Data Security 5 August 2026
What Do the Terms of Use of Free Translation Services Say?
The terms of use of free translation tools, which almost nobody reads, grant the provider a worldwide licence over the text you upload. We work through the clauses one by one.
Free translation services process billions of words a day. Only a very small fraction of users have read the terms of use they accepted. This article looks at what those terms actually say, clause by clause, with a lawyer’s reading.
Contents
What the clause says and what it means
In his study of the broad licensing terms used by online services, the legal scholar Miloš Novović cites the following clause from a major provider’s 2016 terms as an example:
When you upload, submit, store or receive content to our Services, you grant us (and those we work with) a worldwide licence to use, host, store, reproduce, modify, create derivative works (such as those arising from translations), transmit, publish, publicly display and distribute this content.
Novović, M. (2017), p. 202
| Wording | What it means in practice |
|---|---|
| “worldwide licence” | The content may be used without any statement of which country’s servers will process it |
| “and those we work with” | The right is not confined to the provider; it extends to its business partners |
| “store” | The text does not have to be deleted once it has been processed |
| “create derivative works” | New content may be produced from the text |
| “reproduce, distribute” | It may be copied and passed on |
Most of these clauses are necessary for the service to work at all: translating a text means transmitting it, processing it and storing it temporarily. The problem is not that the clauses exist but that their scope is wider than technical necessity requires and that they carry no time limit.
What does “improving our services” mean?
This phrase, which appears often in terms of use, is the vaguest part of them from a data protection point of view. For a translation system, improving means learning from the texts it works on. Whether the text you upload is used to train the system is not stated explicitly in most free products.
The critical distinction here is this: the free product and the corporate product are not governed by the same policy. The same company’s corporate API or subscription plan may undertake not to retain data and not to use it for training, whereas the free web interface gives no such undertaking. Because the two products share a name and a similar interface, users do not see the difference between them.
Which documents carry a real risk?
Not every text carries the same risk. There is a categorical difference between having a news article translated and having a draft contract translated.
- Documents containing personal data. Identity cards, passports, civil registry records, criminal records, diplomas, payslips, personnel files.
- Special categories of data. Medical reports, discharge summaries, test results. These are protected separately and more strictly under the KVKK.
- Commercial documents subject to a confidentiality obligation. Draft contracts, price lists, technical specifications, customer lists.
- Patent application texts. The risk here is of a particular kind: an invention disclosed to the public before the application is filed may lose the novelty criterion. What is lost is not a breach of confidentiality but the registration right in its entirety.
- Documents subject to professional secrecy. Lawyer-client correspondence, patient files.
The “I only use it to understand” defence
The translation literature distinguishes gist translation, which aims at a rough sense of the content, from publication-ready translation. If your purpose really is only to understand, a free tool is a reasonable choice, but only where the document is not confidential.
That is because what creates the risk is not how the translation will be used but the act of uploading itself. The transfer takes place the moment the text is sent; saying afterwards, “I was never going to publish this,” does not undo it.
Why are the free version and the corporate version different?
In the user’s eyes, a brand’s free web interface and its corporate API are the same product: the same logo, comparable output quality. In law they are governed by two separate contracts, and the difference between them matters.
The reason lies in the business model. With the free product the user pays nothing; what the provider gets in return is the right to use the data to improve the service. With the paid product a payment is made and the provider is able to sell an undertaking not to retain the data. That undertaking is a precondition for winning corporate customers.
| Comparison | Free interface | Corporate plan |
|---|---|---|
| Data retention undertaking | Usually absent | May appear in the contract |
| Use for training | Not expressly excluded | Usually excluded |
| Data processing agreement | None | Can be signed |
| Choice of server location | None | Available with some providers |
| Audit and access logs | None | Possible |
The table shows the general tendency; what governs in each case is the provider’s own contract. The lesson to draw, however, is constant: the sentence “we use such-and-such a tool” is not an assurance. The question to ask is which product is being used, on which plan and under which contract.
Let us follow one case step by step
Imagine a medium-sized manufacturing company. The Turkish draft of a supply contract to be signed with a customer abroad is ready, and the legal department wants to see the English text. The process runs like this:
- The contract specialist pastes the draft into a free translation interface. The text contains the parties’ trade names, price tiers and penalty clauses.
- They copy the output into Word and send it to the legal department.
- The legal department corrects the text and the final contract is signed.
- In everyone’s eyes the process has been completed successfully.
Three separate problems arose here, and not one of them was noticed:
- A trade secret was transferred. Price tiers are among the information a company most needs to protect.
- The other party’s data was transferred. The counterparty to the contract had not agreed that its own information would be sent to a third system. This can amount to a contractual breach towards your own customer.
- No record was kept. If a problem were to arise, there is no trace to prove that a transfer took place or to establish its scope.
