Privacy policy

The controller responsible for data processing is:

Represented by: Paul Stephan

Email: info@biling.app

Phone: +49 (0) 6142 9673023

We have not appointed a data protection officer, as the legal requirements for doing so are not met. You can reach us with any data protection question at info@biling.app.

For live translation, Biling requires access to your device’s microphone. Microphone access is only granted if you provide the relevant permission via iOS or Android. You can revoke this permission at any time in your device’s system settings.

During an active translation, spoken language is technically captured, transcribed, and translated. The translation is then shown as text and, depending on the selected mode, read aloud with a synthetic voice.

Biling does not permanently store your audio data. Audio data is processed exclusively for the ongoing translation and is discarded once the required processing has been completed.

For speech recognition, we use a specialized technical service provider. For this purpose, audio data is transmitted to this service during an active translation and processed in real time. The audio data is not used for advertising purposes or to create user profiles.

For certain translation, speech output, and AI functions, transcriptions, texts, and the context required for the translation may also be processed by specialized AI service providers.

Biling does not transmit any audio data to these downstream AI services.

The processing is carried out in order to provide the translation function requested by you on the basis of Art. 6(1)(b) GDPR.

Own Voice: If you use the Own Voice feature, your voice recording is transmitted to the speech recognition and speech output service provider. This provider creates a synthetic copy of your voice from it and stores it until you delete the voice in the app or delete your account. Biling itself does not store the recording.

Creating your own voice is based on your consent pursuant to Art. 6(1)(a) GDPR, which you give explicitly before recording. You can withdraw your consent at any time by deleting your voice in the app.

Biling can be used to translate conversations with other people.

Please ensure that other conversation participants are aware that Biling is being used for live translation. The app must not be used secretly to process conversations where doing so is prohibited by law.

Where personal data of other conversation participants is processed, this is done to enable the live translation requested by the user. Our legitimate interest lies in providing this translation function pursuant to Art. 6(1)(f) GDPR, unless the rights and interests of the data subject override this interest.

In individual cases, conversations may also contain special categories of personal data within the meaning of Art. 9 GDPR, such as health data.

Biling is a general-purpose live translator and does not specifically request such information. Such content should only be processed via Biling where there is an appropriate legal basis for doing so. Where Art. 9 GDPR applies, one of the conditions set out in Art. 9(2) GDPR must additionally be met.

Besides live translation, Biling lets you translate typed text, camera images, photos, and documents, and create summaries of conversations.

For camera and photo translation, Biling needs access to the camera or to the photos you select. This access is only granted after you allow it via iOS or Android and can be revoked at any time in the system settings. Biling only accesses the images you take or select.

The text, the image, the text extracted from a document, or the conversation transcript to be summarized is sent to a specialized AI service provider for processing. If the app cannot read a document page on the device, images of that page are only sent if you explicitly choose “Read with AI”. We do not store images, documents, or texts in a database or file storage for this purpose, and they are not stored in our logs. Results are only stored if you use the history (Section 5).

Please only translate images or documents containing personal data of third parties where you are entitled to do so.

The processing is carried out to provide the function you requested pursuant to Art. 6(1)(b) GDPR.

Biling can store your conversations and translations as a history so that you can view, search, or summarize them later. In particular, transcripts, translations, the language pair, the mode, and the time of a conversation are stored. Audio data is not part of the history.

By default, the history is stored only locally on your device. You can switch off history storage entirely under Account → Privacy & storage.

You can optionally switch on cloud backup. Your history is then additionally stored in our database within the European Union (Frankfurt am Main, Germany) so that it is available again after changing devices or reinstalling. Only you can access these entries through your account.

Conversations you delete from the history are also deleted from the cloud backup. Otherwise, stored conversations are kept until you delete them or until your account is deleted.

The processing is carried out to provide the history and backup functions you have chosen pursuant to Art. 6(1)(b) GDPR.

Guest mode lets another person join a conversation with their own smartphone via a QR code or link, without installing the app or creating an account. The guest page opens in the browser.

To take part, the guest chooses their language and allows microphone access in the browser. The guest’s speech is recognized and translated in real time as described in Section 2 and transmitted to the host’s device; in return, the guest receives the host’s translation as text and speech output.

