Privacy policy

Who we are and our role

Tolayda is an academic document translation service for universities, researchers and students. It is operated by LaunchPad Labs Limited (company number 17137093), registered in England and Wales, with its registered office at 20 Bulford Close, Hucclecote, Gloucester, England, GL3 3AG ("we", "us", "our"). We are registered with the Information Commissioner's Office (registration number ZC198000).

If you use Tolayda through your university's licence, your university is the controller of the papers you upload and the translations you make, and we process that content as its processor under a data processing agreement. We are the controller of the account, security and service data we need to run Tolayda.

If you use a free student account, no university holds a licence for your use, so we are the controller of your account and everything you upload.

We have not appointed a data protection officer. For anything about this policy or your data, contact hello@tolayda.com.

Where your data is stored

Your files are stored in the EU, translation runs on our own servers in the UK, and your content is never sent to any other AI company.

Tolayda runs on Vercel and Supabase in the EU, which hold accounts, papers and translations. Translation itself happens on servers we operate ourselves in the UK, reached through Cloudflare's secure network. Documents are never sent to the developer of the translation model or to any other AI provider. A few service providers, such as Microsoft for university sign-in, may access limited data from outside the UK and EU, and those transfers are covered by UK adequacy regulations or approved contract terms.

The personal data we collect

Depending on how you use the service, we process:

• Account data: your name, email address, account type (licensed or student), language, and the identifiers Microsoft or our sign-in provider gives us when you sign in.
• Papers and translations: the DOCX, PDF and LaTeX files you upload, the structure we extract from them, the translations we produce, and your edits. Papers often contain personal data about other people, such as author names and acknowledgements.
• Collaboration data: share links you create, who opened them, and the name attached to each edit in a paper's edit history.
• Reports and feedback: translation issue reports, including any text excerpts you choose to attach.
• Student account data: your translation allowance and use, your referral code, who referred you and whom you referred.
• University introductions: the name, email address and role of the person you introduce us to, and any notes you add.
• Email data: your email preferences and delivery events such as bounces, spam complaints and unsubscribes. We do not track whether you open emails or click links in them.
• Usage and licence data: uploads, translations, exports and timestamps, used to apply licence and allowance limits and to report usage to licensed universities.
• Technical data: IP address, browser and device details, server logs and error reports.
• Preferences stored on your device: interface language, default source language and accessibility settings (see Cookies below).

Please do not upload special category data, such as identifiable health data, unless your university has authorised it and put safeguards in place.

Where the data comes from

Most of it comes from you. We also receive your name, email address and account identifiers from Microsoft when you sign in with a university account, and confirmation from your university's licence of which email domains may use the service. If you choose to import a file from OneDrive, Microsoft lets us read the file you pick.

If a student introduces us to you as a contact at their university, we receive your name, email address and role from that student. We will tell you this when we first contact you, and you can ask us to delete it at any time.

How we use it, and our lawful bases

Where we act as a processor for your university, we use your papers only on its instructions, to provide the service. Where we are the controller, we use personal data for the purposes below, each with its lawful basis under the UK GDPR:

• To create and run your account, sign you in, check your university's licence, and apply licence or allowance limits. Basis: contract with you, or our legitimate interest in providing the service your university has licensed.
• To translate, store, share and export your papers and keep an edit history. Basis: contract, or legitimate interests as above.
• To run referrals and follow up university introductions, including contacting the person you name. Basis: contract with you for referrals; our legitimate interest in offering the service to universities for introductions.
• To send emails about your account and the service, such as address confirmation, password resets, security notices, a welcome email, tips and check-ins. For licensed accounts, your university instructs us to send these. Basis: contract, or legitimate interests. You can turn off the optional ones on the Account page or with the link in every email.
• To send occasional product update emails about Tolayda (see Product update emails below). Basis: legitimate interests. You can turn them off at any time.
• To investigate translation issue reports and improve translation quality. Basis: legitimate interests.
• To train and improve our translation model, as described in "Improving our translation model" below. Basis: legitimate interests, with the right to opt out.
• To keep the service secure and reliable, prevent abuse and fix errors. Basis: legitimate interests.
• To report usage to licensed universities. Basis: legitimate interests, and the instructions of your university.
• To meet legal obligations and defend legal claims. Basis: legal obligation, or legitimate interests.

Product update emails

As well as emails about your account and the service, we may send occasional product update emails about new Tolayda guides, languages and features. They are only ever about Tolayda, and we never share your details with anyone else for marketing.

Product update emails are switched on when your account is created, unless you tick "Don't email me tips on using Tolayda" when you sign up with an email address, which also turns off tips and check-ins. You can turn them off at any time under Account, Preferences, Email, or with the unsubscribe link in the email. Turning them off does not affect your use of Tolayda.

Improving our translation model

Tolayda translates papers automatically with a machine translation model that runs on servers we control in the UK. To make translations better, we may use papers, translations and your edits to train and improve that model.

Free student accounts: we may use your content for this unless you opt out. Licensed accounts: we use your content only if your university's agreement with us allows it, and you can still opt out.

You can opt out at any time in Account, Preferences, under "Improving translations". From then on, your content is left out of new training. We cannot remove what a model has already learned, but we delete your content from our training datasets when you opt out, delete the paper, or delete your account.

