GDPR has landed
Whether you live in Europe or not, you're probably aware that as of May 25th 2018 the General Data Protection Regulation came into effect. Although this law only protects EU citizens, all our users will benefit from how we're meeting its requirements.
We didn't just start caring about your data today, but we've certainly been given a nudge to make some important changes and document them here in glorious detail.
TL;DR
We've made a few product changes and have a brand new Privacy Notice and updated Terms of Service. It's important you know about these changes so you know what you're agreeing to by continuing to use Loco.
Please note that Loco is for storing translations, and not for uploading personal data belonging to other people. We don't think people are using Loco for this purpose, but as it is physically possible for translations to contain personal data we've had to update our terms of service to explicitly prohibit it.
What's new?
Email suppression list
We now operate an email suppression list. We've done this because anyone can send you an invitation to Loco, or register with your email address (accidentally or otherwise). That's annoying for people and there wasn't anything we could do to stop it. The unsubscribe link in all emails sent from our system now allows you to add yourself to this block list and never be bothered again.
Privacy dashboard
The "personal profile" interface now has a Privacy tab. As well as the existing account deletion option, this now provides two JSON dumps of your personal data. One for your profile data and one for all the records of your log-ins to the site, including time and IP address. We'll be adding further privacy controls to this tab in future. At least it has a home now.
Site notices
We've tried to communicate privacy issues more clearly throughout the interface. Look out for the :privacy icon:. It's a shield. Honestly we weren't sure what the universally accepted icon for privacy should be, but it looks quite cool.
Exposing yourself
When you use Loco to send an email to somebody else (like sharing a link, or inviting a colleague) we are now hiding your email address. Previously this was exposed so they could reply to you. Although that was convenient, it was a personal data leak. We will be working on making this optional so you can show and hide your email to the people you like.
Updated privacy notice
We took the opportunity to rewrite our privacy notice. Although the data we process has barely changed, we've worded the notice more in line with the GDPR and tried to give clearer explanations of why we process your personal data. Please read the new notice, because it's part of what you've agreed to as a Loco user:
Compliance document
Part of complying with the GDPR is demonstrating that we comply with the GDPR. Our privacy notice is supposed to be short and easy to read, so we thought we'd better write a separate document for this. If you're a European citizen and you want to know more exactly how we're protecting your rights, check it out. It's a fun read.
Updated terms of service
The key change to our terms of service has been to our acceptable use policy. It's never been permitted to upload illegal content into Loco, but we've had to expand this to include Personal Data that isn't yours. If you're uploading other people's personal data to our servers - whether you have their permission or not - you'll be in breach of our terms from now on. We don't know why anyone would need to do this with a translation tool (and have never seen it happening) but we've had to make it a condition of service all the same.
We made some other small updates unconnected with GDPR. Primarily we clarified the position that you control your account even if someone else (like your employer) pays for a subscription. They may own the translations in your account, but it doesn't give them access to your account and they can't authorize us to do anything to your account without your permission.
We've also specified that the minimum age to hold a Loco account is 13.
Please read the updated terms. If you don't continue to agree to them, then please ask us to delete your account.