Unbabel Unbabel API Chat FAQs Tickets Video Facebook Instagram LinkedIn Twitter YouTube


Last updated December 2019


Trust is one of the pillars on which Unbabel Inc. (“Unbabel”) was founded on. Likewise, your trust in our service is invaluable and feeling that you can trust us with your data is paramount. We, either as Data Controller or Data Processor, are responsible for ensuring that not only the Personal Data from over 50.000 Unbabelers (our community of Editors, Evaluators and Annotators) are protected, but also that our Prospects’ and Clients’ data privacy and security are safe.


  • 2FA - Two Factor Authentication means that an authentication requires a token that the user, and only the user, has on them at a given time
  • Data Controller - the entity that determines the purposes and means of the processing of Personal Data
  • Data Processor - the entity that processes Personal Data on behalf of the Data Controller
  • Data Protection Authority - the independent national public authority responsible for the monitoring and enforcement of the data protection regulations within the European Union
  • Data Protection Officer - a person or an entity with expert knowledge of data protection law and practices that assists the controller or processor to monitor internal compliance with GDPR
  • Data Subject - an identified or identifiable natural person whose Personal Data is processed by a controller or processor
  • DPA - Data Processing Agreement is a legal binding document that governs the processing made by a Data Processor
  • Encryption - set of technological measures that ensure that the data is only readable by those with specified access
  • NDA - Non-Disclosure Agreement is a legal binding document in which the parties involved can restrict the use and dissemination of information
  • Personal Data - any information related to a ‘Data Subject’, that can be used to directly or indirectly identify the Data Subject
  • Processing - any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal Data Process

Personal data

Under the light of GDPR, Personal Data means any information related to a ‘Data Subject’, that can be used to directly or indirectly identify the Data Subject.

Personal data processed by Unbabel

Community (Editors, Evaluators and Annotators): Unbabel uses Personal Data to connect each editor with the tasks they are more likely to achieve a better end result, such as e-mail, web and push notifications. Unbabel may use their Personal Data to communicate with its Community if there is an inaccuracy or complaint related to an assigned translated work. Unbabel may also require our Community’s payment details to perform and register payment over work provided on the platform. The following Community Personal Data is collected by Unbabel:

  • Email address
  • First name
  • Last name
  • Country
  • Birthdate
  • Language skills

Prospects: Unbabel uses Personal Data from visitors of our website who request to be contacted in order to receive information or demos about our products and services (“Prospects”) to communicate with them and answer to their requests as well as to keep them updated about such products and services, by means of periodical emails or messages. For the above purpose, Unbabel collects the following Personal Data from the Prospects (related to natural persons):

  • First name
  • Last name
  • Job Title
  • Company
  • Email
  • Phone number

Clients: In order to provide reporting, e-mail communications and billing to its clients, Unbabel collects the following Personal Data from its Clients’ accounts (related to natural persons):

  • Email address
  • First Name
  • Last Name
  • Billing Details
  • Taxpayer number (in case of individual Clients)

Unbabel proceeds to the encryption of any Personal Data that may be included in the requested works (i.e.: Names, Credit Card Numbers, Social Security, e-mails, etc.).

Purposes: Unbabel will collect and use Personal Data solely for fulfilling the above specified purposes and for ancillary purposes of the same.
Personal Data should not be further processed in a manner that is incompatible with the purposes that governed the collection, and, to the extent necessary for those purposes, it should be accurate, complete, and up-to-date.
Legal basis for the processing: Unbabel processes the Personal Data of its Community either to perform their contractual relationship (or taking steps before entering into a contract) or to pursue its legitimate interest of ensuring the quality of assigned translated work.
Unbabel processes the Personal Data concerning its Prospects either based upon their consent or relying in its legitimate interest to communicate updates on its products and services, without prejudice to their right to object at any time to processing of Personal Data for marketing purposes.
Finally, Unbabel processes the Personal Data related to its Clients pursuant to their contractual relationship (or taking steps before entering into a Contract) or in order to achieve its legitimate interest of providing a top-notch service.
Should you not provide us with all the Personal Data mentioned above, we may not be able to enter into or execute a contract with you.

Personal data ownership

From Unbabel’s perspective, Personal Data is owned and controlled by the Data Subject to whom it relates.

