個人情報保護規制への対応

注釈

ここには、特定の法的管轄区域で Weblate を運営するために必要なさまざまな法的情報を記載しています。これはガイダンスの手段として提供され、正確性または正しさを保証するものではありません。Weblate の使用にあたり、適用されるすべての法律および規制に準拠しているかどうかの確認の責任は、最終的にはお客様にあります。

Tip

Weblate provides features that help organizations operate within privacy frameworks such as GDPR, DPDPA, PIPL, and others. Hosting, legal basis, retention, notices, and compliance responsibilities remain under the deploying organization's control.

This document outlines Weblate features that can support compliance with:

  • EU 一般データ保護規則（GDPR）

  • カリフォルニア州消費者プライバシー法（CCPA）

  • ブラジル一般データ保護法（LGPD）

  • スイス連邦データ保護法（nFADP）

  • カナダ個人情報保護および電子文書法（PIPEDA）

  • インドデジタル個人データ保護法（DPDPA）

  • 中国の個人情報保護法（PIPL）

プライバシーの原則

データの最小化

Weblate processes account and activity data needed to provide translation workflows, authentication, notifications, access control, and auditability. Depending on enabled features, the following personal data can be stored or processed:

  • Account identifiers such as username, full name, primary e-mail address, verified e-mail addresses, and social-authentication associations.

  • Optional profile fields such as public e-mail, website, profile links, location, company, language preferences, and dashboard preferences.

  • Translation activity, suggestions, comments, watched projects, notification settings, and contribution statistics.

  • Operational records such as audit-log entries, IP addresses, user agents, timestamps, and security-related events.

External analytics, crash reporting, remote logging, and avatar providers are optional integrations controlled by the site operator.

データへのアクセスと可搬性

  • Users can download a JSON export of their user data from the Account tab in ユーザー情報; the export format is documented in Weblate user data export.

  • Administrators can export active non-bot user data with dumpuserdata.

  • Project translations and translation files can be exported separately using Weblate's project and file export features.

消去および訂正の権利

  • Users can correct account and profile information from the profile interface.

  • Users can request account removal from the Account tab. The removal flow requires confirmation and then deactivates and anonymizes the account.

  • Account removal clears private profile fields, API tokens, social-auth associations, group memberships, notification subscriptions, watched projects, and user translation memory.

  • Historical project records can remain associated with an anonymized deleted account where needed to preserve translation history and auditability.

データの保存と削除

  • Audit-log retention is configured using AUDITLOG_EXPIRY.

  • Backups, reverse-proxy logs, mail server logs, and database retention are controlled by the site operator.

  • Third-party services receive data only when configured or used by the operator, for example external authentication providers, avatar providers, Matomo, Sentry, remote logging, machine translation services, or repository integrations.

セキュリティと機密性

  • Weblate supports HTTPS deployments and secure cookie settings; operators should configure TLS and trusted proxy headers correctly.

  • Failed sign-ins, permission changes, two-factor changes, account removal requests, and other security events are recorded in the audit log.

  • Optional GELF logging can forward logs to systems such as Graylog.

  • Access control is enforced through users, teams, roles, project access settings, and component permissions.

  • Commit identity privacy can be improved with PRIVATE_COMMIT_EMAIL_OPT_IN, PRIVATE_COMMIT_EMAIL_TEMPLATE, PRIVATE_COMMIT_NAME_OPT_IN, and PRIVATE_COMMIT_NAME_TEMPLATE.

  • Avatar fetching can be disabled with ENABLE_AVATARS; when enabled, avatars are downloaded and cached server-side as described in アバター.

国際的なデータ移送

  • Weblate itself does not require a specific hosting region.

  • Hosting location, backups, e-mail delivery, repository hosting, external authentication, analytics, error reporting, and machine translation services determine where data is processed.

  • Organizations can self-host Weblate in the required jurisdiction, or use a dedicated deployment with suitable infrastructure controls.

規制要件の対応関係

フレームワーク

Supporting Weblate features

GDPR（EU）

Data export, correction, account removal, audit logs, privacy notices, configurable retention, self-hosting

CCPA（カリフォルニア州）

Data access, deletion workflow, user control, no built-in sale of personal data

LGPD（ブラジル）

Transparency, access, correction, deletion workflow, operator-defined legal basis

nFADP（スイス）

Transparency, purpose limitation by configuration, account controls, auditability

PIPEDA（カナダ）

Notice, consent workflow, access, correction, deletion

DPDPA（インド）

Notice, consent workflow, user rights handling, hosting locality controlled by operator

PIPL（中国）

Purpose limitation by configuration, data minimization, self-hosted locality controls

法令順守に向けた推奨事項

  • Notices and consent: Provide privacy, cookie, subcontractor, and terms information through 法務モジュール, and update LEGAL_TOS_DATE when users must accept changed terms.

  • Policy links: Link external privacy and legal documents with PRIVACY_URL and LEGAL_URL when the documents are hosted outside Weblate.

  • Data subject requests: Define an operational process for user-data export, correction, account removal, backup handling, and historical contribution review.

  • Retention: Configure AUDITLOG_EXPIRY and document retention periods for database backups, log aggregation, mail systems, repositories, and external integrations.

  • External services: Review configured authentication providers, avatar providers, analytics, Sentry, GELF logging, machine translation, e-mail, and repository integrations for transfer and processor obligations.

  • Locality: Ensure application hosting, backups, logs, repositories, and external processors are located in permitted jurisdictions.