Privacy Policy
DeepL added a new payment-processing partner, Payrails GmbH, which will store your payment method and handle your first subscription payment. The policy also now explicitly lists the payment-method details (card brand, last four digits, bank ID, country of issue, card fingerprint) that DeepL receives from its payment providers.
Your payment data is now also sent to a second payment company
Previously your payment info went only to Stripe. Now DeepL also sends it to a new company called Payrails, which will store your card details and handle your first payment. DeepL has a data-protection contract with Payrails limiting what it can do with your data, but it's still a new party that touches your financial information.
“we use the payment orchestration services of Payrails GmbH, Zimmerstrasse 16, 10969 Berlin, Germany; AG Charlottenburg ("Payrails"). Payrails stores your payment method, processes your first payment and returns to us a token for the stored payment details.”
DATA SHARING
More detail now spelled out about payment data collected
DeepL clarified that it receives specific card details — brand, last four digits, bank ID, country, and a card fingerprint — from its payment provider. This data was likely already being processed to run your payments; it's now just listed explicitly rather than being new tracking.
“Information about your payment method received from our payment service provider (token, card brand, last four digits, BIN, country of issue and card fingerprint)”
DATA COLLECTION
| 153 | 153 | |
| 154 | 154 | - First name, surname, and where applicable, company name |
| 155 | 155 | - Address |
| 156 | 156 | - Payment details |
| 157 | 157 | - Tax numbers (where applicable) |
| 158 | 158 | - Selected subscription option |
| 159 | - Information about your payment method received from our payment service provider (token, card brand, last four digits, BIN, country of issue and card fingerprint) | |
+ ADDEDNew disclosed data: payment method details DeepL now explicitly states it receives a token plus your card brand, last four digits, bank identification number, country of issue, and card fingerprint from its payment provider. | ||
| 159 | 160 | - Possibly other, additional data you provided during the registration process. |
| 160 | 161 | |
| 161 | 162 | Your payment details will also be processed by us if you initially sign up for a DeepL Pro subscription with a free trial period. Despite the free trial period, the processing of your payment details is already necessary at the time of the formation of the contract within the meaning of Art. 6 para. 1 sentence 1 lit. b) GDPR, as a DeepL Pro subscription is in principle a paid subscription and we only in some cases allow our customers to test our products free of charge for a trial period. However, if no cancellation is made within the aforementioned trial period, the subscription will automatically continue to be subject to payment and the method of payment specified by you will be debited at the time stated in the booking process. |
| 162 | 163 | |
| 163 | 164 | In addition to the aforementioned data, we process further (usage-)data relevant for the provision and billing of our service, such as subscription ID, date and time of the subscription conclusion, billing period, successful payment processing, logins, number of translated or improved characters and documents, upgrades and downgrades. The processing and storage of the aforementioned data is necessary for the conclusion of the contract as well as its performance and is therefore justified according to Art. 6 para. 1 sentence 1 lit. b) GDPR. If you yourself are not a party to the contract, but DeepL Pro is provided to you, e.g. by your employer or an organization to which you belong, we justify the processing of the data mentioned in section 6.1 and the aforementioned usage data via Art. 6 para. 1 sentence 1 lit. f) GDPR, as this is necessary for the performance of the business relationship with our customers, i.e. your employer or your organization. |
| 164 | 165 | |
| 165 | 166 | We store the data for the duration of the contract term and subsequently, if applicable, for the duration of statutory retention periods, insofar as these prescribe the retention for the respective types of data. We will delete your account if you wish to do so after canceling your subscription. Otherwise, we will maintain your account as DeepL account (see section [6.1]()) so that it is available to you in the event of a renewed subscription without you having to register again. This is in your as well as in our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. |
| 166 | 167 | |
| 167 | 168 | ### 6.3 Processors involved in the DeepL Pro checkout process |
| 168 | 169 | |
| 169 | 170 | In order to process payments, we forward the necessary payment data to our authorized payment service provider Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland ("Stripe"). Where necessary, Stripe will transfer the data to Stripe, Inc., located in the USA. Further information on data protection at Stripe and compliance with the requirements of Art. 44 GDPR can be found [here](https://stripe.com/de/privacy) and [here](https://stripe.com/de/privacy-center/legal). We have concluded a data processing agreement with Stripe, which allows Stripe to process the data solely in accordance with our instructions and not for its own purposes. |
| 170 | 171 | |
| 172 | In addition, we use the payment orchestration services of Payrails GmbH, Zimmerstrasse 16, 10969 Berlin, Germany; AG Charlottenburg ("Payrails"). Payrails stores your payment method, processes your first payment and returns to us a token for the stored payment details. We use the stored payment method to collect the payments due under your subscription. Further information on data protection at Payrails and compliance with the requirements of Art. 44 GDPR can be found [here](https://www.payrails.com/privacy-policy). We have concluded a data processing agreement with Payrails, which allows Payrails to process the data solely in accordance with our instructions and not for its own purposes. | |
+ ADDEDNew payment processor: Payrails GmbH DeepL added a second payment company, Payrails (based in Berlin, Germany), which stores your payment method, processes your first payment, and gives DeepL a token to charge you for future subscription payments. | ||
| 173 | ||
| 171 | 174 | In addition, we use the fraud prevention services of Riskified Ltd, 30 Kalisher St., Tel-Aviv, 6525724, Israel ("Riskified"). Riskified's service helps us to detect and analyse fraud in online transactions. This enables us to prevent fraudulent activity and misuse of our services. |
| 172 | 175 | |
| 173 | 176 | When you purchase DeepL Pro services on our website, DeepL may transmit data like your first name, last name, billing address, email address, the DeepL service you booked, its price, your IP address, a truncated form of your payment data (for credit cards this is the BIN, the last four digits of the credit card and the bank issuing the card, for SEPA payments this is the bank code and the last 4 digits from your IBAN) to Riskified for verification purposes. Riskified also directly collects and processes your IP address and information on your device and on your behaviour in our checkout process as well as an identifier via its beacon, a Java script that is implemented in the DeepL check process. Riskified analyses these various data points and provides us with an assessment of whether a transaction is to be considered safe or likely to be fraudulent. More information on the logic typically involved in such an analysis can be found [here](https://www.riskified.com/learning/fraud/guide-fraud-score-scoring-models/). If Riskified assesses a payment as fraudulent, we may automatically decline your request to subscribe to DeepL Pro. This is justified, because this fraud analysis is necessary for entering into a contract with us. In case you receive an error message, but consider the decision not correct, you can reach out to support(at) deepl.com at any time and one of our support agents will review your case. |
| 174 | 177 | |
| 175 | 178 | We will also feed back user data to Riskified if Riskified has provided us with a positive assessment and we have concluded and executed the contract, but the transaction is subject to a chargeback or the debit on the specified means of payment is not successful after the end of the trial period. |
| 176 | 179 | |