Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-18
1. What this policy covers
Karelia Translate ("the Extension") is an extension for Flarum 2 forums. It detects the language of each post and lets readers translate posts and discussion titles into their own language, using a translation service that the forum's administrator chooses. This policy explains what personal data the Extension handles and what we, the provider, do and do not receive.
2. The short version
- The Extension runs on the forum's own server. It never contacts us, sends no usage data, analytics or telemetry, and has no account with us.
- We cannot read anything the Extension stores. We do not receive posts, titles, user names, email addresses or API keys.
- When a reader asks for a translation, the text of that post is sent to the translation service the administrator has chosen, with the administrator's own key. With a local model or a self-hosted LibreTranslate server, nothing leaves the forum's server.
3. Data handled by the Extension on the forum's server
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Language of each post | A language code such as sv | Show the translate link only on posts in another language | The forum's database (posts table) | As long as the post exists |
| Saved translations | Post id, source and target language, a hash of the original text, the service used, the translated title and text, number of characters, time | Show a translation again without asking the service | The forum's database (karelialabs_translations) | Deleted with the post. Replaced when the post is edited and translated again |
| Settings | The chosen service, address, model, limits, glossary, and the API key unless it is set as an environment variable | Run the Extension | The forum's settings table | Until an administrator changes or removes them |
| Monthly usage | The current month and the number of characters sent | The monthly character limit | The forum's settings table | Reset every month |
| Hourly counter | A one-way hash of the member's id, or of the guest's IP address, and a count | The limit on new translations per reader per hour | The forum's cache | One hour |
Language detection runs on the forum's server. No text is sent anywhere to detect a language.
4. Data sent to the translation service
Only when a reader asks for a translation, the Extension sends to the chosen service:
- the text of the post, and for the first post of a discussion its title;
- the target language;
- the administrator's API key, to authenticate.
Before sending, code blocks, inline code, web addresses, @mentions and the administrator's "never translate" words are replaced by placeholders. They are not sent, and are put back after translation.
The services the Extension can use are DeepL, Google Cloud Translation, Anthropic, any service with an OpenAI-compatible interface (for example OpenAI, Mistral, Google Gemini, DeepSeek or OpenRouter), a model running on the forum's own server, and LibreTranslate. The administrator chooses one and has their own agreement with it. That service processes the text under its own terms and privacy policy. We have no agreement with these services on the forum's behalf and receive nothing from them.
5. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, forum address and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations, for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Subscriptions: subscriptions and payments are handled by Floxum and its payment provider under Floxum's terms. We receive the information Floxum gives sellers about a subscription, such as the account name, the plan and its status, and payouts for our sales.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
6. Roles and legal basis
For data handled by the Extension on the forum's server, the forum operator decides why and how it is used and is the controller. The translation service the operator chooses processes post text on the operator's behalf, under the operator's agreement with that service. We do not process the forum's personal data: the Extension sends us nothing and we have no access to the forum's server.
For our own data (support requests and subscription records) we are the controller. The legal basis is our contract with you, our legitimate interest in running and supporting the Extension, and legal obligations (bookkeeping).
7. Sub-processors and recipients
We use no sub-processors for forum data, because we receive none. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum. Floxum and its payment provider handle subscriptions and payments under their own terms.
8. International transfers
Forum data stays on the forum's server, except post text that the operator's chosen translation service receives. Where that service processes it is set out in the operator's agreement with the service. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
9. Retention and deletion
- Saved translations are deleted together with their post.
- Disabling the Extension keeps its data. To remove the table of saved translations and the language column, an administrator runs
php flarum migrate:reset --extension=karelialabs-translatebefore removing the Extension. - Settings, including an API key stored in the database, stay in Flarum's settings table until an administrator removes them. Keys set as environment variables are never stored in the database.
- Hourly counters expire after one hour.
10. Security
The Extension checks Flarum's permissions on every request: only groups with the "Translate posts" permission can ask for translations, and only administrators can see the settings or run the connection test. API keys can be kept out of the database in environment variables. Error messages from translation services are shown to administrators without the key.
11. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For data on a forum, please contact the administrator of that forum first, because we have no access to it. For our own data contact support@karelialabs.atlassian.net.
12. Children
The Extension is a tool for forum operators and is not directed at children. Whether children use a forum is decided by its operator.
13. Changes
We will update this policy when the Extension's data handling changes and publish the new version with a new date. Material changes are announced in the changelog.