Privacy Policy

This Privacy Policy explains how PATTRANS COMPANY LIMITED (Tax code 0111399245), Unit 0315, C2 Building, 119 Tran Duy Hung Street, Yen Hoa Ward, Hanoi, Vietnam, ("Pattrans", "we") handles personal data when you use Pattrans.Ai (the "Service"). It forms part of our Terms of Service and is presented before you create an account. We process personal data under Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and its implementing regulations. For users outside Vietnam we aim to align with applicable data-protection standards; we do not claim GDPR or APPI compliance. Some data is necessary to create an account, process a document, or issue an invoice — without it we cannot provide those functions; other data is optional. In this Policy, "Customer Content" has the meaning given in Terms of Service, Section 1.

1. Who we are and scope

Pattrans is the operator of the Pattrans.Ai website, applications and translation software. This Policy applies to all of them. Contact details are in §17.

2. What information the Service uses, and why

• Account and contact — your full name, email, phone number if you provide one, organisation and billing contact, to create and manage your account and contact you about it. We record the language you choose for the interface and emails, the date your account was created, your plan tier and term, your Standard Words balance and information about your account benefits to provide and manage the service.
• Payment country or region — the country or region you select in your profile, the market selector or at checkout, used to display the appropriate currency, prices and payment methods and to prefill the country at checkout. When you have not made a selection, the app estimates the country from your device’s time zone or language to display prices; the estimate stays only on your device and is not sent to the server. When international payments are available: after a transaction is completed, if the country you select matches the country in the billing address you enter at that step, we store the result of this comparison as the “confirmed country”, together with the time of confirmation, retain the most recent result for reconciliation, and update the account’s payment country or region to match that result. This does not verify your nationality or place of residence. Each order records the country applicable when the order is created.
• Sign-in data — your sign-in method (email or Google), your credentials, including your Google account identifier if you sign in with Google, session information and email verification status, to enable sign-in, verify your email and keep your account secure. Credentials are stored using industry-standard protection; we do not store readable passwords. When you buy on the website, you sign in to the purchase pages with a code sent to your email; a purchase session is valid for at most 1 hour.
• Customer Content — the documents, text, terminology and My Termbase entries you submit to or store in the Service, together with the Output and any intermediate representations, within the meaning of "Customer Content" in Terms of Service, Section 1. We use this material to perform and return the translation you request, to operate the related Service functions, and for the limited support, security and legal purposes described in this Policy. A technical document usually contains no personal data, but it may include personal data of third parties (for example, a name on a cover page) and occasionally sensitive personal data (§11).
• Technical data — IP address, device identifiers, the device name set in the operating system, app version and the time it was recorded, and operating logs. When you create an account, the system records the IP address, device identifier and device name to keep the account secure and to apply the published gift conditions. When a translation job is re-run, the system uses the identifier and name of the device that created the job and the project path on that device to re-run the correct job.
• Support messages — what you send us when you ask for help, including emails and attachments, used to answer you.
• Promotional programs — when you apply to join a promotional program, including where the application is refused: the version of the rules and your acceptance; the normalised form of your email address, the email domain, the device identifier and app information used to check the published conditions; check results; your use of benefits; the status, reasons and staff handling notes for any refusal, suspension, restoration, review or grant of compensation; and, if you choose to answer, the channel through which you learned about the program.
• Cookie and similar-technology identifiers (§14).
• Invoices and records — invoice, tax and order records; information you provide to request an invoice, including the buyer type, your full name or organisation name, address, country, email address for receiving invoices, phone number, and tax identification number, personal identification number or passport number, as applicable; records of your acceptance of these documents and complaint records. These records are used to manage orders, issue invoices, record acceptance and handle complaints; records subject to mandatory retention are kept in accordance with applicable accounting, tax and record-keeping requirements. These records also include the order content at the time you confirm the order, the versions of the documents you accept, and refund request records (including the reason you write yourself). The retention period for each group is set out in §7.
• Payment data — handled by Pattrans and our payment provider (§13); we receive only limited transaction records, not full card details.

Where this comes from, and where it does not go. Most of this information comes directly from you or from your use of the Service. Some check results are derived from data about your account, devices and use of the Service; handling notes are created by authorised personnel. Limited transaction information may also come from our payment provider (§13). We do not buy personal data from data brokers or other sources for enrichment, marketing or resale. We do not sell, rent, license or exchange personal data as a product, and we do not disclose it for third-party advertising or marketing. This does not prevent the limited disclosures described in this Policy to contracted sub-processors acting for us, to payment providers involved in your transaction, or to authorities where disclosure is required by law. Personal data is not a product or service we offer; where we process it, we do so for the purposes and on the legal bases described in §4.

