Privacy Policy

Who this policy covers

A11yRoo LLC operates a11yroo.com, pdf-audit.a11yroo.com, and pdf-edit.a11yroo.com. This policy covers those websites, shared accounts, document processing, and related support. Contact security@a11yroo.com with privacy questions.

Information we receive

Account information includes your name, email address, optional company name, account status, and preferences. The account service stores a password hash and session records; it does not store your password as readable text.

When you use a tool, we receive the PDFs you upload, your instructions, document profiles, proposed edits, generated copies, reports, and project history. A PDF may contain personal information about you or other people. Upload only information you are authorized to share for this processing.

We also keep information needed to run and protect the service, such as session dates, IP addresses, browser details, processing errors, estimated AI usage, spending allowances, and administrative activity. Support messages contain the information you choose to send us.

Why we use information

We use information to provide and secure your account; assess and edit documents at your request; save and restore projects; explain processing costs and enforce allowances; communicate about account access and support; and troubleshoot the service. Authorized administrators manage account access and may review information needed for support, security, and service operations.

You retain ownership of your uploaded content. We do not sell uploaded documents or account information, and we do not use your PDFs for advertising.

Providers involved in processing

Cloudflare hosts the websites and account services. Its database stores account and project records, and Cloudflare R2 stores saved files. Google Cloud Run hosts PDF processing. OpenAI interprets document evidence and instructions when a workflow needs AI. Resend delivers account verification and password setup messages. Google Analytics measures selected public marketing pages and explicit walkthrough-video clicks.

PDF Auditor sends extracted text, document structure evidence, and rendered page images to OpenAI. PDF Editor sends relevant tagged text, existing announcements, and structural context when interpreting a general written request. Supported direct edits can run without a new AI request. Provider processing is part of the service you request; it is not public publication of your PDF.

Providers may process information outside your country. We have not established a blanket promise of a particular processing region or suitability for every regulated document. Contact us before uploading if your organization requires a specific region, data-processing agreement, or confidentiality arrangement.

OpenAI data handling

OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. That provider policy is separate from data retention. Standard abuse-monitoring logs may retain content for up to 30 days, with exceptions; some processing modes have additional temporary storage.

PDF Editor instruction interpretation disables saved API responses. This setting does not remove separate monitoring retention. A11yRoo does not promise zero retention, and we have not independently verified every organization-level OpenAI setting. Ask us before uploading if those details are required by your organization.

Read OpenAI’s API data policy.

Cookies, preferences, and public-page analytics

Necessary cookies support sign-in, security, and movement between the two tools. Browser storage and a theme preference help remember appearance and working state.

Google Analytics runs only on selected public marketing routes. The application does not intentionally send uploaded PDFs, document names, account identifiers, instructions, or private workspace contents to analytics. Analytics can receive browser and device information, IP-derived information, public page visits, and walkthrough clicks. Advertising personalization and Google signals are disabled in the site configuration.

You can turn off optional analytics using the control on this page. The websites also skip optional analytics when your browser sends Global Privacy Control or Do Not Track. Necessary account and security functions continue to work.

Saved projects and deletion

Auditor projects have a one-year retention period and display expiry dates with Keep project and Delete controls. Editor projects expire after 12 months without a save, creation of a review copy, or Keep project. Opening an Editor project alone does not extend its expiry date.

Deleting a project removes access through the application immediately and queues stored files for cleanup. Editor cleanup runs hourly with a target of removal within 24 hours. This does not guarantee immediate deletion from every provider-managed backup; a maximum backup retention period has not been verified.

Account, security, administrative, and usage records may need to remain for service operations, fraud prevention, legal obligations, or resolving a dispute. We do not claim that deleting a PDF erases every related record. Contact us to request account deletion or information about records associated with your account.

Your requests and choices

Use project controls to download available outputs, delete projects, or extend retention. You can ask security@a11yroo.com to access, correct, or delete personal information associated with your account, or ask about restrictions on its use. We may need to verify your identity and clarify which records you mean. Applicable law may require exceptions or additional rights; these terms do not remove those rights.

Avoid including sensitive PDF content in an initial support message. We can arrange an appropriate way to investigate the issue.

Security and service limits

HTTPS protects information in transit. R2 encrypts stored objects, and the applications check signed-in account ownership before providing saved-project access. These measures reduce risk; no online service can guarantee perfect security. We do not claim blanket accessibility, privacy, or regulated-data certification.

The services are intended for professional and organizational document work, not for children. Contact us if you believe a child has provided personal information.

Changes and contact

We will update the date on this policy when it changes. For a material change affecting existing account use, we will provide notice through the service or an account message as appropriate.

Privacy and security: security@a11yroo.com. Account and product support: support@a11yroo.com.