To support the delivery of our services, Unbabel relies on service providers. Any third-party engaged by Unbabel that might have access or process data that may contain Personal Data is considered a Processor. Despite the Unbabel translation pipeline was designed taking in consideration privacy and security measures, Unbabel still performs a security and privacy review of the practices of any Processors before engaging with them. Below follows a list of our current processors:

  • Amazon Web Services - Cloud service provider
  • Cloudflare - Content distribution, security services and DNS services
  • Conversica - Automated sales assistent
  • Filestack - File Upload
  • FullStory - Support services
  • Google Cloud - Cloud service provider
  • Intercom - Editor’s contact manager
  • HubSpot - Marketing and analytics services
  • Juro - Contract manager
  • LogDNA - Log manager
  • MailChimp - Email services
  • MongoDB - Cloud management services
  • Payoneer - Cloud-based Payment Services
  • PayPal - Cloud-based Payment Services
  • Pusher - Notification manager
  • Salesforce - Client relationship manager
  • Unbabel, Lda - Services provider
  • Zapier - Integration manager
  • Zendesk - Contact Manager

Contractual safeguards & due diligence for our Processors: Any processor and subprocessor used by Unbabel are put under a rigorous scrutiny to assess their security, confidentiality and privacy policies, as well as the adoption of adequate safeguards. We require all our Processors to have signed a DPA with us, similar to the DPA that our Clients sign with us, including but not limited to the requirements to:

  • process Personal Data as defined on their DPA
  • restrict data access only to trusted and legal contractually bound staff to assure data privacy and security
  • train the staff who has access to Personal Data on data privacy and protection issues
  • implement processes which take privacy into account throughout all their data processing activities
  • inform Unbabel about any actual or potential data breach
  • cooperate with Data Protection Authorities or Data Controllers when enquired

Third-party data disclosure

We restrict access to Personal Data to a reduced, privacy protection trained staff that is bound by NDA.
Unbabel only discloses data to third parties where the disclosure is absolutely necessary to provide the services that our Clients requests or in response to a lawful request from an accredited authority. Unbabel will not sell any kind of Personal Data.
Notwithstanding, in restricted and signaled circumstances, we may disclose data to third parties for marketing purposes. We subject the transfer to prior consent of Data Subjects or, at least, to the legitimate interest of such third parties to communicate their products and services. Without prejudice, the Data Subjects have the right to object at any time to processing of Personal Data for marketing purposes.

Personal data breach

By data breach we mean a breach of Unbabel’s security that leads to an accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed on Unbabel’s systems. We don’t consider a Personal Data breach any unsuccessful attempts or activities that do not compromise data security as unsuccessful log-in attempts, pings, port scans, denial of service attacks or other attacks on our systems. In the event of a Personal Data breach that is likely to result in a high risk to the rights and freedoms of natural persons, Unbabel commits itself to notify all Data Subjects without undue delay after the incident discovery. Unbabel also commits itself to notify the supervisory authority without undue delay and, where feasible, no later than 72 hours after having become aware of it if a breach may result in a risk to the rights and freedoms of natural persons.

Data retention

Unbabel complies with the principle of data minimization. Therefore, Personal Data shall only be kept while it is adequate, relevant and limited to what is necessary in relation to the purposes of processing.
Personal Data will be stored during the contractual relationship with our Community or with our Clients or as long as a valid consent is ensured by our Prospects, notwithstanding the need to preserve data for compliance with legal obligations during the term prescribed by law.

Data access, rectification, objection and restriction

Unbabel allows the Data Subjects to access and rectify their Personal Data and also to object to and restrict the processing of their Personal Data in their user’s profile. If you want to make a request regarding the Personal Data that Unbabel holds from you without accessing our platform, follow the procedure below:

  • Request data access, rectification, objection or restriction Send us an email from the email upon which you created your Unbabel account to data-requests@unbabel.com with subject ‘Data access/rectification/objection/restriction request’, specifying your request. Please note that if you object to or restrict the processing of data that we absolutely need to manage your account, we may have to suspend/block your account. Also note that, according to applicable data protection regulations, the right of objection or restriction are subject to certain limitations, which we will take into account to assess the legitimacy of your request.
  • Verify your identity We will send you an email to the address you used to register your account with some steps to verify your identity.
  • Data access/rectification/objection/restriction Once we confirm your identity we will proceed with the access/rectification/objection/restriction to/of your Personal Data.