3. Our roles

For processing we independently determine — account, billing, security and legal compliance — Pattrans is the controller. Any new purpose that requires your consent will be described to you and your consent obtained before that processing begins (§16). For Customer Content processed on your instructions, Pattrans generally acts as a processor under your documented instructions — including these Terms, any applicable Data Processing Agreement, and your use and configuration of the Service — except where required by law or where Pattrans independently determines a separate purpose. You are responsible for the personal data in your documents and for a lawful basis to process it. Roles are determined by purpose, not by whether you are an organisation.

4. Purposes and legal bases

Section 2 explains in practical terms what information is involved and why. This section states the corresponding processing purposes and legal bases.

• Provide the Service to you — including managing your account and Standard Words, processing the documents you submit, running requested translations, and storing and applying terminology in your own My Termbase — to perform your agreement with us, as permitted by applicable personal-data law.
• Check your job for processing faults and retry, to deliver you a usable result — to perform your agreement with us, as permitted by applicable personal-data law.
• Authorised personnel view only the parts of Customer Content and Output necessary to: (i) identify, reproduce and fix job faults; (ii) handle your support request; (iii) resolve operational incidents in order to provide the Service as agreed, or handle security incidents on an appropriate legal basis; (iv) act on specific signs of conduct that infringes the rights or legitimate interests of Pattrans, you or others, to the extent necessary and with a demonstrable basis. Customer Content is processed according to our corresponding role, the relevant instructions and the applicable legal basis. We do not proactively read Customer Content to look for general improvements. Technical fixes arising from these cases may be applied across the Service; we do not place your content or personal data in shared resources (§8).
• Translate documents that may contain third-party personal data — where such data is present, we process it on your instructions as processor, solely as necessary to perform the translation you request; you are responsible for an applicable lawful condition (§10).
• Issue invoices and meet tax and accounting duties — legal obligation.
• Protect the Service and prevent, detect and address fraud, abuse, security incidents and attacks — where necessary to protect Pattrans's, users' or other persons' lawful rights and interests against infringement, or under another condition permitted by applicable law; otherwise, with consent where required. Matching accounts by email address, IP address, device identifier or device name to apply the published conditions of the welcome gift and promotional programs is carried out under the agreement you have accepted and is limited to the data needed for those conditions. Where there are specific signs of infringing conduct, we process data only as necessary to protect the rights or legitimate interests being infringed, and we bear the burden of showing that basis.
• Investigate and respond to support requests you make, including access by authorised personnel to the Customer Content reasonably necessary for that request — to perform your agreement with us, as permitted by applicable personal-data law.
• Send you service and legal notices — necessary to perform our agreement / legal obligation.
• Process your application and provide benefits under the rules of a promotional program you have accepted — including checking the published conditions, calculating benefits, reviewing decisions and granting compensation — as necessary to perform that agreement.
• Record the order content, document versions and your confirmation when you place an order — to perform the transaction, to let you review it later, and to evidence the conclusion of the contract.
• Aggregate statistics on referral channels — from answers to "How did you hear about the program?". The question is optional, nothing is pre-selected, and answering does not affect your benefits; your answer is stored only if you choose to answer (your consent), is kept with your application until the period in §7, and is used only for aggregate statistics. You may withdraw your consent and ask us to delete your answer under §9.

We rely on consent where the law requires it, and you may withdraw it at any time. Withdrawing consent does not affect processing carried out before the withdrawal; if the data is needed for a feature, that feature may no longer be provided.

5. Sub-processors

To provide the Service we use contracted sub-processors in these categories: AI translation providers; cloud hosting and infrastructure; operational tools (logging, error monitoring, support, support mailbox hosting); electronic invoicing providers; transactional email delivery (verification emails, login codes, notifications); domain management, delivery of the website (including the purchase pages, as static pages) and the app-update channel — when your device loads this content, the provider processes your IP address, browser or app information and request data; account and order data sent by the purchase pages and the app go directly to our servers and do not pass through this provider; and third-party account sign-in, where you choose that sign-in method. Some process Customer Content; some are located outside Vietnam (§6). Our sub-processors may not use Customer Content to train, fine-tune or improve models or services for themselves or others, and process it only to perform their function for us. We disclose the current categories of sub-processors in this Policy; processing locations are set out in §6. Any data subject may ask for information about the recipients and processors of personal data relating to them, including the name of each party and the purpose and scope of processing, through the channels in §9. We provide this information in line with your rights and applicable law, and do not limit this right by type of customer. We give affected users reasonable advance notice of a new sub-processor that materially changes how Customer Content is processed, and of a material change to the categories of recipients, processing locations or use of Customer Content; where a change requires consent under the law, we obtain that consent before applying it. We may change providers, including processing on infrastructure we operate ourselves.