We rely on our legitimate interest in improving the service. Before training we take steps to reduce the personal data in training data, such as removing names and contact details where we can. Training data stays on our own systems and is never sold, published, or given to other AI companies.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who we share it with

We do not sell personal data or use it for advertising. We share it only as follows:

• Your university, if you use its licence: usage information and, where its agreement provides, the content you upload under that licence.
• People you share a paper with: anyone who signs in with a share link you create can see the paper and, for edit links, its edit history and the names attached to it.
• Service providers who process data for us under written contracts, listed below.
• Professional advisers, and authorities where the law requires it or where needed to protect our rights or the safety of others.
• A buyer or successor if our business is sold or reorganised, who must keep using personal data in line with this policy.

Our service providers

For each provider, what it does and where it processes data:

• Vercel: application hosting and cookieless page analytics. Where: EU (our application runs in Vercel's Paris region); may involve US access.
• Supabase: sign-in, database and file storage. Where: EU.
• Cloudflare: secure connection to our UK translation servers; document content passes through it. Where: Cloudflare network; may involve US access.
• Microsoft (Entra ID): university sign-in, and importing files from OneDrive if you choose to. Where: may involve US access.
• Resend: email delivery and email preferences. Where: may involve US access.
• Sentry: error reporting and performance tracing. Where: EU; may involve US access.
• Slack: internal notifications to our team about translation reports, including any excerpts attached to them, and university introductions. Where: may involve US access.

International transfers

Your account data, papers and translations are stored in the EU, and translation and model training happen on our own servers in the UK. The UK recognises the EU as providing adequate protection. Where a provider may access data from outside the UK and EU, including the United States, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified recipients) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us for more detail.

How long we keep it

• If you delete your account: when you delete your account from the Account page, we permanently delete your papers, translations, files and account from our live systems straight away.
• Papers, translations, edits and share links: until you delete them or your account, or, under a university licence, for the period your university sets.
• Licensed accounts: your university sets how long content is kept, up to a maximum of six years from when it was created. An account not used for twelve months is archived after at least 30 days' warning, and restored if you sign in again. When a licence ends, your university has 90 days to export its data, after which we delete it.
• Backups: copies in encrypted backups are overwritten in our normal backup cycle, normally within 30 days.
• Copies in training datasets: until you opt out, or delete the paper or your account.
• Account data: for as long as your account exists.
• Referral records and translation reports: for as long as the accounts involved exist, or until a report is resolved and no longer needed.
• University introductions: until the introduction is closed and no longer needed, and in any case for no more than two years.
• Error reports and technical logs: up to 90 days, unless needed longer to investigate a security incident.
• Email suppression records (such as unsubscribes and bounces): for as long as needed to respect them.

We may keep limited records longer where the law requires it or to defend legal claims.

Cookies and similar technologies

We use only cookies and browser storage that the service needs to work or that remember choices you make. We do not use advertising or cross-site tracking cookies, so we do not ask for cookie consent. Our page analytics do not use cookies.

• Sign-in cookies set by Supabase (named sb-…-auth-token), to keep you signed in. They last up to 400 days, are renewed while you use the service, and are removed when you sign out.
• NEXT_LOCALE, to remember your interface language, for up to one year.
• tolayda_ref, to remember a referral code between the sign-up page and sign-in, for up to 7 days.
• TOLAYDA_SOURCE_LANG, to remember your default translation source language, for up to one year.
• tonic-a11y-prime, a short-lived cookie that carries accessibility settings from a support link to your browser. It lasts up to two minutes and is deleted once read.
• Browser storage (localStorage) for your accessibility settings and whether you have seen the product tour, tips and banners, kept on your device until you clear it. The paper editor also remembers which view you were using in session storage, which your browser clears when you close the tab.

How we protect it

We protect personal data with:

• encryption in transit and at rest
• role-based access for our staff, on a least-privilege basis
• university single sign-on, so we do not store university passwords
• regular backups, with restore testing at least once a year
• a documented information security policy and staff training
• independent penetration testing, the first within twelve months of our first university contract

We hold Cyber Essentials certification and are working towards ISO/IEC 27001 and ISO/IEC 42001. No system is completely secure. If you believe your account or data is at risk, contact hello@tolayda.com straight away.

If something goes wrong

If we have a personal data breach, we will tell your university within 72 hours of becoming aware of it where it affects data we hold for them. Where we are the controller, we will tell the Information Commissioner's Office within 72 hours unless the breach is unlikely to put anyone at risk, and we will tell you directly if it is likely to put you at high risk.

Your rights

Under UK data protection law you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. You can object to optional emails, including product update emails, and to your content being used to improve our translation model, at any time. Some rights depend on the lawful basis and have exceptions.

You can delete your account yourself from the Account page; this is permanent. For anything else, contact hello@tolayda.com. We will respond within one month and may ask you to confirm your identity. If you use Tolayda through your university, we may pass your request to your university as controller and help it respond.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Age

Tolayda is intended for university staff, researchers and students aged 16 or over. We do not knowingly collect personal data from anyone younger.

Changes to this policy

We will update this policy when how we handle personal data changes. If a change is significant, we will tell you by email or in the service before it takes effect. The date at the top shows when it last changed.