Data protection
This page is for the people who must approve the extension: your data protection officer, and the Shopware store review.
INFO
This page describes the behaviour of the software. It is not legal advice. The obligations that follow from it stay with you.
What the extension transmits
You can start a translation by hand, through automation or from the CLI. In each case the extension sends these items to the provider that you selected for that run:
- the content that you selected for translation (for example product names and descriptions, category texts, CMS texts, mail-template bodies, snippet values, translatable custom fields),
- the translation instructions in effect: the tone, your custom instructions and the applicable glossary terms,
- the source locale and the target locale.
Some other operations contact a provider without shop content:
| Operation | What the extension sends |
|---|---|
| Test connection in Settings → Providers | the API key only |
| A refresh of the Model list | the API key only |
The preview route of the Admin API, which has no Administration screen and accepts calls from an API client only | the sample text in the request body, and the tone and the instructions |
| The status and the credit balance of modernice All-in-One | the signed entitlement token and your shop domain, and no content |
What the extension does not transmit
The extension does not select order entities or customer entities for translation. Orders, customer accounts, addresses, payment data and carts are not among the content types that it can translate. Supported content gives the full list of what it can reach.
Until you activate modernice All-in-One, the extension sends no request to modernice at all. It contacts only the providers whose keys you configured. With an active subscription, it reads the status and the credit balance so that the Administration can show them. That request carries the entitlement token and the shop domain, and never shop content.
WARNING
Catalogue, CMS, mail-template, snippet and custom-field content can itself contain personal or confidential data: a testimonial with a customer name, an internal note in a custom field, a mail template with support contact details, an unpublished campaign text. The extension cannot detect that data. Examine the content that you select before a run. Use Settings → Advanced → Excluded fields for the fields that the extension must never send.
Where requests go
The extension sends data only through the provider path that you select, and only when you start a translation or enable automation.
| Service | Service operator | Data is sent only when |
|---|---|---|
| DeepL API | DeepL SE, Cologne, Germany | DeepL is the selected provider |
| Google Cloud Translation API | Google LLC, USA | Google Translate is the selected provider |
| Google Gemini API | Google LLC, USA | Google Gemini is the selected provider |
| OpenAI API | OpenAI LLC, USA | OpenAI (ChatGPT) is the selected provider |
| Anthropic API | Anthropic PBC, USA | Anthropic Claude is the selected provider |
| Mistral AI API | Mistral AI SAS, Paris, France | Mistral is the selected provider |
| modernice translation service | MODERNICE LIMITED | modernice All-in-One is the selected provider |
A provider that you did not configure and did not select receives nothing. You can also assign a provider to each target language under Settings → Providers → Providers by target language. Examine that mapping and the default provider when you document which services you use.
Own API keys
With your own API keys, the extension sends the requests directly from your server to the provider, under your own contract with that provider. The terms of the provider, its retention settings and your data-processing agreement with it apply, unchanged and in full. modernice is not part of that request path and receives nothing.
Select this mode when you already have a signed agreement with a specific provider. Select it also when your policy requires you to control the retention settings at the provider yourself.
modernice All-in-One
With modernice All-in-One, the requests go through MODERNICE LIMITED to a reviewed pool of providers and models. You select a service tier (Speed, Balanced or Premium quality), and modernice selects which provider from that pool serves each request.
- Authentication. Each request carries your shop domain and the signed Shopware In-App-Purchase token that proves the subscription. It also carries the extension version and request identifiers that hold no content.
- Content handling. The service processes the ordinary request content and response content in memory. It encrypts a successful response and retains it for a reliable idempotent retry, for up to 24 hours by default, then deletes it.
- Retained metadata. The service can keep the billing metadata and the operational metadata for longer, and this metadata holds no content: normalised or hashed tenant identity, entitlement period, character and credit counts, tier, provider and model, registry versions, token counts, provider cost, error class, request identifiers and timestamps.
- Not logged. The service writes no authorisation tokens, no source text, no translated text, no prompt text and no glossary values to its logs.
The managed data-processing disclosure that comes with the extension explains these data categories. The executed modernice DPA and the current subprocessor notice stay authoritative. They identify the operators, the processing locations, the international-transfer mechanisms and the change-notification process. Do not infer those items from this documentation.
What the extension stores inside your shop
Everything below is in your own database.
| Stored data | Contains shop content? | Notes |
|---|---|---|
| Translation history | Yes, the previous value and the new value of each translated field | The rollback mechanism. See the retention rules below |
| Translation jobs | The configuration, the provider, the counters, the characters, the cost or credits, the timestamps | Also the id of the Administration user who started the job |
| Job errors | The entity type, the record id, a display label and the error message | Up to 500 rows per job |
| Glossary | Your terms and their forced translations | |
| Usage figures | The characters, tokens, requests and calculated cost, per provider and month | No content |
| Change fingerprints | Hashes of the source value and the written target value | Hashes only, and no text |
| Settings | Including the provider API keys | Stored in the system configuration of Shopware |
The extension writes the translated content itself into the native translation tables of Shopware, where your normal backup, retention and access rules already apply.
Retention and deletion
- Translation history. The extension keeps it for the Retention period (days) that you configure under Settings → Advanced → Translation history. The default is 30 days, and you can change it. The extension deletes the older entries automatically, also when the recording is off. The cleanup goes through the hourly scheduled task of the extension, therefore the scheduled-task runner must be active for the deletion.
- You can stop the recording completely with Record translation history, if your retention policy does not permit stored copies of content. In exchange you lose the guarded revert and re-apply path. See Translation history.
- On uninstall. If you do not keep the user data, the extension drops its own tables: jobs, errors, history, glossary, usage and fingerprints. It also deletes each
NiceTranslate.*entry from the system configuration, which includes the stored API keys. The uninstall never deletes the native Shopware translations.
What to add to your privacy policy
Work through this checklist once, and read it again each time that you change providers:
- Name the processing. AI-assisted translation of shop content, which staff start by hand, or which starts automatically after a save or on a schedule.
- List the recipients that you actually use. Take the rows from Where requests go that agree with your configuration. Keep the operator and the country. Examine the per-language assignments as well. Delete the rows that you do not use.
- State the data categories. The shop content that you select for translation, the translation instructions, and the source and target locale. State explicitly that the extension selects no order records and no customer records.
- Cover the personal data inside the content. If your product texts, CMS pages, mail templates, snippets or custom fields can contain personal data, say so. Most privacy statements miss this category.
- Document your transfer mechanism for the providers outside the EU and the EEA (Google LLC, OpenAI LLC, Anthropic PBC), from your own contract with them.
- For own-key mode, state that the requests go directly from your server to the provider under your contract. The terms, the retention and the DPA of that provider therefore apply.
- For managed mode, name MODERNICE LIMITED as the processor. Reference the executed DPA and the current subprocessor notice. Describe two more items: the encrypted retention of a successful response for up to 24 hours, and the retained usage metadata that holds no content.
- State your history retention. Give the configured retention period for the translation history, because those rows contain copies of shop content.
- Record which mode you enabled. One shop can have both modes active at the same time. Your documentation must agree with the provider assignment that you configured.