6. Cross-border transfer

Some sub-processors are located outside Vietnam. Depending on the activity, transfer and processing outside Vietnam may involve Customer Content, account and transaction data, and information about access to the website or the app-update channel. For each transfer we assess the recipient, purpose and protections, apply appropriate contractual and security safeguards — which may include purpose limitation, confidentiality, access controls, security requirements, retention limits, deletion obligations and restrictions on onward transfer — and comply with the cross-border-transfer requirements of Vietnamese personal-data law, including any impact assessment and filing. These safeguards reduce but do not eliminate transfer risk. Servers and storage: Singapore. Our AI translation, transactional email, third-party sign-in, domain, website-delivery and app-update providers are entities in the United States; transactional email is delivered through a sub-contractor's infrastructure in Japan. We use Google Workspace to receive, store and process support emails and their attachments. Data handled through this channel may be processed outside Vietnam, including in the United States. We do not speculate that data is stored anywhere other than the locations our providers publish. Any data subject may ask for information about the recipients and processors of personal data relating to them, including the name of each party and the purpose and scope of processing, through the channels in §9. We provide this information in line with your rights and applicable law, and do not limit this right by type of customer.

7. How long we keep it

Your own device remains the primary home for your files. On our servers, processing-cache copies of source files, Output and intermediate representations created solely to provide the Service are deleted automatically after your project reaches a final state (completed, cancelled or failed) and the copies are no longer needed — normally within 7 days. Where storage on our servers runs low, these processing-cache copies may be removed sooner, and a server-side copy of a project that has not reached a final state may also be removed once it has been inactive for more than 30 days. Project records or other copies retained in your account remain until you delete the project; a deleted project remains in trash, where you can restore it, for up to 90 days unless you empty the trash earlier, after which its remaining account copies are permanently deleted, subject to the limited backup and legal-retention exceptions below. My Termbase entries remain in your account until you delete them or close your account. When you close your account, the account enters a 14-day waiting period during which you can restore it (how the waiting period is counted, when the Service is suspended and how to restore your account: the "Service termination and refund policy" part of the General Transaction Conditions (Vietnamese)). After the waiting period, we delete the account and content from active systems; only data that needs to be kept on an applicable basis is retained for the separate periods set out in Section 7. Where you request support or a technical investigation, related project data may be kept for the duration of that request and deleted within the stated period after it is resolved, unless a longer period is legally required. Support messages you send us through the in-app support request feature are kept for up to 90 days after the request is closed. Where a request relates to a refund, a dispute or a legal claim, we may keep the related messages for as long as needed to resolve that matter, and delete them when it ends. Database backups are encrypted and kept for up to 120 days (14 days on the server; 30 days in a second store in the same region; up to 120 days on a Company device in Vietnam); operating logs (including security logs) are kept on a separate, limited cycle and are removed within 90 days.

In addition to the periods above, the following records are kept as set out below. An account is "permanently deleted" when the 14-day recovery period ends and the account data is deleted under this Section; some items listed below are kept longer for their own periods. When a period ends, the data is deleted; an exception for an open matter applies only to the data needed for it, with restricted access, and the data is deleted when the basis for keeping it ends. Storage, backup and review cycles do not extend the time limit for carrying out a deletion request (the "Personal data protection policy" part of the General Transaction Conditions (Vietnamese), clause 1, point (e)). When you request deletion, the relevant data in active systems, trash and the support mailbox is deleted within that time limit. Encrypted backups and copies in providers' systems cannot be selectively deleted: that data is not used, is removed when the backup cycle or the provider's period set out in this Section ends, and the deletion request is re-applied if the data is restored; we state this when we respond to your request. Any data retained on another basis is kept only to the extent necessary, and we tell you the reason.

