Privacy Policy

BasalBit GmbH, Deckerstraße 39, 70372 Stuttgart, Germany, info@basalbit.com, operates ReRune and acts as controller for personal data processed in connection with account registration, website use, billing administration, support requests, newsletter subscriptions, platform security, and workspace administration.

Where customers upload translation content, project files, languages, or collaboration data into a ReRune workspace, the customer determines the content and purpose of that processing. ReRune processes that customer content to provide the requested localization service, configured workflows, imports, exports, and runtime delivery features.

This Privacy Policy applies to visitors, registered users, organisation owners, invited workspace members, billing owners, newsletter subscribers, and individuals who contact BasalBit GmbH about ReRune.

• Account and authentication data: email address, account identifiers, authentication state, verification events, password-reset events, session metadata, security-relevant access events, and Figma plugin connections and pairing sessions.
• Organisation and authorization data: organisation names, invited-user email addresses, member roles, billing ownership, workspace membership, and administrative settings.
• Project and localization data: project names, languages, locales, translation keys, translation values, placeholders, glossaries, metadata, tags, comments, imported files, exported files, runtime delivery settings, and design data sent from the Figma plugin: Figma file keys, names and links, the layer IDs and the layer, frame and page names of linked text layers, design screenshots of frames with the positions of linked layers and the text of each linked layer captured with the screenshot, and requests for new screenshots with the member who made them, and screenshots uploaded in the dashboard, with the name given to each, the positions of the keys marked on it and the member who uploaded it. This also includes work packages, with their name, due day, keys, the member who created them, the member they are assigned to, the member who approves them and the reason given when one is rejected, and the notifications members receive about them.
• Integration and workflow data: enabled integration status, provider selection, language or model choices, request metadata, activation state, and usage metadata required to perform the selected workflow.
• Support and communication data: messages sent to BasalBit GmbH, support context supplied by the user, newsletter opt-in state, newsletter email address, and unsubscribe state.

Translation content remains customer content. ReRune stores and processes translation strings, source text, target translations, prompts used for translation workflows, glossaries, placeholders, project metadata, imported files, and design references and screenshots, with the layer texts captured with them, sent from the Figma plugin, and screenshots uploaded in the dashboard, for the purpose of providing the localization workspace.

Users are responsible for the content they upload. Users must not place secrets, credentials, payment card data, health data, regulated sensitive data, or unlawful material into translation strings, prompts, glossaries, metadata, comments, or imported files unless they have all required rights, legal bases, and safeguards.

The ReRune Figma plugin runs in Figma and talks only to the ReRune API, and only while a user works with it. Inside Figma, it reads the text layers of the selection or page a user works on, with their names, their frames and pages, and the ReRune data stored in the file. It sends the texts a user searches for, links or pushes, and the IDs of the keys it shows; a push that creates keys also sends each new key's name and the name of its top-level frame, which becomes the key's description. To find existing keys with the same text or name, it also sends texts it does not push: opening Push sends the text of every unlinked text layer in the selection or page it covers and the key names suggested or typed for them, and Link exact matches and the Link dialog send the text of the selected layers; the Link dialog also searches for the first 100 characters of a layer's text. These lookups create nothing in ReRune. When a user saves a file's Figma link, it also sends the file key, link and name, and for linked text layers their layer IDs and the layer, frame and page names. With Upload screenshots of changed frames turned on, a push or Update layers from ReRune uploads an image of each top-level frame it changed, with the frame and page names and, for each linked layer, its position and its text; sandbox accounts never upload images. When members of the project ask for new screenshots, the plugin reads which frames are requested, and only when the user chooses Update screenshots does it read those frames, write their changed ReRune texts and upload their images in the same way. ReRune stores these images in a bunny.net Storage zone in Germany (EU), and shows them only to members of the project's organisation, through signed links that expire. Sign-in pairs the plugin with the user's ReRune session in the browser. The plugin keeps its token in Figma's local plugin storage on the user's device; ReRune keeps only a keyed hash (HMAC) of the token with its last four characters, emails the account after each new connection, and lists every connection under Connected apps in the profile, where it can be revoked. A pairing session holds the pairing code, a hash of the plugin's poll secret, its approval state with the account that approved or blocked it, and a hashed identifier of the network that started it. The plugin writes into the Figma file its links (key ID and name, project ID and a hash of the linked text), its file settings (the ReRune server and project, the file's Figma link and name, and the plugin's naming and scan options), previews (translations, pseudo-localized text or key names) with the original text they replace, and language copies of frames, each marked with its language, its source (draft or published), the variation option ID, the original frame's ID and the copy's own layer ID; Figma stores that file data under the customer's own agreement with Figma and is not a ReRune subprocessor.