The point to note is this: in this scenario nobody broke a rule, because there was no rule. The responsibility rests with the organisation that failed to set one.
The safe answer to the same need is simple: a translation sent to a provider bound by a confidentiality undertaking, with machine translation switched off and a record kept. The difference in time is a few hours; the difference in risk cannot be measured.
How should this be explained to staff?
Most corporate policies written on this subject do not work, because they start from the wrong assumption: they assume that the employee will read the rule and remember it. In reality the employee decides within seconds, in the middle of trying to finish a job.
A policy that works has three features: it is short, it gives examples and it offers an alternative.
It must be short
A rule that runs beyond a single page will not be read. The aim is not legal perfection but being remembered at the moment of decision. A three-line rule produces more compliance than a twelve-clause directive.
It must give examples
The sentence “documents containing confidential information must not be uploaded” is abstract; not everyone treats their own document as confidential. What should be written instead are the names of the documents the organisation actually produces: “customer contracts, price lists, personnel files, patient reports, technical specifications.”
It must offer an alternative
This is the item most often left out. Imposing a ban without showing an alternative pushes the employee into breaking the rule quietly, because the work still has to be finished. Alongside the policy there should be a line saying, “send these documents to this address and they come back the same day”.
The template below can be used directly in most organisations:
Permitted: Texts that are already public: press releases, website content, published reports, general correspondence. You may use online tools for these.
Prohibited: Customer contracts, price and cost information, personnel files, medical documents, patent and R&D documents, litigation files. These are not uploaded to any online translation tool.
What to do: For documents on the prohibited list, raise a request through [translation request address]. Standard delivery is 1 working day; for urgent needs speak to [contact point].
The most important feature of this rule is that the third paragraph exists at all. Many organisations have the first two; the rule goes unapplied precisely because the third is missing.
Once the rule is written, the second step is to make it visible: add it to the induction of new staff and repeat it once a year. An email sent once and then forgotten does not count as a policy.
Two common objections
“Our documents are not that important.” That assessment is made not by the person sending the document but by whoever gets hold of the information. A price list is routine for you and strategic for your competitor. The test is not how important the document looks to you, but who stands to gain once it is outside.
“Everyone uses them and I have never heard of a problem.” Most of the leaks caused by these tools are never noticed at all; the data is processed quietly and no alarm goes off. A problem being invisible does not mean it does not exist; it only means it has not been measured.
The Türkiye context
Most of these tools keep their servers outside Türkiye. Uploading a document containing personal data to such a tool therefore amounts to a transfer of data abroad for KVKK purposes. Since the 2024 amendment the rules in this area have tightened; for regular transfers, explicit consent on its own is no longer treated as a sufficient basis.
The scenario seen most often in practice is this: an employee pastes a customer contract into a free tool to get the work done faster. The company knows nothing about it and has no policy in place. The responsibility nevertheless rests with the company in its capacity as data controller.
What does this mean for you?
Banning free tools does not work in most organisations; employees carry on doing their jobs, they simply become invisible. The more effective approach is classification:
- Write a one-page rule. Which document types are permitted and which are prohibited: clear and short.
- Show the safe alternative. A ban without an alternative leaves the rule useless.
- Consider corporate plans. For high-volume work that is not confidential, paid plans with a data undertaking are a reasonable middle way.
- Set up a closed-circuit process for confidential documents. Machine translation switched off, the process kept inside the country, the retention period set by contract.
We can work out this distinction for your organisation together. Look at our translation services or get in touch directly.
Frequently asked questions
Is the text I paste into Google Translate stored?
The free versions carry no clear undertaking about the retention period. The terms of use state that content may be used for the purpose of improving the services. Unless the contrary is written explicitly, it is not safe to assume that nothing is stored.
Are the corporate (paid) versions different?
Generally yes. Corporate APIs and subscription plans may include undertakings not to retain data and not to use it for training. Those undertakings vary from plan to plan, though; do not assume them without reading the contract.
Is it a problem if I only translate one sentence?
It depends on what the sentence contains. A single sentence with a name, an address, the name of an illness or a contract clause in it can carry personal data or a trade secret just as well. The test is content, not length.
How should I manage the use of these tools in my company?
Rather than banning them, set a rule based on classification: define on a single page which document types are permitted and which are prohibited, and show staff the safe alternative.
Sources
- Novović, M. (2017). User-Generated Content: How Broad Licensing Terms Threaten the Web. In: Taddeo & Floridi (eds.), The Responsibilities of Online Service Providers. Springer, pp. 201–217.
- Pietrzak, P. & Kornacki, M. (2021). Using CAT Tools in Freelance Translation. Routledge, pp. 24–25.
This article is for general information and is not legal advice; for the terms currently in force, check official sources and, where necessary, a legal adviser.