For this, we process a randomly generated session and guest identifier, the selected language, the conversation turns transmitted as text, the connection status, and technical data such as the IP address, browser and device type, and diagnostic values on connection quality. These diagnostic values contain no conversation content and are linked to the host’s account for troubleshooting.

Conversation turns transmitted between the devices are only held temporarily on our servers and are deleted when the conversation ends, at the latest after 24 hours. Audio data is not stored.

In the guest’s browser we store a random guest identifier (local storage) and the selected language (session storage). No product analytics run on the guest page.

The processing is based on our legitimate interest, and that of the host, in translating the joint conversation the guest asked for by opening the page, pursuant to Art. 6(1)(f) GDPR.

If you use a user account, we process, in particular, your email address, an internal user identifier, account settings, language preferences, authentication information, your subscription status, and information about available and used credits and translation minutes.

You can sign up by email (sign-in link or code), with “Sign in with Apple”, or with “Sign in with Google”. With Apple and Google, we receive a user identifier from the respective provider, your email address (which Apple may relay), and, if you choose to share it, your name. The sign-in itself is additionally subject to Apple’s or Google’s privacy terms.

Before creating an account, you can try Biling with an anonymous guest account that is tied to a device identifier.

Our primary backend and database infrastructure for user accounts is operated within the European Union in Frankfurt am Main, Germany.

The processing is carried out to set up and manage your user account and to provide Biling pursuant to Art. 6(1)(b) GDPR.

When you request the free trial credit, we check once, using Apple’s (DeviceCheck) or Google’s (Play Integrity) device verification services, whether the request comes from a genuine, unmodified device and a genuine installation of Biling, and whether a trial has already been used on that device. A verification token generated by the operating system and a device identifier are processed for this purpose. This check serves to prevent abuse on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

For the secure and reliable operation of the app, technical data such as your IP address, app version, operating system, time of a request, technical identifiers, and error and diagnostic information may also be processed. Server and security logs are generally deleted after a few days, and at the latest after 30 days, unless they are needed longer to investigate a specific security incident.

This processing is based on our legitimate interest in the security, stability, and troubleshooting of Biling pursuant to Art. 6(1)(f) GDPR.

If you voluntarily report a translation for quality review, we receive the complete transcript of that conversation and your optional note. By sending the report, you consent to this specific submission and human review pursuant to Art. 6(1)(a) GDPR and, where the transcript contains special categories of personal data, explicitly pursuant to Art. 9(2)(a) GDPR. This consent is separate from product analytics.

Only authorized staff may access report content. The transcript and note are retained until the report is resolved or dismissed and for 30 days afterward; those contents are then deleted while a minimal report receipt remains for duplicate prevention and possible future refund auditing. Deleting your account immediately removes both that receipt and any report content still held. Deleting the original History entry alone does not delete a report already submitted.

Using “Direct feedback”, you can send us a private message. We process your text, your account identifier, technical information (app version, platform, and app language), and optional information about your use case, your situation in life, and whether you or someone you communicate with is hard of hearing. We are notified of new feedback by email; this notification contains your email address so that we can reply.

Information about hearing loss is health data. It is optional; if you provide it, by sending the feedback you explicitly consent to its processing for improving Biling pursuant to Art. 9(2)(a) GDPR. The processing of the feedback is otherwise based on your consent pursuant to Art. 6(1)(a) GDPR. Feedback is deleted 12 months after receipt unless it has already been resolved and deleted.

In the app’s public community area, you can publish suggestions and vote for suggestions. Your posts are visible to other signed-in users together with the display name you choose. With a suggestion, we additionally store the app version, platform, and app language; this information is only visible to us. Posts remain until you delete them or your account is deleted; we may hide posts that violate our terms of use. The processing is carried out to provide this function pursuant to Art. 6(1)(b) GDPR.

Paid subscriptions and purchases in the app are made through Apple’s App Store or Google Play. Apple and Google process the data required for this, in particular payment data, as independent controllers; their privacy policies apply. Biling does not receive complete credit card, bank, or other payment information.

You can also take out a subscription on our website. The seller is then a specialized payment service provider acting as merchant of record, which processes your payment data, your email address, and your billing details as an independent controller; its privacy policy applies. Here too, we do not receive complete payment information.

