Privacy policy

1.1 Information you provide. We collect the following information that you provide to us:

1. Account information: your name, email address, role, and organization. Your password is stored only as a one-way hash. If you set up two-factor authentication, we store its secret and your recovery codes.
2. Customer Content: the PDF files you upload, the Output Files we generate from them, and the accompanying reports.
3. Billing information: billing contact details, billing address, invoices, and payment records. Most customers pay by check, ACH, or wire transfer. We keep only the remittance details needed to apply your payment, such as the payer’s name, bank name, and reference number.
4. Communications: quote requests submitted through our website (name, email address, organization, and message) and any support requests, conformance reports, messages, and feedback you send us. Please do not email us documents unless we ask you to for a conformance report under the Terms. Otherwise, upload them through the Service.
5. Invitations: the email address and role of each person your organization’s administrators invite.

1.2 Information collected automatically. We collect the following information automatically when you use the Service:

1. Processing history: for each document, who uploaded it and who approved it, its status, page count, the number of issues found, addressed, and left open, its accessibility scores before and after, whether review was skipped, when it was uploaded, processed, and approved, how long processing took, and an error code if it failed. Processing history never includes a document’s content or file name.
2. Sign-in records: when you signed in or changed security settings, your browser and operating system, and your IP address.
3. Sessions: the devices on which you are signed in, and the IP address each signed in from.
4. Terms acceptance: when your account is created, and each time you accept an updated version, we record your email address, the versions of the Terms and this Privacy Policy you agreed to, and the date and time, as proof of what was agreed. We do not record your IP address for this. Section 3.3 says how long we keep it.
5. Upload records: when you upload a document, we record who uploaded it, their email address, when, its page count, your confirmation under Section 4.2, and whether review was skipped. When a document is approved, we add who approved it, their email address, when, and how many issues were left open. These records never include a document’s content or file name, and they are kept apart from processing history as proof of what was confirmed and approved. Section 3.3 says how long we keep them.

1.3 Cookies. We use only essential cookies, which sign you in and keep your session secure. Your choice of light or dark theme and a few display preferences, such as how many items a list shows and whether to notify you when a document is ready, and, for managers, which organization you are working in, are stored in your own browser. We do not use analytics, advertising, or third-party tracking cookies or scripts on our website or in the Service.

1.4 Personal information inside documents. We do not ask you for sensitive personal information, and the Service is not designed to receive it. Documents can still contain personal information about other people, such as names and addresses in meeting minutes. Section 4 explains what we do if sensitive information reaches us anyway.

2.1 Use. We use information to:

1. provide the Service, including processing your PDF files and identifying Flagged Items for your review;
2. create and manage accounts, bill for plans, and track page usage against plan limits;
3. respond to support requests, investigate and correct conformance problems you report under the Terms, and, at your request, help resolve Flagged Items;
4. maintain security, prevent misuse, and fix errors;
5. improve the Service, using aggregated or de-identified usage data, such as page counts, issue counts, and processing times, that never includes the content of your documents or excerpts from them; and
6. send service notices and, if you opt in, product updates, from which you may unsubscribe at any time.

2.2 No sale, no advertising, no training. We do not sell or rent your personal information or Customer Content, and we do not use either for advertising. We do not use Customer Content to train artificial-intelligence or machine-learning models, and we do not allow our service providers, including the AI service provider described in Section 3.1, to do so.

2.3 Sharing. We share information only with:

1. service providers that host or process Customer Content, such as cloud hosting and network security providers, and the AI service provider that checks and improves image descriptions and suggests layout and structure changes (Section 3.1). They must protect it under written confidentiality and data-protection obligations and use it only to provide services to us;
2. service providers that do not receive Customer Content, such as providers of email, accounting, and invoicing services. They receive only the account, billing, and communications information they need to do their work;
3. your organization, where your account is administered by your employer or a client, and, if your organization is managed through a management account under Section 2.5 of the Terms, that account’s managers, who can see and act on your organization’s documents and account and whose actions there are recorded in a log your administrators can read;
4. legal authorities, where required by law, subpoena, or court order, and, for information other than Customer Content, where needed to protect the rights and safety of any person; and
5. a successor, if Docability is involved in a merger, acquisition, or sale of assets. The successor must continue to honor this Policy for Customer Content already in the Service, and we will notify you before your other information becomes subject to a different privacy policy.

If we receive a request or legal process seeking your Customer Content, we will, where legally permitted, notify the Customer promptly and reasonably cooperate with its response, at its expense. We are responsible for our service providers’ compliance with this Policy as to Customer Content.

2.4 Service provider list. Apart from Anthropic, which Section 3.1 names, we describe service providers by category in this Policy. On request, we will give an account administrator a current list of the providers that may receive Customer Content, and we will notify account administrators before we add or replace one.

2.5 Customer references. We will not name your organization as a customer in our marketing without your written permission.