Stripe Payments Europe, Limited handles payments, tax calculation, invoicing, subscriptions, paid-plan trials, payment methods, cancellations, refunds, and customer portal workflows for ReRune.

BasalBit GmbH receives and stores the billing and subscription information needed to administer ReRune accounts, connect a subscription to a billing account, apply plan limits, maintain invoice records, and comply with commercial and tax obligations.

• Service provision: create accounts, authenticate users, operate organisations and projects, store translation content, run imports and exports, manage collaborators, deliver OTA functionality, and provide selected integrations.
• Billing administration: manage subscriptions, trials, invoices, payment status, tax information, cancellations, refunds, and free-account limits after downgrade.
• Service communications: send transactional emails, verification emails, password reset emails, invitation emails, billing notices, support replies, and opt-in newsletters.
• Security and operations: detect abuse, secure accounts, investigate errors, enforce limits, troubleshoot issues, maintain operational logs, and preserve platform reliability.
• Legal compliance: keep commercial, accounting, tax, payment, consumer, and legal records for the period required by applicable law.

After a visitor selects Accept analytics, ReRune uses PostHog Cloud EU for acquisition attribution, product usage measurement, and reliability measurement. ReRune sends explicit event names; anonymous device and session identifiers; the stable internal user ID after sign-in; account-safe organisation and project IDs where relevant; plan IDs; counts; enums; booleans; platform and locale information; approved UTM source, medium, campaign, and content values; origin-and-path-only page and referrer URLs; and browser or device metadata added by the PostHog web SDK.

ReRune does not intentionally send email addresses, first or last names, translation keys or values, source or target text, prompts, comments, credentials, API tokens, repository URLs, support free text, raw error messages, exception payloads, or session recordings to PostHog. Automatic interaction, Web Vitals, session recording, and exception capture are disabled, and URL query strings and fragments are removed before events are sent.

Analytics is off when no choice exists or when analytics is rejected. Accepting enables PostHog browser storage and sends a sanitized marketing page-view event. Visitors can reject, accept, or withdraw analytics from the Cookie Notice page. Withdrawal opts out of capture, resets the analytics identity, and clears PostHog persistence where supported. ReRune stores the analytics choice separately from PostHog.

ReRune uses PostHog Cloud EU, hosted in Frankfurt, Germany, and has configured the production project to discard client IP data. PostHog Inc. acts as processor under a signed Data Processing Agreement. The agreement incorporates the EU-US Data Privacy Framework and EU Standard Contractual Clauses, Module 2, for authorized processing outside the EEA. PostHog analytics events are retained for 12 months under the current Free plan.

• Contract performance under Article 6(1)(b) GDPR for account access, workspace operation, collaboration, translation workflows, subscriptions, support, and requested integrations.
• Legal obligation under Article 6(1)(c) GDPR for commercial, tax, invoice, accounting, payment, consumer, compliance, and legally required retention records.
• Consent under Article 6(1)(a) GDPR for opt-in newsletters and other processing that requires consent.
• Legitimate interests under Article 6(1)(f) GDPR for service security, abuse prevention, troubleshooting, reliability, support administration, and normal product operation.

DeepL and OpenRouter are optional customer-enabled integrations. ReRune sends translation content, glossary terms, prompts, language metadata, model choices, and request metadata to the selected provider only when a user triggers the relevant integration workflow.

The customer controls whether an optional integration is enabled and which content is submitted through that workflow. The provider's own terms and privacy information apply to the provider-side processing.

ReRune sends transactional email and newsletter email through Microsoft 365 / Exchange Online via Microsoft Graph. Transactional emails include verification, password reset, invitation, account, and billing-related messages required to operate the service.

Newsletter email is opt-in. ReRune processes the email address for newsletter delivery, provides an unsubscribe option, and does not use newsletter tracking pixels or link tracking.

ReRune uses Hostinger for hosting, application data, storage, and backups in Frankfurt, Germany. ReRune uses bunny.net (BunnyWay d.o.o.) for OTA translation delivery, staging previews, delivery usage logging, and the storage and delivery of design screenshots uploaded from the Figma plugin or the dashboard. ReRune uses Microsoft 365 / Exchange Online via Microsoft Graph for transactional and newsletter email. ReRune uses Stripe for billing and payment workflows.