For the technical management of purchases and subscriptions, we use a specialized subscription service. In particular, an internal or pseudonymous user identifier, product and transaction identifiers, subscription status, and information about the start, renewal, and end of a subscription may be processed.

The processing is carried out for the performance and management of your subscription pursuant to Art. 6(1)(b) GDPR.

If you request a refund from Google Play, Google may ask us for a statement. For this, we transmit, through our subscription service, an assessment based on your credit consumption in the billing period concerned. No conversation content is transmitted. We do not provide such a statement to Apple. The processing is based on our legitimate interest in the proper handling of refund requests pursuant to Art. 6(1)(f) GDPR; Google decides on the refund.

To operate Biling reliably, identify technical errors, and develop it according to actual needs, we use the analytics service PostHog (PostHog Inc., USA) as a processor pursuant to Art. 28 GDPR. Analytics data is stored on servers within the European Union in Frankfurt am Main, Germany. Where access from a third country cannot be ruled out, the safeguards described in Section 14 apply.

Usage statistics on our servers: From the requests the app sends to our servers anyway in order to work, we derive pseudonymous usage events and pass them to the analytics service under your internal account identifier: first use of the app; the start and duration of conversations with mode and language pair; features used, such as text, photo, camera and document translation or summaries; a guest joining through a shared link; the purchase, renewal and end of subscriptions and credits; plan status, app language and the use case you chose during onboarding. We also use the platform (iOS or Android) and the app version, which the app sends with every request for compatibility checks. Nothing is stored on or read from your device for this.

Interface statistics in the app: In addition, the app sends information about how it is used: screens viewed; steps taken, for example during onboarding, when choosing a plan, and when buying or cancelling a subscription; latencies, connection and quality values of conversations; for errors, only the type of error and the affected program locations; and the app version and platform. This information carries only a random identifier that is created anew at every app start, held only in memory, and never stored on your device. It is linked neither to your account nor to earlier app starts, and no user profile is built from it.

Your email address and name are not passed to the analytics service; IP addresses are not stored by the analytics service.

Audio recordings, conversation content, transcripts, and translated text are neither collected nor stored for analytics purposes. No session recordings take place in the app.

Product analytics is active by default. The legal basis is our legitimate interest in a stable, error-free service that is developed according to actual needs, pursuant to Art. 6(1)(f) GDPR. In our assessment this interest prevails because only pseudonymous usage data, without any conversation content, is processed, the usage statistics are derived only from requests that are needed anyway, and the interface statistics carry no persistent identifier. As product analytics neither stores information on your device nor reads it from your device, no consent under Section 25(1) TDDDG is required.

You may object to this processing at any time pursuant to Art. 21 GDPR by sending an informal email to info@biling.app. Neither our servers nor the app then send analytics data for your account, and we delete the analytics data already recorded under your account identifier. Interface statistics from earlier app starts are not linked to any person and therefore cannot be deleted selectively.

On this website we use the same product analytics in two tiers. In particular, the pages you open, the language version, a category for the referring site, campaign parameters, the type of browser and operating system, and your interactions with the website — such as the live demo, the pricing plans, and the forms — may be processed.

Without consent (cookieless audience measurement): If you have not consented, we count your visit without cookies and without storing anything on your device. For this, PostHog computes, on servers in the EU, a hash of your IP address, browser identification (user agent), the domain visited, and a random value that changes daily, under which your page views of one day are grouped. The IP address is then discarded and not stored. Because the random value is replaced every day, you are not recognised on a different day. Further device information such as screen size, time zone, or language setting is not collected in this mode, no session recordings take place, and purchases are not linked.

The legal basis for cookieless audience measurement is our legitimate interest in measuring the reach of our website and improving it according to actual needs, pursuant to Art. 6(1)(f) GDPR. In our assessment this interest prevails because no persistent identifier is created and recognition beyond the day is ruled out. As no information is stored on your device and no information is read from it beyond what your browser transmits with every page request anyway, no consent under Section 25(1) TDDDG is required.

You may object to this measurement pursuant to Art. 21 GDPR. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we treat it as an objection, and no analytics of any kind then run on this website. As we cannot identify you in this mode, an objection can technically only be implemented through this browser setting. Please note: “Decline” in the notice refuses the consent-based analytics, not the anonymous count.

With consent: After you consent, we additionally assign this browser a pseudonymous analytics identifier, stored locally so that repeat visits can be related to each other, and also process technical device information such as screen size and time zone, as well as page load times.

