Privacy Notice

This Notice is given pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "General Data Protection Regulation") and describes the processing of personal data carried out in connection with targum.

Identity of the Controller

The controller of the personal data described in this Notice is David Langellotti (the "Controller"), who operates the service made available at targum.page (the "Service").
The Controller may be contacted at hello@targum.page in respect of any matter arising under this Notice, including the exercise of any right set out at clause 7 below.
The Controller has not appointed a data protection officer, no such appointment being required under Article 37.

Scope

This Notice applies to personal data relating to persons who hold an account with the Service, who request access to it, or who otherwise access the pages made available at targum.page (each, a "Data Subject").
This Notice does not apply to any website to which the Service links and over which the Controller exercises no control.

Categories of data, purposes and legal bases

The Controller processes only such personal data as is necessary for the purposes stated. The categories processed, the purpose of each and the legal basis relied upon are as follows.

Electronic mail address. Processed for the purposes of authenticating the Data Subject, maintaining the account and communicating with the Data Subject in relation to the Service. The Service employs no password; the address constitutes the account. Legal basis: Article 6(1)(b), performance of a contract to which the Data Subject is party.
Material retained by the Data Subject. Namely words and phrases marked by the Data Subject, together with any notes, meanings, documents opened, reading positions and dates of reading. Processed for the purpose of providing the Service. Legal basis: Article 6(1)(b).
Material uploaded by the Data Subject. Namely any file supplied by the Data Subject and any targum generated from it. Processed for the purpose of providing the Service. Legal basis: Article 6(1)(b).
Records of requests for authentication links. Namely the electronic mail address to which each such request relates and the time of the request, whether or not an account exists for that address. Processed for the purpose of enforcing a rate limit, without which the authentication form could be employed to transmit unsolicited mail to third parties from the Controller's domain. Legal basis: Article 6(1)(f), the legitimate interests of the Controller and of such third parties in preventing the misuse of the Service.
Server access records. Namely the internet protocol address from which a connection is made, the resource requested and the time of the request, recorded by the reverse proxy through which the Service is served. Authentication tokens are removed from each record before it is written. Processed for the purposes of diagnosing faults and detecting misuse, and of counting visits in aggregate: the number of pages viewed and of distinct visitors each day, the pages viewed, the referring sites, the campaign named in a link, and the country in which each address is located, which is determined on the Controller's own server and not disclosed to any person. Such counts identify no one; a visitor is distinguished from another only within a single day, and no identifier is retained from which one day's visitor could be matched with another's. Legal basis: Article 6(1)(f).
Records of use of the reader. Namely, for each document opened by the Data Subject: each word looked up, in its dictionary form, and the segment in which it occurred; the portions of any recording played, and whether its picture was shown; pages turned and sections marked as finished, with the number of words in each; the position at which a session ended; and the controls of the reader that were pressed. A record of a control pressed identifies neither a document nor a segment. Processed for the purposes of presenting to the Data Subject the time they have listened and watched and the number of words they have read, and of preparing for the Data Subject, at their request, a printed sheet of the words they looked up in a given week. Legal basis: Article 6(1)(b). The Data Subject may at any time cease such recording, and erase the records held, from the account page.
Aggregate records of use. Counts, by segment and by control, of the events described at clause 3.6, across all Data Subjects and bearing no identifier of any of them, and confined to documents the licence of which permits their redistribution; no such count is made in respect of material uploaded by a Data Subject. Processed for the purposes of measuring the difficulty of the texts offered and of arranging the controls of the reader. Legal basis: Article 6(1)(f), the legitimate interest of the Controller in improving the Service.
Corrections of meaning offered by the Data Subject. Namely, where the Data Subject has accepted the grant described in the contribution terms, the word corrected, the sentence in which it was read, the meaning as it stood and as it now stands, and the text in which the correction was made. No such record bears the name or the account of the Data Subject: each is stored under a role, together with a pseudonym which distinguishes one contributor from another and which cannot be resolved to an account save by means of a secret held by the Controller and never published. Processed for the purposes of correcting and evaluating the linguistic data upon which the Service depends, and of research into the language so described. Legal basis: Article 6(1)(a), the consent of the Data Subject, given by acceptance of that grant and withdrawable at any time; withdrawal ends the offering of further corrections and does not unmake those already given, which are held under the licence then granted.
Telegram. Where the Data Subject links a Telegram chat to the account: the identifier of that chat and the time at which it was linked, and any message the Data Subject sends to the Service's bot from it. A message so sent is processed only to create a targum from its content, which is held as material uploaded by the Data Subject under clause 3.3; the name of any person from whom it was forwarded is not read or stored, and no record of the messages themselves is kept. Processed for the purpose of providing the Service. Legal basis: Article 6(1)(b). The Data Subject may unlink the chat at any time, by sending /stop to the bot or from the account page, whereupon its identifier is deleted. The retention of messages by Telegram is governed by Telegram's own terms.
The waitlist and the Weekly News Digest. Namely, for a person who asks to join the waitlist or to receive the digest: the electronic mail address, the language of the page from which the request was made and, for the waitlist, which page of the Service that was, whether the address has been confirmed or withdrawn, and the times of those events; and, where the person tried a link on the front page before joining, that link, kept with their place and deleted if they leave the waitlist. Processed for the purposes of confirming the address, of inviting the person to the Service in turn and preparing that link for them, and of sending the digest. When a link is tried on the front page, a one-way hash of the visitor's network address is kept for up to one hour, to limit how often that box can be used, and is then deleted. Legal basis: Article 6(1)(a), the consent of the person, given by confirming the address and withdrawable at any time by the link in each message.
Where processing is founded upon Article 6(1)(f), the Data Subject may object to that processing in accordance with clause 7.6, and the Controller shall state which of the operations concerned it is able to cease without terminating the account.
Authentication tokens and session identifiers are stored in the form of a one-way cryptographic digest and not in their original form.
No processing is undertaken for the purposes of advertising or profiling, and no record of the conduct of a Data Subject is kept save as stated at clauses 3.6 and 3.7. The Service transmits no data to any provider of analytics, employs no third-party script, and sets no cookie other than that which maintains an authenticated session and, while an assistant is being connected to the account, one which holds that request for no more than ten minutes. A generated targum opened from a file makes no network request whatsoever; served to an authenticated Data Subject, it communicates with the Service alone.

