe rather than instant action.

There is no charge for a reasonable request. If a request is excessive or repetitive we may explain why we are declining rather than quietly ignoring it.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information du Québec if you are in Quebec.

Our service is intended for adults and for organizations. We do not knowingly collect personal information from children. Documents submitted for translation may contain information about a child, for example a birth certificate; we treat that information as confidential like any other document content.

If you believe a child has provided us information directly, contact us and we will delete it.

We will update this policy as the service changes, and we will change the effective date at the top when we do. Where a change materially reduces your rights or materially expands how we use your information, we will make that clear rather than relying on a silent edit.

This document is maintained in English. Translations are available on request; where a translation and the English version disagree, the English version governs.

Privacy questions, requests and complaints: contact@optranslations.com.

We aim to acknowledge enquiries within two business days. During publicly announced periods of reduced availability, shown as a notice at the top of our website, acknowledgement may take up to five business days. Statutory deadlines for privacy requests are unaffected by those periods and we continue to meet the 30-day response commitment in section 11.