Once you consent, we additionally record masked session recordings of how the website is used, so that we can find usability problems. Every input field, and the live demo, form, and purchase-confirmation areas, are masked or hidden in your browser, so their contents never reach our systems. Console output and network payloads are not recorded.

If you take out a subscription on this website, we pass this browser’s pseudonymous analytics identifier to our subscription service so that the purchase can be related to the preceding website visit. This only happens if you have consented.

Consent-based analytics takes place pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw any consent you have given at any time with effect for the future through “Cookies” in the footer of every page; after that, only cookieless audience measurement takes place.

Session recordings are deleted after 30 days. Other analytics data, including the data from cookieless audience measurement, is deleted no later than 12 months after it was collected.

When you visit this website, our hosting and network provider processes technically necessary access data, in particular your IP address, date and time, the address requested, the amount of data transferred, the referrer, and browser and operating system information. This data is used to deliver the website and to fend off attacks and overload. It is generally deleted after a few days, and at the latest after 30 days. The legal basis is our legitimate interest in a secure, functioning website pursuant to Art. 6(1)(f) GDPR.

In the free live demo, your speech is captured via your browser microphone as described in Section 2, translated in real time, and not stored. To limit demo use, we process pseudonymous identifiers as described in Section 15. The legal basis is Art. 6(1)(b) GDPR for the demo you start and Art. 6(1)(f) GDPR for limiting abuse.

If you write to us using the contact form, we process your name, your email address, the selected topic, your message, the language version of the page, and the browser identifier (user agent). We are notified of new requests by email. The processing is carried out to answer your request pursuant to Art. 6(1)(b) GDPR where it relates to a contract, and otherwise on the basis of our legitimate interest in communicating with you pursuant to Art. 6(1)(f) GDPR. Contact requests are deleted 12 months after receipt unless statutory retention obligations apply.

If you join a waitlist, we process your email address and the language version of the page in order to let you know as soon as the feature or platform concerned is available. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe at any time by emailing info@biling.app; your address is then deleted, and in any case once the announced information has been sent.

For account-related, sign-in, security-related, support, and other necessary emails, we use a specialized email service provider.

In particular, your email address as well as sending, delivery, and technical communication information may be processed.

The infrastructure we use for this purpose is located within the European Union.

Depending on the nature of the message, processing is carried out either for the performance of the contract pursuant to Art. 6(1)(b) GDPR or on the basis of our legitimate interest in secure and reliable communication pursuant to Art. 6(1)(f) GDPR.

Marketing emails are only sent where the relevant consent or another legal basis exists.

We use specialized technical service providers to provide Biling.

These include, in particular, service providers for backend systems, databases, and authentication; hosting, content delivery, and network security; real-time speech recognition and speech output; AI-based text, image, and translation processing; subscription management; product analytics (PostHog); and email delivery.

Where these service providers process personal data on our behalf, they are contractually bound pursuant to Art. 28 GDPR.

Apple and Google receive data as independent controllers where you use their app stores, sign-in services, or device verification services, as does the seller of subscriptions on our website (Sections 7 and 9).

We limit the data transmitted to the extent necessary for the respective purpose. Data is only disclosed to other third parties where we are legally obliged to do so.

Specific information about the recipients of personal data is available on request at info@biling.app and as part of your right of access.

A substantial part of our infrastructure is operated within the European Union.

However, certain specialized technical service providers or their subprocessors may process personal data outside the European Economic Area, in particular in the United States of America.

This may apply, in particular, to technical services for speech and AI processing, subscription management, payment processing, hosting, and network security.

During real-time speech processing, audio data may technically be transmitted to the speech recognition service used for this purpose. In this case, audio data is processed exclusively for the purpose of carrying out the current translation and is not permanently stored by that service.

Where personal data is processed outside the European Economic Area, this is done only on the basis of a transfer mechanism permitted under Chapter V of the GDPR. For service providers in the United States certified under the EU-U.S. Data Privacy Framework, we rely on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR); the list of certified companies is available at https://www.dataprivacyframework.gov. In all other cases, we agree to the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

You can request a copy of the safeguards applicable in each case by contacting info@biling.app.