• (a) IP address, device identifier and device name recorded when the account was created, and the last recorded app version: while the account exists. When the account is permanently deleted, only the device identifier and the time are kept for a further 90 days to apply the gift conditions; device names and project paths linked to jobs are also deleted.
• (b) After an account that received a welcome gift is permanently deleted, to check whether the gift is claimed again we keep only a keyed matching value of the normalised email address and minimal information about the gift, for at most 12 months. This is still personal data, is used only for that purpose and is deleted when the period ends; we do not keep the readable email address or the Google identifier in this record.
• (c) Sign-in session records (including IP addresses): deleted within 3 days after a session expires or is revoked. Internal account-matching lookup logs: 90 days.
• (d) Promotional program application and participation records: 12 months after the program ends, after which only aggregate statistics are kept. Answers to "How did you hear about the program?" are aggregated when the program ends, and their link to accounts is deleted within 30 days after that.
• (e) Order content and evidence of acceptance when you place an order: 5 years from the date of each order, including after the account has been deleted, with restricted access.
• (f) Refund records: the parts that are accounting documents are kept for the periods required by accounting and tax law; the reason you write yourself is kept for 5 years after the request is resolved.
• (g) Evidence of acceptance at account sign-up and when joining a program: the document version, time and a minimal record identifier linking the acceptance event are kept while the account exists and for at most 5 years after it is permanently deleted, with restricted access, to evidence acceptance and resolve related disputes. The IP address, browser or app information and device identifier in the acceptance record are deleted when the account is permanently deleted.
• (h) Emails and attachments sent to support@pattrans.ai are kept while your request is being handled. We review the mailbox quarterly and delete emails and files that are no longer needed at the next review after the request has been resolved. If retention is still necessary for a specific refund matter, dispute or complaint, or to meet a legal obligation, only the necessary parts are retained with restricted access, reviewed quarterly and deleted at the next review after that basis ends. Records subject to a separate retention period in this Section follow that period; your deletion rights under §9 remain unaffected. When we delete them, the emails and files are permanently deleted from the mailbox; residual copies in the mailbox provider's systems are deleted by the provider within the periods it publishes, currently up to about 7 months.

Records we must keep by law (such as invoices and tax records) are retained for the legally required period. Certain transaction records also retain the project folder name associated with the transaction. A project folder name includes a system-generated timestamp and a label you supply, which may reflect a document title; we retain it with the transaction record so that your own transaction history remains readable after the project itself has been deleted. These records do not retain your source documents, translations or intermediate files themselves. You can delete active project copies, or empty your trash, at any time; residual backup and log copies are removed under the cycle above.

8. Improving the Service

We work to improve the quality of the Service.

(a) As part of producing your translation, our systems automatically check your job for processing faults — such as missed or untranslated segments, empty output, or formatting errors — and retry so we can deliver you a usable result. This is part of providing the Service and concerns technical processing, not the linguistic accuracy of the Output.

(b) Authorised personnel view only the parts of Output and Customer Content necessary in the cases and within the limits set out in §4. Applying a fix across the Service does not involve copying or reusing Customer Content in shared resources.

(c) We do not copy, extract or place Customer Content into any shared resource, including by manual transcription; we do not use Customer Content to train or fine-tune AI models; and we contractually require applicable AI providers not to use Customer Content for those training or fine-tuning purposes (see the commitments in the "Rights and obligations of the parties" part of the General Transaction Conditions (Vietnamese), clause 1, point (g)).

When you ask for support on a specific issue, we may ask you to grant scoped, time-limited access to the projects concerned. You can decline, and you can revoke access you have granted at any time.

9. Your rights

Subject to law, you may ask us to: know how we process your data; give or withdraw consent; access, correct or update your data; delete or restrict processing; object to processing; and provide personal data relating to you in the form and scope required by law. You may also make a denunciation, bring proceedings, seek compensation and request other protective measures as provided by law. You may submit a request by emailing support@pattrans.ai or using the in-app support request feature. Pattrans receives the request, verifies your identity where necessary, carries out the request or notifies you of the legal grounds for not doing so, and then informs you of the outcome. The procedure and time limits for exercising each right are set out in the "Personal data protection policy" part of the General Transaction Conditions (Vietnamese), clause 1, points (e) and (g). If copies of deleted data remain in backups, those copies are removed under the cycle in Section 7, and the deletion request is re-applied if the data is restored from backup. Where we process Customer Content only as a processor, we will assist and may direct you to the customer who controls that data. You may also complain to the competent authority for personal-data protection in Vietnam (§17). For data of children or of persons who must act through a legal representative, we accept requests to exercise rights through the representative in accordance with the law.

