Privacy and data retention

What we collect, and why

• Contact-form inquiries - your name, email, organization and message. Used only to reply to you and route your request to the right person. Never sold, never used for marketing lists.
• Order details - the website address or document package you ask us to work on, your email, organization and package choice. Used to deliver the service you bought and to invoice you.
• Source documents - the PDF, Word or PowerPoint files you send for remediation. Used only to complete, verify and support the work you ordered; access is limited to the team members fulfilling and reviewing that order.
• Campaign attribution - first-touch source tags and advertising click identifiers attached to a genuine inquiry or order. Used to understand which campaigns produced real outcomes; not used to build a cross-site profile.
• Optional free-scan email - if you ask us to email a completed ABLE screening, we store the email address, scanned public URL, aggregate issue counts and first-touch campaign attribution with a lead reference. We use it to send that one result and alert the service team; it does not add you to a newsletter.
• Payment information - handled entirely by PayPal or Stripe on their own secure pages. Your card or account details never touch our servers; we receive only a confirmation that payment completed.
• Scan results - the accessibility findings for the pages you asked us to check. Used to prepare your report and verify fixes on re-test.
• Display preferences - text size, theme and similar settings are stored in your own browser, not on our servers.
• AI agent logs - our operational agents record the actions they take on each order (scoping, scanning, drafting, scheduling, invoicing) so every decision is auditable. Logs reference order IDs, not personal profiles.

What we don't do

• No cross-site advertising trackers and no profiling of you across the web. We use Google Analytics 4 to understand how people find and use this site; it sets a first-party cookie and reports aggregate traffic to us. We do not sell or rent your data to anyone.
• We do not use your website's scan results or documents to train our own AI models. Our paid Gemini API service processes prompts and responses under Google's paid-services data terms, which state that Google does not use that content to improve its products.
• We do not send newsletters or promotional email - you hear from us only about your inquiry, order, or a free-scan result you explicitly asked us to email.

Data retention

• Inquiries: kept for up to 24 months so we can pick up the conversation where it left off, then deleted.
• Orders and invoices: kept for 7 years, as financial and tax rules require.
• Scan results and reports: kept for 12 months after delivery so we can support you on re-tests and remediation questions, then deleted on request or on schedule.
• AI app drafts: kept for up to 12 months for validation and creator support, then deleted on schedule unless a longer engagement requires them.
• Documents you send for remediation: working copies are deleted within 90 days of delivering the remediated versions.
• Agent logs: retained as operational evidence, with personal details minimised.

Want something removed sooner? Email info@visionaid.org and we will delete your data within 30 days wherever the law allows.

Where your data lives

Ability Bazaar runs on Google Cloud. Durable records are stored in Google Cloud Firestore. Website administration requires a named, approved staff email, a one-time email link and an authenticator code. Site traffic measurement uses Google Analytics 4. AI-assisted workflows use Google's paid Gemini API. Payments are processed by PayPal and Stripe under their own privacy policies.

Questions

Anything unclear, or a request about your data? Contact us or email info@visionaid.org - a human reads every message.