palu. Your language. Your business. Connected.
English

Privacy policy

Controller

upbyte® e.K., owner Riccardo Rabe, Schwastrum 60, 24351 Damp, Germany
Email: [email protected]

This website

The website uses no trackers, no cookies and no external scripts. Fonts are served from the same server. Your language choice is stored only in your browser. Hosting: Hetzner, data centre in Nuremberg. The server logs technical access data.

For operation and security we store sign-ins and failed attempts with time, sign-in method, IP address, device and app version for 90 days. We store errors from the server and the app with error number, place and message for 30 days. They contain no message content. Only upbyte as the operator sees these logs.

Data the app processes

  • Name, language, writing style and your consent
  • Optional: gender and profile picture. Only your friends see the picture.
  • An anonymous identifier from Sign in with Apple and a sign-in token, stored on the server only as a hash. We do not ask for your email address.
  • Messages, translations, photos, files, reactions and stickers
  • Settings per chat: relationship, style, age relation and your own rules
  • A push token of your device for notifications
  • For operation, troubleshooting and abuse prevention: the time you last used the app, the app version and your device's region setting. We delete this data with your account.

Translation by an AI service

So that palu can translate, your texts go to an AI service. Sent along are the gender of sender and recipient, style, relationship, age, your own rules if set, and recent messages as context. In the same step, the AI checks whether a text contains threats, severe insults or sexual harassment. The "I don't understand this" feature uses the same service.

For translating, explaining, summarising and checking messages we use OpenRouter, Inc. (USA) as a processor and its model provider Google in the EU. Only the message text and the details listed above are sent. Processing takes place on servers in the EU, the EEA, the United Kingdom or Switzerland; the content is not stored there after processing. Where data reaches OpenRouter in the USA, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); a copy is available on request. The legal basis is Art. 6(1)(b) GDPR (provision of the service).

Further AI features

Only when you use them, texts go to the AI service for: preview with misunderstanding check, reply suggestions, explaining a message, summary (messages of the last 24 hours), chat search (up to 200 messages) and translating text from photos. Text recognition in photos and date detection run on your iPhone. Every message is automatically checked for threats and severe insults, unless everyone uses the same language or it contains no letters.

Voice messages

When you use the microphone, Apple's speech recognition turns your speech into text. Your recording may go to Apple for this. palu neither transmits nor stores a recording, only the recognised text. Reading aloud runs on the iPhone.

Sofa mode

In sofa mode, two people talk on one iPhone. The texts go to the AI service for translation, palu does not store them.

Link preview

If a message contains a link, your iPhone loads a preview from the linked website. That website sees your IP address.

Image check

Before delivery, photos are automatically checked by the AI service for prohibited content.

Guests in the browser

Guests give a name, a language and optionally their gender, and consent to processing. A guest link is valid for 7 days, after which we delete the guest and the chat. Guest chats are protected by HTTPS only, Cloudflare can technically read them.

palu Web

If you connect a browser by QR code, we store a device label, the time of last use and a session token as a hash for this session. The session ends after 7 days without use, when you sign out, or with your account. Until then the token is kept in your browser storage.

Company features

For companies we store terms, service tickets and an activity log with action, time and acting person. Terms that appear in a message are sent with it to the translation service. When translating text from photos, your iPhone recognises the text itself and only the text is sent to the service. We delete this data with the company. Company owners and admins can view tickets and the log.

Messages are encrypted in transit and on the server. palu does not offer end-to-end encryption because translation needs the plain text. The server and the AI provider can read content.

Recipients

  • Hetzner, data centre in Nuremberg: server operation
  • Cloudflare: routing of data traffic
  • OpenRouter and Google: translating and checking texts, processing in Europe, data processing agreement in place
  • Apple: delivery of notifications

Some recipients are outside the EU, for example in the USA. This can involve transfers to third countries based on the providers' safeguards, for example standard contractual clauses.

Retention

Messages and files are deleted after 30 days. Translation uses messages from the last 24 hours as context. If you delete your account in the app, the account and all messages are deleted.

Translation feedback

When you rate a translation, we see your choice, your language, the message and the translation. This helps us improve translations. Feedback is deleted together with the message.

Reports

If you report a message, the report goes by email to [email protected].

Legal bases and your rights

We process your data to provide palu (Art. 6(1)(b) GDPR), based on your consent (a) and to prevent abuse (f). You have the right to access, rectification, erasure, restriction, data portability and objection, and may withdraw consent at any time. You may complain to a supervisory authority; ours is the data protection commissioner of Schleswig-Holstein. palu is for people aged 16 and over. Users in Thailand also have rights under the PDPA. Questions to [email protected].