Privacy Policy

Section 1

Information We Collect Directly From You

When you create an account or purchase a service we collect: account information (name, email, business name, password hash, and a hash of any API token you create), platform credentials for any CMS or commerce platform you ask us to remediate (encrypted at rest with AES-256-GCM and a scrypt-derived key), payment information handled by Stripe (we never see card numbers), and the content of any communications you send us through email, the in-app support form in your dashboard, or the chat on scan and checkout pages.

When you use document and app checks you also give us the files you upload (documents such as PDF and Office files, Android and iPhone app builds, iPhone source archives) and access to any GitHub repository you connect. These can contain personal data about other people, such as names, photos, signatures or customer records. You decide what to upload.

Section 2

Information We Collect Automatically

Scan data: when your website or a lead's website is scanned, we store the HTML of each element that failed a check, the axe-core violation list, keyboard navigation results, AI visual analysis findings on paid scans, screenshots, recorded keyboard-navigation videos, and the accessibility score. When we remediate a site, we also store the original and changed content of each resource we edit. For the EN 301 549 support-services check, the scanner also reads a site's help, contact, documentation and terms pages. From those it keeps the page title, the main heading, the support links it found and yes-or-no signals (for example, whether an email or phone contact is listed); it does not keep their full text. Those pages often list staff names, email addresses and phone numbers.

App checks: when we run your app in our emulator or simulator, we store a screenshot of each screen we reach, together with the findings. Screens can show whatever the app displays, including user data, so please use a test account.

Usage data: pages you visit on remediada.com, dashboard actions, and feature usage. Technical data: IP address, user agent, browser, device, approximate location, and timestamps. Email engagement: when you open an email we sent, a small tracking image records the open, and when you click a link in it, our server records the click before it sends you on. Both record the time and your browser's user agent. Our email provider reports delivery, bounces and complaints.

Section 3

Information From Third Parties

Business listings from the Google Places API, and from the Yelp Fusion and Foursquare Places APIs when we have an account key for them (business name, address, phone, website and, from Foursquare, a published email address). Foursquare is then one of the default sources in our lead searches. Public business listing pages on Google Maps, Yelp, Yellow Pages and BBB, which we read directly. Public map data from OpenStreetMap, through its Nominatim and Overpass services. Business lists we import, such as public directories and government open-data lists. Court filings from CourtListener: the case name, court, filing date and the names of the parties to ADA website lawsuits, including named plaintiffs. Contact addresses a business publishes on its own website. Validation results from ZeroBounce, when enabled, on whether a business email address can receive mail. Payment data from Stripe (masked card details, transaction status, dispute and chargeback notifications). Email engagement from Resend (delivery status, bounce and complaint signals). On our own site we record one page view, with a one-way hash of your IP address, when you open a link we sent you and, only if you allow the referral cookies, the pages you view, the buttons you click, when you view pricing or start a checkout, how far you scroll and how long you stay (Section 13). We collect these ourselves and never sell or share them.

Section 4

How We Use Information, and Our Legal Bases

We use the information above for the purposes in this table. For people in the European Economic Area, the United Kingdom and Switzerland, the right column is the legal basis under Article 6 of the GDPR (and the UK GDPR) that we rely on.

Where we rely on legitimate interests you can object at any time (Section 10). We do not use your data for automated decisions that have legal or similarly significant effects on you.

Section 5

Our Role: Controller and Processor

For content you give us to check or fix (your website pages, documents, app builds, app screenshots, source code, and any personal data inside them) we act as your processor. We process it only to provide the Service and on your instructions, and you are the controller. Our Data Processing Agreement sets out those terms under Article 28 of the GDPR and is available to every customer.

For your account, billing, support messages, our own website analytics and our lead generation, we are the controller and this policy applies directly.

Section 6

Information Sharing and Sub-processors

We share information only with the service providers listed on our sub-processors page, each for the purpose and with the data shown there, and with law enforcement or government authorities when legally compelled by a valid subpoena or court order. We do not sell personal information to advertisers or data brokers.