Recipients

Personal data is not sold, and is not disclosed to any person for that person's own marketing purposes.
The Controller engages the following processors, each of which processes personal data only upon the Controller's instructions and for the purpose stated.

Hetzner Online GmbH (Federal Republic of Germany)

Provision of the server upon which the Service and its data reside.

Resend, Inc. (United States of America)

Transmission of the Service's electronic mail: authentication messages, invitations, confirmations of the waitlist and of the digest, the digest itself, and notices that a targum is ready. Receives the electronic mail address of the Data Subject and the content of each message.

Anthropic PBC (United States of America)

Translation and explanation of text presented for reading, the reading of pictures supplied for reading, and the replies of the Service's chat. Receives that text, those pictures and what the Data Subject writes in the chat, and does not receive the electronic mail address of the Data Subject. Anthropic states that inputs and outputs are deleted within thirty days of receipt or generation and are not used to train models.

OpenAI OpCo, LLC (United States of America)

Transcription of recordings supplied by the Data Subject, and the making of cover pictures. Receives the sound of such a recording and the title of a text, and does not receive the electronic mail address of the Data Subject.

ElevenLabs, Inc. (United States of America)

Transcription of recordings supplied by the Data Subject. Receives the sound of such a recording, and does not receive the electronic mail address of the Data Subject.

Google LLC (United States of America)

Speech read aloud from a text, at the Data Subject's request. Receives the text to be spoken, and does not receive the electronic mail address of the Data Subject.

DataImpulse

Relaying requests made by the Service to fetch material at an address supplied by the Data Subject. Receives that address, and no identifier of the Data Subject.
Save as provided at clause 4.2, the Controller discloses personal data only where compelled to do so by law, or where disclosure is necessary to investigate use of the Service against another person.

Transfers to third countries

The server upon which the Service operates is situated at Falkenstein in the Federal Republic of Germany.
Five of the processors identified at clause 4.2 are established in the United States of America. Accordingly, the electronic mail address of the Data Subject, the text presented for translation, what the Data Subject writes in the chat, and pictures and recordings supplied by the Data Subject are transferred to that third country.
No other transfer of personal data outside the European Economic Area is undertaken.

Retention

Personal data is retained for no longer than is necessary for the purposes for which it is processed.
The period applicable to each category, or the criteria by which that period is determined, is set out in the Data Retention Schedule, which forms part of this Notice.

Rights of the Data Subject

Subject to the conditions and exceptions provided by the General Data Protection Regulation, the Data Subject has the following rights.

Access (Article 15). To obtain confirmation as to whether personal data concerning the Data Subject is processed and, where it is, a copy of that data. This right may be exercised directly and without application by means of the function styled "Download your words" upon the profile page, which returns the entirety of the account in machine-readable form.
Rectification (Article 16). To obtain the correction of inaccurate personal data.
Erasure (Article 17). To obtain the deletion of personal data. The procedure is set out in the Erasure and Account Closure Procedure.
Restriction of processing (Article 18).
Portability (Article 20). To receive personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller. The function identified at clause 7.1 satisfies this right.
Objection (Article 21). To object, on grounds relating to the Data Subject's particular situation, to processing founded upon Article 6(1)(f).
Rights not exercisable by the means described above may be exercised by written application to hello@targum.page. The Controller shall respond within one month of receipt, which period may be extended by two further months where necessary, the Data Subject being informed of any such extension.
The Controller shall require that any such application be made from the electronic mail address recorded against the account, verification of identity being necessary in order that disclosure does not itself occasion the harm the right exists to prevent.

Complaints

The Data Subject has the right under Article 77 to lodge a complaint with a supervisory authority, in particular in the Member State of the Data Subject's habitual residence, place of work or of the alleged infringement.
The exercise of that right is without prejudice to any other administrative or judicial remedy.

Requirement to provide data

The provision of an electronic mail address is a requirement necessary to enter into a contract for the Service. The Data Subject is under no obligation to provide it, but the Controller is unable to furnish an account in its absence.
No decision producing legal effects concerning the Data Subject, or similarly significantly affecting the Data Subject, is taken on the basis of automated processing within the meaning of Article 22.

Amendment of this Notice

The Controller may amend this Notice from time to time. The date of the last amendment appears below.
The Service is developed in the open and the history of every amendment is publicly recorded.

Last amended 28 September 2026. Adapted in part from 37signals' open-source policies, used under CC BY 4.0. This document is not legal advice.