# Confidentiality, NDAs and AI in Translation: What I Check Before I Paste Source: https://traduq.com/blog/translation-confidentiality-nda-ai · Updated November 7, 2026 ## Key takeaways - Most translation NDAs say three things, don't share the files, don't pass them to third parties and delete them on time. Pasting a client's text into an online AI or MT tool can break all three. - Free and paid tiers differ. DeepL's privacy policy says Free texts can be used to train its models and Pro texts can't; Google and Microsoft say the same of their translation APIs. - Health data, personal data and unpublished patents need more care. HIPAA expects a business associate agreement, GDPR a processor contract, and a patent can lose novelty once disclosed. - Matecat's terms describe your segments, public or private, as contributed to MyMemory, whose terms let Translated use them to improve its services and license them to partners, MT included. - Read the NDA, ask before using any tool, use the client's channel, delete on schedule and put your AI policy in writing. What translation NDAs usually say, what ChatGPT, DeepL, Google Translate and other tools do with your text, and when AI is off limits. I've translated between English and Spanish for years, and I've signed a lot of NDAs. They differ in length and tone, but most of them ask for the same few things. Don't share the files. Don't give them to third parties. Delete them after a set period. One client goes further: files come and go through Box, and nowhere else. Others say plainly that no AI may touch their content, because it includes patients' health information. None of that is unusual. What changed is how easy it has become to break those rules without noticing. Select, copy, paste into a chatbot, and the text is on someone else's server. This post is what I check before I do that, and why some texts never go near an AI tool. Policies change, so I checked every page linked here on 7 November 2026 (see Sources at the end). ## What an NDA really asks of you An NDA doesn't need to mention AI to forbid it. If it says you may not disclose the material to third parties, then the company that runs the chatbot or the MT engine is a third party. Its servers receive the text, store it for some time, and in some cases use it to improve their models. "Delete the files after 30 days" has the same problem. You can delete your copy. You can't delete the copy on a server you don't control, and you often don't know how long it stays there. The American Translators Association says it directly in its [2025 statement on AI](https://atanet.org/advocacy-outreach/ata-statement-on-artificial-intelligence/): AI tools "may store, process, or even repurpose the data", which "can lead to breaches of confidentiality agreements and violations of data protection laws". Its [Code of Ethics](https://www.atanet.org/about-us/code-of-ethics/) and the [ITI](https://www.iti.org.uk/about-iti/professional-standards/code-of-professional-conduct.html) and [CIOL](https://www.ciol.org.uk/code) codes already require us to keep client information confidential. This isn't theory. In 2017, Norway's NRK reported that Statoil contracts and dismissal letters were [findable online](https://qz.com/1075524/if-you-value-your-privacy-be-careful-with-online-translation-tools) because staff had used the free site Translate.com. In 2023, Samsung [restricted generative AI](https://www.cnbc.com/2023/05/02/samsung-bans-use-of-ai-like-chatgpt-for-staff-after-misuse-of-chatbot.html) on company computers after staff uploaded sensitive code to ChatGPT. ## What the common tools do with your text The free consumer product and the paid business or API product of the same company often follow different rules. Here's what each company's own pages say. **ChatGPT.** OpenAI's [Data Controls FAQ](https://help.openai.com/en/articles/7730893-data-controls-faq) says personal Free, Plus and Pro accounts can be used for training unless you turn off the option in Settings → Data Controls that lets OpenAI use your chats to improve its models. Business, Enterprise and Edu workspaces are excluded by default. Its [API data page](https://developers.openai.com/api/docs/guides/your-data) says API data "is not used to train or improve OpenAI models" unless you opt in, and abuse-monitoring logs are kept for up to 30 days. **DeepL.** The [privacy policy](https://www.deepl.com/en/privacy) says that with the free translator, DeepL processes your texts "for a limited period of time" to "train and improve our neural networks". With Pro and the API, texts "will be deleted" and "will not be used to improve the quality of our services". **Google Translate.