Security & data privacy

Last updated: 2026-10-14

Localhero.ai is a company in Stockholm, run by Andersson-Larsson Holding AB. Your translation files and your team's accounts pass through our service. This page describes where that data goes, who can see it and how we look after it.

The short version:

• Your translations and account data are stored in the EU. AI translation runs in the EU too.
• Nobody trains AI models on your content. Not us and not our AI providers.
• We keep as little personal data as we can.

If something is missing here or you want to report a security issue, email hi@localhero.ai. You'll hear back from the person who built the service.

Where your data is processed

• Our application and database run on Render in Frankfurt, Germany.
• Translations run on Microsoft Azure OpenAI with Data Zone EU deployments. Requests are processed inside the EU.
• Some analysis (glossary, style guide and quality checks) uses Anthropic's Claude models through AWS Bedrock. So does our fallback when Azure is unavailable. We call Bedrock from Frankfurt with inference profiles that stay inside the EU.
• Translation files we generate are stored on AWS S3 in Frankfurt.
• Web traffic passes through Cloudflare's network, which protects the site and the signup form.
• Translated files are committed to your own GitHub repository.

Your content and AI

• We don't use your content to train AI models. Microsoft and AWS don't either.
• OpenAI and Anthropic never get access to your content. The models run inside Microsoft's and Amazon's own infrastructure.
• AWS doesn't keep requests for the Claude models we use.
• Microsoft's standard abuse monitoring can keep prompts that are flagged as possible abuse. Those stay in the EU and are reviewed only by Microsoft staff in the EEA.

Personal data we store

• For each user: name, email address and the account IDs from GitHub or Google if you sign in with them.
• For pull requests: the title, branch and commit. We don't store who opened a pull request.
• IP addresses are used for bot checks at signup and for rate limiting. They show up in our application logs for 14 days. We don't store them with your account.
• Error reports are filtered to leave out email addresses, IP addresses, cookies and session data.
• Website analytics use Plausible, which doesn't use cookies or track individual visitors.
• We don't sell data and we don't run ads.

Sub-processors

These are the services that process data on our behalf.

Providers outside the EU are covered by the EU Standard Contractual Clauses. Most are also certified under the EU-US Data Privacy Framework. We tell customers before we add a new sub-processor.

How we protect it

• All traffic is encrypted with TLS.
• Data is encrypted at rest. That covers the database, its backups and the files on S3.
• Database backups are kept for 7 days.
• Every infrastructure and admin account uses multi-factor authentication.
• Each organization has admin and editor roles.
• Access to production systems and data is limited to the founder.

Deleting your data

• When you delete an organization, its projects, translations and settings are permanently deleted 30 days later. The delay means we can restore it if it was deleted by mistake.
• To delete your user account or anything else, email hi@localhero.ai.

Data processing agreement

Our data processing agreement is part of our Terms of Service. If your company has its own DPA, send it over and we'll go through it. See also our Privacy Policy.