What goes to Anthropic. We use the Anthropic API for AI analysis and fix writing. It receives:

• page HTML snippets with their context, element images, page screenshots on paid scans and violation text from website scans;
• images from your documents that lack a text alternative, with the document text around each image, so it can write alt text. Documents can contain personal data, and so can these images and that text;
• screenshots of your app's screens from runtime checks, for visual analysis, and excerpts of your app source code when a control needs an accessible name;
• page URLs, titles, descriptions and a summary of the page text, to write SEO fixes;
• the change requests you type in your review queue, with the fix they refer to;
• messages typed into the chat on scan and checkout pages;
• replies from businesses we emailed, so it can draft an answer that a person reviews and sends.

Under Anthropic's commercial terms, Anthropic may not train models on the content we send through its API. It keeps inputs and outputs for a limited period under those terms.

Section 7

Lead Generation Practices

RemediADA collects business information from publicly available sources (the Google Places API; Yelp Fusion and Foursquare Places when we have an account key for them, and Foursquare is then used by default in our lead searches; public business listing pages on Google Maps, Yelp, Yellow Pages and BBB; OpenStreetMap map data; business lists we import, such as public directories and government open-data lists; public court records of ADA website lawsuits from CourtListener; and the business's own website) to identify websites that may benefit from accessibility remediation. We scan the public pages of those websites, check that the published business email address can receive mail, and may send commercial email to it. All commercial email we send complies with the CAN-SPAM Act: the message identifies itself as commercial, lists an accurate physical postal address, and includes a one-click unsubscribe link that removes the recipient from all future marketing communications within 10 business days.

Section 8

Data Security

Platform credentials are encrypted with AES-256-GCM using a key derived via scrypt, and are decrypted only on our servers at the moment a job or integration call needs them. All traffic is served over HTTPS with modern TLS. Every table in our Postgres database has row-level security (RLS) turned on; our own services use a server key that bypasses it, so the separation between customer accounts is enforced in our application code. Uploads are kept in a private storage bucket. Our API routes are rate-limited, and scan requests submitted through our scan form are refused when the address points to a private or internal network. Access to production systems is limited to the company's operator, and sign-ins to our admin console are recorded. More detail is on our security page.

Section 9

Data Retention

The table says how long we keep each kind of data. Some records have no deletion job; the table says which ones, and why we keep them.

When you close your account from /dashboard/account, you are signed out and can no longer sign in. Closing the account does not cancel a subscription. Erasure starts 30 days after you close the account. An automatic job then erases your account record, OAuth tokens, platform credentials, scans, reports, remediation history, uploads, screenshots, stored outputs and dashboard support messages.

The job holds the whole account while any of these is open:

• a plan subscription that is active or past due;
• an add-on subscription that is active, past due or suspended;
• an active monthly plan;
• monitoring you are enrolled in;
• a suspended account (a refund or a payment dispute can suspend it);
• a payment dispute on any of your invoices that has not been closed.

A held account is checked again every week and erased once nothing is open. An account our job cannot erase automatically, or one held after a refund or a dispute, is erased when you ask us at support@remediada.com, once nothing is owed or disputed.

After erasure, these records stay:

• your invoices, with your name, email and business details removed, because tax and accounting law requires the record;
• the payment notices Stripe sent us about your payments, with names, email addresses, postal addresses and phone numbers removed, for the accounting record;
• the main email address we held for your business as a sales lead, and the contact addresses we held for it, on our do-not-email list, so our outreach emails skip them. Other addresses we had collected for the business are deleted, not added to that list;
• that business lead record (business name and website, without contact details), with its interaction history, whether each of our sequence emails to it was opened or clicked, and the pages viewed after a link we sent, so the business stays marked as unsubscribed. The email opens and clicks tied to it, and replies from the business, are deleted;
• referral commission records, to account for commissions we paid or reversed;
• bookings of a call with us, quotes and links we sent, with the person's name, email and phone cleared, as our own sales and calendar records;
• our security log of sign-ins and account actions, with IP address and browser, for security. It cannot be edited or deleted.

