Lokalise AI

Lokalise references AI Features governed by an Annex C (AI Addendum) but the addendum text is not provided in the documents. The Privacy Policy mentions using data for 'service improvement' and creating 'new features' but lacks explicit clarity on whether user content trains AI models. The vague language and missing AI Addendum create moderate concern.

“[ToS] 'Your access to and use of any artificial intelligence or machine learning functionalities made available within the Services ("AI Features") is governed by Annex C (the "AI Addendum")' — but Annex C not provided in documents.”

The ToS grants Lokalise a 'non-exclusive license to host, store, process, and display User Content for the purpose of providing the Services' with deletion upon termination. However, the license scope is somewhat broad ('process and display') and the Privacy Policy indicates data may be used for service improvement and feature creation, creating ambiguity about sublicensing and derivative use rights.

“[ToS] 'You grant Lokalise a non-exclusive license to host, store, process, and display User Content for the purpose of providing the Services. Lokalise may delete User Content upon the expiration or termination of your access.'”

Lokalise shares data with 'trusted entities,' 'third-party vendors,' 'corporate affiliates,' and integrations with third-party services. A sub-processor list is published and referenced, but the Privacy Policy states data may be shared with 'partners' and 'affiliates' for 'internal administrative' purposes with somewhat vague controls. Aggregated/anonymized data sharing is permitted.

“[Privacy] 'We share your Personal Data with a limited number of third-party vendors and business partners who process it on our behalf... The updated list of our Sub-processors can be found here https://lokalise.com/sub-processors.'”

The Privacy Policy states data is retained 'no longer than necessary' and deleted 'in accordance with statutory provisions,' with retention periods of 6-10 years for tax/commercial obligations and 3 years for other data. However, the language is vague ('no longer than necessary') and data may be retained after account deactivation for 'legitimate business interests,' creating moderate uncertainty.

“[Privacy] 'We will process and store the User Data no longer than necessary... storage and documentation obligations from commercial and tax laws apply. The retention and documentation periods specified there are six to ten years.'”

The ToS explicitly states that for Authorized Users, User Content 'is and remains the sole property of the Customer' and for Trial Users, content is 'owned by you.' Lokalise claims only a non-exclusive license to provide the service, with no rights to outputs beyond service delivery. This is enterprise-friendly.

“[ToS] 'All data and content submitted by you in your use of the Services ("User Content") is and remains: For Authorized Users: the sole property of the Customer; For Trial Users: owned by you, subject to Lokalise's rights under Section 4.2.'”

The Privacy Policy explicitly states Lokalise 'has received internationally recognized SOC 2 Type 2 security certification' and confirms compliance with GDPR, EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF. A DPA is available for download and a sub-processor list is published, meeting enterprise security standards.

“[Privacy] 'Lokalise has received internationally recognized SOC 2 Type 2 security certification confirming that Lokalise has system and organization controls to safeguard the processing, integrity, confidentiality and security of the User Data.'”