3.1 Processing. Documents are processed by software that Docability operates, including layout analysis software and an image-description model that drafts a description of each image, on infrastructure hosted by the cloud hosting provider described in Section 2.3. To check and improve those descriptions and suggest layout, styling, and structure changes, the Service sends your documents, including their text and images, to Anthropic, the provider of the Claude AI models, through Anthropic’s commercial API. For each page, we send an image of the page, an image of the page as the Service has rebuilt it, the page’s text and structure, and the outline of the document’s headings. Anthropic processes them only to return a result to us, under Anthropic’s commercial terms, which do not permit Anthropic to train its models on our data, and retains them only as described in Anthropic’s API data retention policy. Under that policy, Anthropic currently deletes them within thirty (30) days. If its automated safety systems flag a request as violating Anthropic’s usage policy, it may keep the inputs and outputs for up to two (2) years, and it may keep them longer where the law requires. Docability’s software checks each suggested change before applying it. Each image description is a Flagged Item that you can review, edit, and approve before the Output File is created. If you choose to skip review, the image descriptions and the checked changes go into the Output File without review. We do not send Customer Content to any other outside AI service, and our personnel do not paste or upload Customer Content into any outside AI tool.

3.2 Review Window and deletion of Customer Content. After automatic processing completes, you can review each uploaded file for the Review Window, which lasts three (3) days. During the Review Window, you can open the file, resolve Flagged Items, and approve it. The Output File and its accompanying report are created when you approve the file, or straight away if you skip review. We delete the uploaded file, Output File, and report:

1. twenty-four (24) hours after the Output File is created; or
2. if you do not approve the file, at the end of the Review Window.

We also delete them at once if processing fails or is canceled, and whenever you delete them yourself. We may keep them longer only if the Customer asks for a different period in writing or if the law requires it. If your account is closed or terminated, the same deletion schedule applies. Customer Content is not retained in our backups, logs, caches, or error reports beyond these periods. The one exception is the copies Anthropic receives under Section 3.1: they are held by Anthropic only as described in its API data retention policy (currently deletion within 30 days, or up to two years if flagged), on a schedule we do not control, and neither the periods above nor deleting a file from the Service deletes them. A document’s file name is kept only as long as its files. Because we do not keep long-term copies, keep your own copies of your original files and Output Files. You will need them to report a conformance problem under the Terms, and you may upload a deleted file again for correction.

3.3 Retention of other information.

3.4 Staff access. Docability personnel access Customer Content only to provide the Service, to resolve Flagged Items at your request, to investigate and correct a conformance problem or other issue you report, to keep the Service running, or to comply with the law. Access is limited to personnel who need it for one of those purposes.

3.5 Security and incidents. We maintain commercially reasonable administrative, physical, and technical safeguards designed to protect your information, including encryption of connections (HTTPS) and restricted personnel access. No system is completely secure, and we cannot guarantee that unauthorized access will never occur. If we become aware of unauthorized access to your information, we will notify the affected Customer without undue delay, take reasonable steps to investigate and limit the effect, and reasonably cooperate with any notices the Customer is legally required to give.

3.6 Location. Customer Content is stored in the Service’s document-processing environment, hosted in the United States, while retained under Section 3.2. Our database and its backups are also hosted in the United States. Connections to the Service pass through our network security provider’s global network on the way. Documents sent for image descriptions and layout suggestions are processed in Anthropic’s environment as described in Section 3.1.

4.1 What not to upload. The Service is designed for documents intended for public posting, such as agendas, minutes, budgets, notices, and teaching materials. Please do not upload protected health information, payment card data, Social Security numbers, financial account numbers, student education records, or other regulated or confidential personal data unless Docability has agreed in writing to handle it. Because documents are sent to an outside AI service provider (Section 3.1), this is especially important.

4.2 Upload confirmation. When you upload documents, the Service will ask you to confirm that they contain none of the information described in Section 4.1.

4.3 If sensitive information reaches us anyway. We do not screen documents for sensitive information. Public-entity documents can still contain it, for example, in board packets, personnel items, claims, or resident correspondence. If we learn that a document contains it, we will:

1. keep it on the same deletion schedule as all Customer Content (Section 3.2), or delete it sooner;
2. limit personnel access to what is needed to address the issue; and
3. promptly notify the Customer so it can decide how to proceed, including whether the document was sent to the AI service provider under Section 3.1.

A compromise of Customer Content, including content that should not have been uploaded, is handled under Section 3.5.

5.1 Records belong to your organization. If you are a public entity, documents you post publicly, such as agendas and minutes, may be subject to public-records laws. Those obligations belong to your organization, not to Docability. Docability is not the custodian of your records. Because we delete Customer Content on the schedule in Section 3.2, keep your own copies of original files and Output Files.

5.2 Questions about information in a document. Customer Content belongs to the Customer: for an organization managed through a management account, the organization, not its manager. If you are not the Customer and want to ask about, correct, or delete personal information that appears in a document, please contact the organization that uploaded it. We will help the Customer respond to such requests where we can.

5.3 Your permissions. The Customer is responsible for having the right to upload its documents and permit their processing as described in this Policy, including documents it processes on behalf of clients, as the Terms provide.

6.1 Your choices. You may:

1. change your name in your account settings at any time. Your organization’s administrators manage your role. Your email address is the one you were invited with; to use a different one, ask whoever invited you to invite the new address;
2. request a copy of the personal information we hold about you, or ask us to correct it;
3. delete your files from your account, or ask us to delete your account and personal information, subject to any records we are required by law to keep and the records of Terms acceptance and upload records described in Section 3.3;
4. unsubscribe from marketing emails using the link in any such email; and
5. block or delete cookies through your browser settings, although essential cookies are required to sign in.

6.2 Making a request. Depending on where you live, state privacy laws may give you additional rights. To make a request, email [email protected]. We will respond within thirty (30) days and may need to verify your identity. For requests about personal information inside a document, see Section 5.2.