Section 10

Your Rights (GDPR and CCPA)

Depending on your location, you may have the following rights with respect to your personal information:

• Right to access. You can download a machine-readable export of your personal data, scan history, and account information at any time from /dashboard/account. You may also send a written request to support@remediada.com.
• Right to correction. You may update your name, business name, and website directly in your account settings at any time. To change your email address, or for any other correction, contact us.
• Right to deletion. You may close your account from /dashboard/account; its data is erased as described in Section 9. You may also ask us by email to erase specific data.
• Right to data portability. Account exports from /dashboard/account are provided in JSON format, can be imported into compatible systems, and include your scan history. PDF versions of scan reports are a paid-plan feature, but the JSON export is available on every plan and is not conditioned on payment.
• Right to object and to restrict. You can object to processing based on legitimate interests, or ask us to restrict processing while a complaint is resolved, by emailing us.
• Right to opt out of marketing. Use the unsubscribe link in any marketing email, or email us. Transactional emails are not affected.
• Right to revoke platform access. Platform credentials for any connected CMS or commerce platform can be revoked at any time by disconnecting the integration from /dashboard/integrations.
• Right to complain. If you are in the EEA, the UK or Switzerland, you can complain to your local data protection authority.

We respond to verifiable privacy requests within 30 days. We will not discriminate against you for exercising any of these rights. If a request concerns content one of our customers gave us (Section 5), we pass it to that customer and help them answer it.

Section 11

California Residents (CCPA / CPRA)

We do not sell personal information within the meaning of the California Consumer Privacy Act or the California Privacy Rights Act, and we do not share personal information for cross-context behavioral advertising. California residents have all of the rights described in Section 10 and additionally have the right to know the categories of personal information we collect (see Sections 1 to 3), the business or commercial purposes for which it is used (see Section 4), and the categories of third parties with whom it is shared (see Section 6 and our sub-processors page). To make a CCPA/CPRA request, contact support@remediada.com.

Section 12

International Data Transfers

We are a United States company. Our main database and file storage (Supabase) are in the United States (us-east-1). Our application services, with the Postgres database and Redis cache they use, run on Railway in Singapore (asia-southeast1); data is processed there while a job runs, and the Redis cache holds full-page screenshots for up to 30 minutes during a fix. The workers for the document and app add-ons run on hosts we will name here before those add-ons go on sale. Our other providers are located where the sub-processors page says. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, your information is transferred to those countries.

For transfers from our customers to us, we use the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3, processor to processor), with the UK Addendum for the United Kingdom. They are incorporated into our Data Processing Agreement. For onward transfers to our providers, we rely on their Standard Contractual Clauses and, where a provider is certified, the EU-U.S. Data Privacy Framework. You may ask for a copy of these safeguards at support@remediada.com.

Section 13

Cookie Policy

We use first-party cookies only: session cookies that keep you signed in, two referral cookies that remember which link brought you here, and one cookie that remembers your answer about them. If you arrive through a link, we ask first, and the referral cookies are set only if you allow them. We do not use advertising cookies, cross-site trackers, or third-party marketing pixels. Our website analytics (Plausible, when enabled) set no cookies.

The following cookies are set by remediada.com:

The session cookies are needed for the Service to work. The two referral cookies are optional: they are set only if you allow them, and you can clear or block them without affecting the Service.

When you open a link we sent you, our server records one view of the page it opened, with the identifier in the link, your browser's user agent and a one-way hash of your IP address, whether or not you allow the cookies. We rely on our legitimate interest in knowing whether our emails reach people (Section 4). Without your consent we record nothing else about your visit: no pages viewed after that, no clicks and no time on page. When you follow a referral short link, our server also counts one click on it, with the time and your browser's user agent, before any cookie is set.

Section 14

OAuth Login

Sign-in with Google, GitHub or Shopify is not currently offered. RemediADA accounts use an email address and a password. If we turn it on, this section will say so.

Section 15

Children

RemediADA is a business-to-business service and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact support@remediada.com and we will delete it.

Section 16

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be announced by email to the address on file and by posting the updated policy at this URL, at least 30 days before they apply to existing accounts. We also give notice before adding or replacing a sub-processor, as described on the sub-processors page.

This version applies to accounts opened on or after September 29, 2026, and to accounts opened before that date from October 29, 2026.

Section 17

Contact