** For the [Cloud Translation API](https://docs.cloud.google.com/translate/data-usage), Google says it "does not use the content you send to train and improve our Google Translation features" and holds it "briefly in-memory". For the free translate.google.com, I didn't find a statement either way. The [privacy policy](https://policies.google.com/privacy) only says Translate works by "detecting common language patterns in phrases you ask it to translate". **Microsoft Translator.** The [Azure Translator documentation](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/translator/data-privacy-security) says it "doesn't persist customer data submitted for translation". Microsoft's [No Trace page](https://www.microsoft.com/en-us/translator/business/notrace/) says that with the free apps, Translator for Bing and Edge, "text translations are recorded for service improvements purposes". **Gemini and Claude.** Google's [Gemini privacy hub](https://support.google.com/gemini/answer/13594961) says some chats are read by human reviewers and kept for up to three years, and chats are kept for 72 hours even with activity off. Anthropic [lets consumer users choose](https://www.anthropic.com/news/updates-to-our-consumer-terms) whether chats train Claude: if you allow it, data is kept up to five years, otherwise 30 days. Work plans and the API aren't covered by that change. A paid tier isn't automatically fine for client work. It just has terms you can show the client, and the client still decides. ## Texts that should never go near a cloud AI Some texts can go through AI without any problem: a public product page, a press release that's already out, my own blog posts. Others can't, and the reason is usually the law, not the client's mood. **Health information.** In the US, a hospital or insurer can share protected health information with a vendor only with a [business associate agreement](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), a contract in which the vendor promises to safeguard it. HHS says even a [cloud provider](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) that stores only encrypted data is a business associate. If my client has a BAA with its translation vendor and I paste the file into a free chatbot, the chatbot has no BAA with anyone. That's why my medical clients forbid AI, and I think they're right. **Personal data in Europe.** Under the GDPR, a company that has someone process personal data on its behalf must use processors with "sufficient guarantees" and a written contract ([Article 28](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679)). A processor "shall not engage another processor without prior specific or general written authorisation". If I'm the processor, an AI service I add on my own is another processor nobody authorized. **Patents.** This is the clearest case for me. A patent application has to be new. Under the European Patent Convention, the state of the art is everything "made available to the public" before the filing date ([Article 54](https://www.epo.org/en/legal/epc/2020/a54.html)). The EPO guidelines say a disclosure under a secrecy agreement that hasn't been broken doesn't count ([G-IV 7.2.2](https://www.epo.org/en/legal/guidelines-epc/2026/g_iv_7_2_2.html)). That's exactly why patent work comes with an NDA. The US has a one-year grace period for the inventor's own disclosures ([MPEP 2152](https://www.uspto.gov/web/offices/pac/mpep/s2152.html)), but that doesn't cover a leak through a translator. The USPTO itself [warned practitioners](https://www.govinfo.gov/content/pkg/FR-2024-04-11/html/2024-07629.htm) in 2024 that "AI systems may retain the information that is entered by users", and that if confidential information is used to train AI, parts of it "may filter into outputs from the AI system provided to others". An unpublished invention, pasted into a tool that trains on it, could end up shaping someone else's answer. I don't do that, and no client has ever asked me to. ## Your work as someone else's training data This one is personal. I don't like the idea of a platform taking translators' work, training its MT or AI on it, and then selling that product back to us at a price. It's my opinion, not a legal point, and it's why I read the terms of every platform I use. Matecat is the one I've thought about most. When I used it, Matecat machine-translated the text and I post-edited the segments. Translated, the company behind it, also sells its own MT: ModernMT, now [turning into Lara](https://modernmt.com/privacy). So I'd want to know whether my corrections end up improving the engine they sell back to us. I don't know that they do. Here's what their pages say: - Matecat's [terms](https://site.matecat.com/terms/) say it keeps "any translation submitted, whether it's public or private" on a long-term basis, and describe the segments you send, public or private, as "contributed to MyMemory", Translated's translation memory service. - If no private TM with "Update" checked is attached, ["all translations are automatically saved inside the public memory"](https://guides.matecat.com/activ), which [all Matecat users](https://guides.matecat.com/public-tm-and-translation-memory-key-tm-key) see as suggestions. A private TM key keeps them out of other users' matches. - But MyMemory's [terms](https://mymemory.translated.net/terms-and-conditions) say contributions, "whether they are 'Public Data' or 'Private Data'", are used "to create statistics, set up new services and improve existing ones", and that Translated can give partners a license over them "to improve the quality of our and/or 3rd parties' services (eg. machine translation suggestions, glossaries, language models, spell checkers...)". - Matecat's [default MT is ModernMT](https://guides.matecat.com/default-machine-translation-engine), which "learns from translation memories and post-editing" ([Matecat guide](https://guides.matecat.com/modernmt-mmt-plug-in)), and pre-translation with it is [on by default](https://guides.matecat.com/machine-translation-engines). I found no page that says whether those corrections adapt only your own memories or also the general model. ModernMT's [privacy policy](https://modernmt.com/privacy) covers personal data and doesn't address it. - Lara is clearer. In Learning Mode, texts "may be securely stored and used to improve Lara's translation models", and Incognito Mode prevents that ([Lara help](https://support.laratranslate.com/en/how-learning-mode-incognito-mode-and-customer-assets-affect-model-training)). So their terms allow it for MyMemory, and I found nothing that rules it out for ModernMT. If you use Matecat for confidential files, ask the client first, attach a private TM key and check the MT settings before you open the first segment. The other platforms I checked: - **Smartcat**: its [terms](https://www.smartcat.com/terms/) give it a license to "use, reproduce, modify, process" users' content "exclusively for the purpose of maintaining and enhancing the functionality of the Platform features". They don't mention AI training. If that matters to you, check its customer and supplier agreements, or ask. - **Smartling** says in a [December 2025 post](https://www.smartling.com/blog/smartling-iso-27001) that it has a policy of "never training AI models on customer content". Custom MT training on a customer's own memories is a separate, opt-in service. - **wxrks**: its [privacy notice](https://wxrks.com/privacy-policy) says "Customer Content is not used to train artificial intelligence models, ours or a provider's". So the picture is mixed, and it changes. Read the current terms, and if they're vague, ask the company in writing. ## What I actually do - **Read the NDA before the job,** not after. Look for "third parties", "subcontractors", "retention" and "deletion". - **Ask when in doubt.** A short email, "May I use machine translation or AI on this project?", takes a minute and protects both of us. Keep the answer. - **Prefer tools that don't keep or train on the text:** a paid or API tier with no-training terms, or a tool that runs on your own computer. - **Use the client's channel.** If the client says Box, it's Box, not email or WeTransfer. - **Delete on schedule,** including copies in your downloads folder, your email and your CAT tool's project folders. - **Keep personal data and health information out of consumer AI.** No exceptions. - **Patents:** no cloud AI or online MT unless the client approves it in writing. - **Write your AI policy into your terms,** so a client knows before the job what you use and what you don't. This isn't legal advice. If an NDA is unclear, ask the client or a lawyer. ## How TraduQ handles this I built the CAT in TraduQ with these rules in mind. It runs in your browser, keeps your files, memories and glossaries on your computer, and has no machine translation built in, so nothing is sent to an MT engine. TraduQ doesn't sell your data or use it to train AI, and an optional end-to-end encrypted cloud backup is coming. The [Security page](https://traduq.com/security) explains what we can and can't see. ## Sources Pages checked on 7 November 2026: - [ATA: Statement on Artificial Intelligence (May 2025)](https://atanet.org/advocacy-outreach/ata-statement-on-artificial-intelligence/): confidentiality risks of AI tools - [ATA: Code of Ethics and Professional