As a general rule, we store personal data only for as long as necessary for the respective purpose. Specific periods are given in the relevant sections; the most important ones are summarized here.

Audio data from live translations is not permanently stored by Biling.

User account data and a backed-up conversation history are generally stored for as long as your user account exists. After the account is deleted, the associated personal data will be deleted or anonymized unless statutory retention obligations or other legal grounds require further storage.

We keep accounting and invoice records relating to purchases and subscriptions for up to ten years in accordance with commercial and tax law obligations (Section 257 HGB, Section 147 AO). After an account is deleted, these records are separated from your user account and retained without a profile, email address, or recoverable login identity. The legal basis is Art. 6(1)(c) GDPR.

Server and security logs are deleted after 30 days at the latest, website session recordings after 30 days, and other analytics data after 12 months at the latest. Contact requests and feedback are deleted after 12 months.

For the free website demo, we store a randomly generated pseudonymous browser identifier and a pseudonymized identifier derived from the IP address observed by our server. Both identifiers are processed with a secret HMAC key before storage; raw values are not stored. They are used solely to prevent abuse and costs and to enforce the demo limit, then deleted after 30 days. Recipients are our hosting and database providers. This processing is based on our legitimate interest in secure and economical operation pursuant to Art. 6(1)(f) GDPR.

With certain external AI services, transmitted text content may, depending on the technical configuration, be temporarily processed in the provider’s security and abuse-prevention logs. Where storage takes place, it is limited to what is technically and legally necessary.

You can request the deletion of your Biling account using the corresponding function within the app or by emailing info@biling.app.

Please note that deleting your Biling account does not automatically terminate a subscription purchased through an app store. Where applicable, the subscription must also be cancelled separately through the relevant app store.

To prevent the same login identity from repeatedly claiming free introductory minutes, after an account is deleted we permanently store a key-bound HMAC fingerprint of your verified login identity. The associated key is kept exclusively internally; the original email address or provider identifier is not stored together with this fingerprint, and the fingerprint is not used to contact you. The processing is carried out for the purpose of preventing abuse on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

When you use Sign in with Apple, we store the Apple refresh token in encrypted form so that the Apple authorization can be revoked when the account is deleted. If no such revocation token is available for an older account, we will nevertheless fully delete the account and inform you that you should additionally terminate the connection in your Apple Account settings under “Stop Using Apple ID.”

Biling may store certain information locally on your device, in particular login and session tokens, language settings and other app settings, the conversation history (Section 5), and, where applicable, your objection to product analytics. The app stores nothing on your device for product analytics itself (Section 10).

On this website we store your consent decision and the version of this policy it relates to locally in your browser. Only after you consent are a pseudonymous analytics and session identifier, and a count of the demo runs you have started, added; withdrawing consent removes them. Without consent, analytics stores nothing on your device (Section 10). To limit the demo, we also store a random browser identifier (Section 15). On the guest page we store the information listed in Section 6.

Where such storage is strictly necessary for the functionality requested by you, it is carried out pursuant to Section 25(2) No. 2 TDDDG without separate consent. Otherwise, it only takes place with your consent pursuant to Section 25(1) TDDDG.

Subject to the applicable legal requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and to object to certain processing (Art. 21 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

Right to object: Where we process data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, in particular for product analytics in the app and cookieless audience measurement on this website (Section 10), you have the right to object at any time, on grounds relating to your particular situation, pursuant to Art. 21 GDPR. We act on an objection to product analytics without requiring any further reason. For the app, an informal note to info@biling.app is sufficient; for the website, the “Do Not Track” or “Global Privacy Control” browser signal.

To exercise your rights, you can contact us at info@biling.app.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence. The authority responsible for us is:

You are not legally required to provide your data. However, without an email address or sign-in with Apple or Google we cannot set up a user account, without microphone access live translation is not possible, and without camera or photo access image translation is not possible.

No decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place. The automated abuse-prevention checks only concern the granting of free trial and demo allowances.

We take appropriate technical and organizational measures to protect your personal data against loss, misuse, and unauthorized access.

Communication between Biling and our backend and API services generally takes place over encrypted connections.

We review and improve our security measures in line with technological developments and the relevant risk situation.

We may amend this Privacy Policy if Biling, the processing activities we use, or the applicable legal requirements change.

The current version will be made available within the app and/or on our website.