DeepL and OpenRouter receive customer content only when the customer enables and triggers the relevant optional integration. Current processors and optional integration recipients are listed on the Subprocessors page.

When a visitor submits a ReRune contact form, Web3Forms, operated by Web3Creative in Kerala, India, processes the email address, message, and any supplied name. Depending on the form, it also receives the inquiry category, summary, page path, interface language, and optional company, team-size, translation-key estimate, and locale estimate. Web3Forms processes these details through infrastructure in the United States (US-East) and forwards the inquiry to BasalBit GmbH. Web3Forms’ privacy and retention terms apply to that processing.

Core hosting is located in Frankfurt, Germany. bunny.net is operated by BunnyWay d.o.o. in Slovenia / EU and delivers OTA content through a global edge network, which may involve processing outside the EEA. Design screenshots from the Figma plugin or the dashboard are stored in a bunny.net Storage zone in Germany (EU), without replication to other regions; serving them may also involve edge processing outside the EEA. Stripe Payments Europe, Limited is located in Ireland / EEA. DeepL SE is located in Germany / EU. OpenRouter, LLC is located in the United States and receives content only for customer-triggered optional AI translation workflows.

Where personal data is transferred outside the EEA, ReRune relies on the safeguards provided by the relevant provider terms, data processing agreements, standard contractual clauses, adequacy decisions, or other transfer mechanisms available under applicable data protection law.

ReRune keeps account, workspace, translation, billing, and operational data for as long as required to provide the service, maintain the account, comply with law, resolve disputes, enforce agreements, and protect the platform. Figma file records, layer links and design screenshots stay with their project: a new upload of a frame replaces its screenshot and the texts captured with it and clears its screenshot requests, a member can delete a screenshot from the Figma plugin in the dashboard with the texts captured with it and its screenshot requests, the plugin's link sync removes the links of unlinked layers, deleting a key removes its links and its highlight boxes, screenshots uploaded in the dashboard stay until a member replaces their image or deletes them, removing a key from one removes its areas, disconnecting a file in the project's Figma settings removes the file's links and screenshots, and deleting a project removes all of its Figma data. A background job then deletes removed screenshots from the Storage zone and retries until the deletion succeeds. Work packages stay until the member who created them deletes them or the project is deleted. Notifications stay until the member who received them deletes them, their account is deleted or the project is deleted, and keep the name of a work package after it is deleted.

ReRune does not automatically delete workspace data after subscription cancellation or downgrade. Workspace data remains available under free-account rules until users delete relevant data or legal, billing, security, or operational retention requires continued storage.

Users can delete their profile from profile settings. Profile deletion is irreversible. Users should export their data before deleting their profile, cancel active subscriptions where needed, and understand that billing and invoice records remain stored where commercial or tax law requires retention. Deleting a profile also deletes the user's Figma plugin connections and pairing sessions. Figma plugin connections otherwise end after 90 days without use and at the latest 365 days after sign-in, when the user revokes them in the profile or signs out in the plugin, and when the password is reset; ended connections are deleted. Pairing sessions are deleted when sign-in completes or automatically after they expire, 10 minutes after they start.

Account, authentication, workspace, and billing information is required where it is necessary to create an account, provide the requested service, administer a subscription, comply with legal obligations, or protect the platform. If required information is not provided, ReRune cannot provide the affected account, workspace, billing, support, integration, or delivery functionality.

• Request access to personal data ReRune holds about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion where continued processing is not required.
• Restrict or object to certain processing.
• Receive portable data where the right applies.
• Withdraw newsletter consent at any time.
• Lodge a complaint with a competent supervisory authority. For BasalBit GmbH, the competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

ReRune uses self-hosted authentication and application infrastructure on Hostinger, operational access controls, account verification flows, password reset flows, and security logs to protect the service.

No online service is completely risk free. Users must protect account credentials, restrict workspace access to authorized people, review invited users, and avoid placing secrets or regulated data into localization content.

ReRune does not use personal data for automated decisions that produce legal effects concerning users or similarly significant effects within the meaning of Article 22 GDPR. Translation automation and optional AI-assisted translation workflows generate localization output for user review and do not decide legal, financial, employment, credit, or access rights without user action.

For privacy requests, contact BasalBit GmbH at info@basalbit.com.