Data deletion

To maintain and improve service continuity and quality, data is deleted upon account termination or by explicit request either on our platform or by email, provided and insofar that such deletion does not prevent Unbabel or the Data Subject to comply with their legal or contractual obligations. If you want us to delete your data without accessing our platform, follow the procedure below:

  • Request data deletion Send us an email from the email you shared with us to data-requests@unbabel.com with subject ‘Data deletion request’.
  • Verify your identity We will send you an email to the address you used to register your account with some steps to verify your identity.
  • Data deletion Once we confirm your identity and we confirm that the requested deletion does not prevent Unbabel or the user to comply with their legal or contractual obligations, we will proceed insofar with the deletion of your Personal Data.

Data export and portability

In compliance with applicable data protection regulations, Unbabel enables Data Subjects to export their data via our platform or by explicit request. If you want to export all the Personal Data that Unbabel holds from you, please follow the procedure below:

  • Request data export Send us an email from the email upon which you created your Unbabel account to data-requests@unbabel.com with subject ‘Data export request’.
  • Verify your identity We will send you an email to the address you used to register your account with some steps to verify your identity.
  • Data export Once we confirm your identity, we will export all the Personal Data we have from you and send it by email, in a structured, commonly used and machine-readable format.

Other rights

In compliance with applicable data protection regulations, the Data Subjects have always the right to withdraw any provided consent upon any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Also, the Data Subjects may lodge a complaint with a relevant Data Protection Authority regarding any processing carried out by Unbabel.

Data security

In the section below you can find an overview on how we enforce data security at Unbabel.

  • Pseudonymization All content passing through Unbabel’s Translation Pipeline from its Clients goes through an automated pseudonymization process which removes Personal Data (credit cards, social security numbers, URLs and email addresses, etc.) and restores it before delivery. No Personal Data is shared with Community.
  • Access control All access to Unbabel’s products and services is encrypted and protected by firewall. All access credentials are segregated by work-group areas, provided to staff on a need-to-know basis, and audited based on internal security heuristics.
  • Two factor authentication Access to administration applications are secured by 2FA on top of standard user account authentication.
  • Audits and external validation Unbabel applies internal security policies to increase penetration barriers, from digital to physical, and regularly performs information security audits by third-party vendors to validate their compliance with best practices procedures and performance.
  • Encryption Data are encrypted in transit and at rest. More details on this process can be provided on request.
  • NDA and security training Both all our employees and Community members are bound by NDA’s and subject to a continuous security awareness training.

EU-US Privacy Shield

Privacy Shield is a framework for transatlantic exchanges of Personal Data for commercial purposes that protect the fundamental rights of Data Subjects where their data is transferred to the United States and ensure legal certainty for businesses.


Unbabel complies and is certified with the EU-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use and retention of Personal Data transferred from the European Union to the United States. Unbabel has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

If you have any inquiries or complaints about our handling of your personal data under Privacy Shield, or about our privacy practices generally, please contact us at: privacyshield@unbabel.com. We will respond to your inquiry promptly. If we are unable to satisfactorily resolve any complaint relating to the Privacy Shield, or if we fail to acknowledge your complaint in a timely fashion, you have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding Privacy Shield compliance not resolved by any of the other Privacy Shield Mechanisms, including the operation of DPA Panels – for this purpose, please visit https://www.privacyshield.gov/article?id=ANNEX-I-introduction.


As of May 25th, 2018 Unbabel is GDPR compliant.

Data Protection Officer

Unbabel has a Data Protection Officer (DPO), which (i) monitors compliance of data processing with applicable standards, (ii) is a point of contact with the Data Subjects to clarify questions regarding the processing of your data by Unbabel, (iii) cooperates with the supervisory authority, (iv) provides advice about Unbabel’s obligations regarding privacy and data protection.

Contact us

For any enquiries or requests please use the following e-mails according to subject: Subject/E-mail address

Unbabel Inc. is a U.S. based company with registered office at at 2 Embarcadero Center 8th Floor San Francisco CA 94111, USA.