10. Your responsibilities

Your documents may contain personal data of third parties, sometimes sensitive. Your representations and responsibilities concerning the content you submit are set out in Terms of Service, Section 7.2. You should not upload sensitive personal data unless necessary and lawfully authorised. These obligations do not limit our own obligations under applicable law.

11. Sensitive personal data

Customer Content may contain sensitive personal data (for example, health or genetic information in medical or pharmaceutical patents, or identification and financial details). Submit such data only where necessary and lawfully authorised. Because we may not be able to identify every item of sensitive data within technical documents, we apply strong baseline protections to all Customer Content and additional controls where sensitive processing is identified.

Beyond Customer Content, some data we collect ourselves to operate the Service may fall within the descriptive scope of the sensitive personal data categories under Vietnamese law: payment-transaction reconciliation data, and account sign-in, session and device logs. We apply the protections for sensitive data to this data. Where we need consent to process sensitive personal data, we state clearly that it is sensitive data.

12. Security

We use technical and organisational measures appropriate to the risk, including: encryption in transit and, where applicable, at rest; access control on a least-privilege basis; logging and monitoring; logical access separation between customer accounts; secure deletion; sub-processor due diligence; and periodic review. Access to Customer Content is limited to authorised personnel and sub-processors bound by confidentiality, and only where necessary to provide, secure or support the Service, to fix errors in the cases set out in §4 and §8, or for incident response or legal compliance. For authorised personnel, access to Customer Content is subject to the purposes and limits set out in §4. If a personal-data breach occurs, we will investigate it and mitigate its effects; where notification is required by law, we will proactively notify the competent authority and affected persons within the legally prescribed period. For personal data in Customer Content for which you are the controller, we will notify you promptly.

13. Payment and invoicing data

Payment transactions are concluded with Pattrans (with our payment provider). Payment providers process payment data under the roles described in their applicable privacy terms and contractual arrangements, and may be located outside Vietnam. Pattrans processes the limited order and account data it receives to provision Standard Words, reconcile transactions, and provide support.

Invoicing. For purchases made directly from Pattrans, we issue a Vietnamese electronic invoice. The billing details you provide are sent to the electronic invoicing provider we use to prepare and issue the invoice, and are transmitted to the tax authority as required by law. We also send the invoice email address you provide to the electronic invoicing provider so that it can send the invoice to you. For invoices marked “Bán cho người tiêu dùng” (sale to a consumer), we send your account email address to the provider so that it can send the invoice to you, including when “Issue an invoice to me” is turned off. We limit the information sent to the data needed to prepare, issue and send the invoice to you.

When you pay, your device loads the payment-code image directly from the collecting gateway; that party sees your IP address and device information at this step without passing through our servers.

14. Cookies

Our website does not currently use cookies or similar technologies for analytics, profiling or advertising. It uses local storage in your browser to remember display preferences you set, such as your chosen currency, and session storage to keep your purchase-page sign-in session and orders awaiting payment. A purchase-page session expires after at most 1 hour; signing out ends the session; you can delete data stored in your browser using its clear-site-data function. Any cookie set by the Service is limited to what is necessary to operate and secure it. If we later introduce non-essential cookies or similar technologies, we will ask for your consent where required and provide controls for them before we start using them.

15. Automated decisions

When you receive a trial gift or apply for a promotional program, the system automatically checks the conditions published in the General Transaction Conditions or the applicable Rules; depending on the result, your request is accepted, passed for an additional check, or refused under the applicable conditions. You are told the status and the reason category, and you can ask our staff to review it through the published channel. Generating a translation is not an automated decision that produces legal or similarly significant effects for you.

16. Changes

We may update this Policy; material changes will be notified and the "last updated" date will change. Where a change introduces a new purpose that requires your consent, we will ask for that consent before starting the new processing.

17. Contact and complaints

Privacy and information-security questions, reports and complaints may be submitted by emailing support@pattrans.ai or using the in-app support request feature; the steps and time limits are set out in the "Procedures for receiving and handling feedback, requests and complaints" part of the General Transaction Conditions (Vietnamese). To exercise your rights, see Section 9. You may also submit a complaint or request to the competent Vietnamese authority responsible for personal-data protection, including the Ministry of Public Security or the authority designated under applicable law.