Data processing

Every field, where it goes, how long it stays.

This is the page to hand to a privacy reviewer. It covers the full set of data MCT touches, and the much larger set it does not.

Data inventory

What MCT processes.

One row per data category, including the ones where the answer is simply no.

Data type

What it is

Purpose

Where it goes

Retention

Marketing copy

Subject lines, preheaders, body text, CTAs and static HTML inside the block

Sent to the translation engine to produce per-language versions

MCT backend on your infrastructure, then Google Cloud Translation v2

Held in memory for the duration of the compile request only

Block configuration

Target languages, block prefix, folder names, do-not-translate terms

Controls how the compile runs and where output is written

Stored with the content block inside your Marketing Cloud org

Lives with the block, removed when you delete the block

AMPscript & personalization tokens

%%=v(@field)=%%, IF/ELSE, ContentBlockById and similar

Stashed out before translation, re-injected afterwards

Never leaves your infrastructure, never sent to the translation engine

Not stored

API credentials

SFMC client ID and secret, Google Cloud API key

Authenticating the backend to Marketing Cloud and the translation engine

Managed secret store (Azure Key Vault or host equivalent)

Until you rotate or revoke them

Operational logs

Timestamps, request status, error codes, org identifier

Troubleshooting failed compiles

Your hosting platform's log store

Controlled by your host's log retention settings

Subscriber data

Email addresses, contact records, Data Extension rows, send logs

Not applicable

Never received by MCT

Not applicable

Sub-processors

Who else can see anything.

A short list, because the architecture keeps it short.

Google Cloud Translation v2

Purpose: Machine translation of extracted copy chunks
Data involved: Marketing copy only, with code stashed out
Region: Google Cloud region selected for your project

Microsoft Azure (App Service, Key Vault)

Purpose: Default hosting and secret storage
Data involved: Runtime processing and credentials
Region: The Azure region you deploy into

Salesforce Marketing Cloud

Purpose: Your own org, the source and destination of all content
Data involved: All of your content and subscriber data
Region: Your existing SFMC tenant region

We notify licensed customers by email before adding a sub-processor that would handle marketing copy.

Residency

You pick the region.

Because you deploy the backend, data residency follows your own deployment choices rather than ours.

Backend region

Whichever Azure region, CloudPages tenant or PHP host you deploy into. EU-only deployments are common and fully supported.

Translation region

Determined by the Google Cloud project you connect. You can use your own existing Google Cloud contract and region settings.

Content at rest

Compiled blocks and the switch email live only in your Marketing Cloud org, in whatever region your SFMC tenant already uses.

Requests

Export, deletion and access.

Deletion

Delete the generated content blocks and the switch email in Content Builder, and the output is gone. There is no external copy for us to purge because the backend does not retain your emails.

Export

Compile output is standard Content Builder content. Export it with the same tools you already use for any other block.

Data subject requests

MCT holds no personal data about your subscribers, so subscriber-level requests are handled entirely inside Marketing Cloud. If you need written confirmation of that for a regulator, we will provide it.

DPA

A data processing agreement is available on request for the translation processing described above. Email legal@genetrix.tech.

Need this in your own template?

Send us your vendor questionnaire or security addendum and we will complete it against the facts on this page. Contact privacy@genetrix.tech.

Back to the trust center

Clear answers beat vague reassurance.

Book a call and bring your privacy reviewer along.

Book a demo