GDPR role and legal identity
José Negro,Fundão, Portugal, operates Searchspeare as the First Party. For GDPR purposes, the relevant legal role is data controller for Searchspeare account, subscription, support, security, billing, product, and service-administration data.
- Searchspeare decides the purposes and means of its own account, security, billing, support, and product processing.
- For workspace content that a user uploads or processes on behalf of a client, employer, or other controller, Searchspeare acts as a processor or sub-processor to the extent it processes that content only to provide the service under the user's instructions.
- This Data Processing Addendum and the Data Processing Terms in the Terms of Service govern processor processing and incorporate Article 28 commitments on instructions, confidentiality, subprocessors, security, assistance, breach notice, deletion or return, audits, and international transfers.
- The GDPR contact is gdpr@searchspeare.com.
Processing schedule
This schedule describes processing performed for the customer during the term of the Searchspeare service and for the limited period needed to delete or return data after termination.
Native document import, conversion and export run inside Searchspeare on the user's device, without a hosted conversion provider. Local-only workspace content is not collected by Searchspeare. If the customer chooses an online AI feature, the content needed for that request is sent to the selected provider, as described in the Privacy Policy.
| Item | Details |
|---|---|
| Subject matter | Cloud hosting and synchronization, editing, analysis, user-requested AI processing, support, security and deletion of customer workspace data processed through the service. |
| Nature of processing | Collection, recording, organization, storage, retrieval, consultation, alteration, translation, alignment, transmission to authorized subprocessors, export, restriction, and deletion as initiated by the customer or required to provide the service. |
| Purpose | Providing the cloud workspace and the online AI, text-recognition, machine-translation, collaboration, support, security and billing-related features selected by the customer. |
| Data subjects | Customers and authorized users; their employees, contractors, clients, vendors, project participants, and contacts; and any person identified or identifiable in uploaded source material, translations, memories, termbases, business records, prompts, or support requests. |
| Personal data | Identity, contact, professional, account, project, linguistic, billing-record, usage, device, diagnostic, and any personal data contained in customer workspace content. |
| Sensitive data | Searchspeare does not require special-category, criminal-offence, health, biometric, financial-account, or children's data. Customers must not submit such data unless they have documented authority, a valid legal basis, necessary safeguards, and provider permissions. |
| Duration | For the service term and the deletion, backup, security, statutory, or legal-claims periods described in the Privacy Policy. User-triggered external providers apply their own documented processing and retention periods. |
Lawful bases
Searchspeare relies on different GDPR lawful bases depending on the purpose of processing.
| Item | Details |
|---|---|
| Contract | Account creation, authentication, project storage, translation workflows, export/download features, AI features requested by the user, subscription access, and customer support. |
| Legitimate interests | Security, abuse prevention, service reliability, error diagnostics, product improvement, fraud prevention, enforcing terms, and protecting user workspaces. |
| Consent | Searchspeare does not currently rely on consent for optional analytics or marketing. If optional consent-based processing is introduced, it will be presented separately with the required controls. |
| Legal obligation | Accounting, tax, invoicing, dispute handling, lawful requests, data protection compliance, and security incident obligations. |
| Vital interests | Not expected in normal CAT tool operation, but reserved for exceptional circumstances where legally necessary. |
Data subject rights
Searchspeare supports the GDPR rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where applicable. Requests should be sent to gdpr@searchspeare.com.
- Users may ask for a copy of personal data controlled by Searchspeare.
- Users may ask for deletion of account and cloud workspace data where no overriding obligation requires retention.
- Users may export project, memory, terminology, invoice, quotation, and other app data through available product exports or by request where technically feasible.
- Users may object to processing based on legitimate interests, including non-essential analytics where enabled.
- Users may lodge a complaint with the Portuguese CNPD or another competent EU supervisory authority.
Additional transparency information
The following information clarifies Article 13 transparency items for normal Searchspeare use.
- No Data Protection Officer has been appointed at this time. GDPR requests should be sent to gdpr@searchspeare.com.
- Providing account, authentication, workspace, and billing data is necessary to create an account, use cloud features, receive support, or subscribe. If the user does not provide required data, Searchspeare may be unable to provide the requested feature.
- Searchspeare does not make solely automated decisions that produce legal or similarly significant effects for users. AI-assisted suggestions, QA checks, translations, alignments, and classifications are productivity outputs that users must review.
- Searchspeare cannot access, export, correct, or delete local-only workspace data that never leaves the user's device. Users control that data through the app and their device or browser controls.
Security measures
Searchspeare maintains technical and organizational measures appropriate to the nature of the service and the risks of processing.
- Authentication, authorization, and logical access controls are used to restrict access to authorized users, personnel, and service operations.
- Personal data is protected in transit using industry-standard encrypted connections where applicable.
- Account and connected-provider credentials are handled using controls designed to prevent unauthorized disclosure.
- Local workspace data remains under the user's device and browser security controls unless the user enables a cloud or external-service feature.