Responsibility](https://www.atanet.org/about-us/code-of-ethics/): confidential information - [ITI: Code of Professional Conduct (2025)](https://www.iti.org.uk/about-iti/professional-standards/code-of-professional-conduct.html): confidentiality, technology and contractual obligations - [CIOL: Code of Professional Conduct](https://www.ciol.org.uk/code): confidentiality, subcontracting - [Quartz: Be careful with online translation tools (2017)](https://qz.com/1075524/if-you-value-your-privacy-be-careful-with-online-translation-tools): Statoil and Translate.com - [CNBC: Samsung bans use of generative AI after misuse (2023)](https://www.cnbc.com/2023/05/02/samsung-bans-use-of-ai-like-chatgpt-for-staff-after-misuse-of-chatbot.html) - [OpenAI: Data Controls FAQ](https://help.openai.com/en/articles/7730893-data-controls-faq): training setting for personal and business accounts - [OpenAI: Your data (API)](https://developers.openai.com/api/docs/guides/your-data): API training and retention - [DeepL: Privacy policy](https://www.deepl.com/en/privacy): Free vs Pro and API - [Google Cloud: Cloud Translation data usage](https://docs.cloud.google.com/translate/data-usage) - [Google: Privacy policy](https://policies.google.com/privacy): Google Translate - [Microsoft: Azure Translator data, privacy and security](https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/translator/data-privacy-security) - [Microsoft Translator: No Trace](https://www.microsoft.com/en-us/translator/business/notrace/): free consumer products - [Google: Gemini Apps Privacy Hub](https://support.google.com/gemini/answer/13594961): human review, retention - [Anthropic: Updates to consumer terms (2025)](https://www.anthropic.com/news/updates-to-our-consumer-terms) - [HHS: Business associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) - [HHS: Guidance on HIPAA and cloud computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) - [GDPR, Regulation (EU) 2016/679 (EUR-Lex)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679): Article 28, processors - [EPC Article 54: Novelty](https://www.epo.org/en/legal/epc/2020/a54.html) - [EPO Guidelines G-IV 7.2.2: Agreement on secrecy](https://www.epo.org/en/legal/guidelines-epc/2026/g_iv_7_2_2.html) - [USPTO MPEP 2152: Prior art and exceptions under 35 U.S.C. 102](https://www.uspto.gov/web/offices/pac/mpep/s2152.html) - [USPTO: Guidance on use of AI-based tools in practice before the USPTO (Federal Register, April 2024)](https://www.govinfo.gov/content/pkg/FR-2024-04-11/html/2024-07629.htm) - [Matecat guide: Activating private resources](https://guides.matecat.com/activ) and [Public TM and TM keys](https://guides.matecat.com/public-tm-and-translation-memory-key-tm-key) - [Matecat: Terms of use](https://site.matecat.com/terms/): long-term storage, public and private data, MyMemory - [MyMemory: Terms and conditions](https://mymemory.translated.net/terms-and-conditions): use and licensing of contributions - [Matecat guide: Default machine translation engine](https://guides.matecat.com/default-machine-translation-engine), [ModernMT plug-in](https://guides.matecat.com/modernmt-mmt-plug-in) and [Machine translation engines](https://guides.matecat.com/machine-translation-engines): ModernMT, adaptation, pre-translation - [ModernMT: Privacy policy](https://modernmt.com/privacy): personal data, transition to Lara - [Lara: Learning Mode, Incognito Mode and model training](https://support.laratranslate.com/en/how-learning-mode-incognito-mode-and-customer-assets-affect-model-training) - [Smartcat: Terms of Service (September 2026)](https://www.smartcat.com/terms/): content license - [Smartling: ISO 27001 (December 2025)](https://www.smartling.com/blog/smartling-iso-27001): AI training policy - [wxrks: Privacy notice](https://wxrks.com/privacy-policy): customer content and AI training ## Related posts - [The Death of Per-Word Pricing? How AI Is Changing What Translators Charge For](https://traduq.com/blog/death-of-per-word-pricing) — Why a per-word rate fits AI-assisted translation badly, which pricing models are showing up instead, what each one gets wrong, and what I'd ask for as a translator. - [Translation Rates 2026: Per Word, Per Hour & Budget Guide](https://traduq.com/blog/translation-rates-guide) — Typical translation rates per word, hour, page and 1,000 words by language pair, what public surveys say, and how to budget a translation project, with a worked example. - [Free CAT Tools in 2026: What Each One Can Actually Do](https://traduq.com/blog/free-cat-tools) — The free CAT tools that still exist in 2026: OmegaT, MateCat, CafeTran's free mode and TraduQ's browser editor. Plus the once-free tools you now pay for.