- AI requests send the content needed for the requested feature, not the entire workspace unless the feature requires broader context.
Processors and provider responsibility
Searchspeare uses third-party service providers to operate the service. Their processing is governed by applicable contracts, data-protection terms, and law.
Each provider is responsible for its own services and contractual commitments. Searchspeare remains accountable for its own data-protection obligations and for service providers selected by Searchspeare. Customers remain responsible for lawful content and instructions and for services they connect using their own provider account or key.
- Searchspeare does not sell user information and does not divulge private workspace content except as needed to provide the service, comply with law, protect users, or process a user-requested integration.
- Supabase provides cloud data hosting, authentication, storage, and related service infrastructure.
- Cloudflare provides hosting, delivery, communications, and related infrastructure services.
- Polar provides checkout, subscription, customer portal, and payment-related services.
- Google may provide account sign-in, AI, and ancillary interface services when the relevant feature is used.
- OpenAI, Google Gemini, OpenRouter and routed model providers, DeepL, and Mistral AI may process submitted text or documents when a user invokes the relevant feature.
Subprocessors and objections
The customer gives general authorization for Searchspeare to use the subprocessors identified in the Privacy Policy and reference links for the service features the customer enables.
- Searchspeare will use a subprocessor only where it has assessed the provider as appropriate for the relevant processing and put legally required data-processing and transfer terms in place.
- Searchspeare will provide reasonable advance notice of a new subprocessor that materially processes customer workspace personal data, normally at least 30 days before use where practicable and legally permitted.
- A customer may object during the notice period on reasonable data-protection grounds by contacting gdpr@searchspeare.com. Searchspeare will work in good faith on a reasonable alternative; if none is available, either party may terminate the affected feature or service without penalty for future unused periods, subject to mandatory law.
- Searchspeare will require subprocessors to protect customer personal data to a standard materially consistent with this Addendum for their assigned processing. Searchspeare remains responsible to the customer for its subprocessor obligations to the extent required by applicable law.
International transfers
Because Searchspeare uses global cloud and AI providers, personal data or workspace content may be transferred outside Portugal or the EEA depending on the selected storage mode, region, provider, model, billing tool, and user action.
- Before a restricted transfer of customer personal data, Searchspeare will put an applicable lawful transfer mechanism in place, such as an adequacy decision or the European Commission Standard Contractual Clauses, complete required transfer-risk assessment, and apply supplementary measures where necessary.
- When using a user-supplied API key, the user must verify the provider's transfer mechanism and confirm they are allowed to send the relevant content.
- OpenRouter routing may involve underlying providers with different jurisdictions and retention policies, so provider-specific verification is required.
Security incidents
If Searchspeare becomes aware of a personal data breach affecting customer personal data, it will contain and investigate the incident, document relevant facts, and notify the customer without undue delay with information reasonably available to support the customer's obligations. For data controlled by Searchspeare, it will notify the competent authority and affected users where applicable law requires it.
Instructions, assistance, deletion, and audit
Searchspeare processes customer personal data only on the customer's documented lawful instructions expressed through this agreement, product configuration, support requests, and use of enabled features, unless law requires otherwise.
- Searchspeare will inform the customer if, in its reasonable opinion, an instruction infringes applicable data-protection law, unless legally prohibited from doing so, and may pause the affected processing while the parties resolve it.
- Persons authorized to process customer personal data must be bound by confidentiality and receive access only as needed for their duties.
- Taking into account the nature of processing, Searchspeare will provide reasonable technical and organizational assistance for verified data-subject requests that concern data processed for the customer.
- Searchspeare will provide information reasonably available to assist with security assessments, DPIAs, prior consultation, and regulator inquiries where required, taking into account the nature of processing and information available to Searchspeare.
- At the customer's choice and subject to applicable law, Searchspeare will delete or return customer cloud workspace personal data at the end of processing. Local-only data remains under the customer's device control. Limited backups, security records, legal-acceptance evidence, billing records, and legal-claims records may be retained under the Privacy Policy and isolated from ordinary use.
- Searchspeare will make information reasonably necessary to demonstrate Article 28 compliance available and permit an audit by the customer or an independent auditor where legally required, normally once per year, on reasonable notice, during business hours, subject to confidentiality, security, scope, and cost controls. An incident or regulator request may justify an additional audit.
How to make a GDPR request
Send GDPR requests to gdpr@searchspeare.com. Use the email associated with the account where possible and identify the request type and data scope. Searchspeare may ask for additional verification before acting.
- Searchspeare will respond without undue delay and normally within one month after verifying the request, subject to lawful extensions for complexity or request volume.
- Requests can cover Searchspeare-controlled account, cloud workspace, support, billing, and diagnostic data.
- For data held independently by AI/API, OAuth, or billing providers, users may also need to contact those providers directly under their own procedures.
Supervisory authority and contact
For questions or requests, contact gdpr@searchspeare.com. Users may also contact the Comissão Nacional de Proteção de Dados in Portugal or another competent EU data protection authority.