Privacy and data handling

About you

The name, work email address and organization you type into the sign-up form or that an operator enters when creating your account. Your organization’s type (city, county, state agency and so on) if you choose one.

About your website

The public pages our crawler reaches by following links, the accessibility findings raised against them, and a record of every document those pages link to — its address, its file name, its size and what our inspection observed about it.

Documents you upload

A PDF you upload to be fixed is kept beside its fixed copy for a week after fixing finishes, so you can compare and download them; then both are no longer available, and are removed from our database within about an hour. Only your organization’s accounts can see them. Every PDF you upload also stays in its upload set for three days after you add it, whether or not it is converted. See how long things are kept.

If you use the free PDF page

The PDF is read on our servers and the repaired copy is held in memory for a few minutes, until you download it or it is discarded. Neither the original nor the copy is written to our database, and no AI model reads it. Your results appear before we ask for anything. If you choose to download the repaired copy, we keep the email address you give — and your name and organization, if you give them — as a sales record, so we can follow up once. That record does not include the document, its name, or anything found in it. Our logs record the internet address a request came from, the size of the file and, when you download, the domain of the email address you gave — never the file’s name or its content.

Billing

What we invoiced you and whether it was paid. No card number and no bank details ever reach this product.

If a partner referred you

When you arrive on a link with a short code on the end (?ref=), as the links our referral partners give out have, the code is kept in your browser for up to 90 days (at most five such codes) and taken out of the page address straight away, before any analytics or session-recording tool on the page starts, so none of them receives it. If you create an account in that browser, the codes are sent with it and we record which partner, if any, introduced you; the rest are discarded. We also record it by hand when a partner introduces you to us by email. We use it only to work out what we owe the partner from the invoices you pay. It does not change your price, and the partner gets no access to your account, your documents or your results; the statement we send them names your organization, the invoices you paid and their commission.

If you apply to be a partner

The details you enter (your business’s legal name, type, where it is organized, its address, the name and title of the person signing, and an email for notices), the name you type to sign, the signature you draw if you choose to draw one, the time you signed, the internet address and browser description your request came from, and the signed agreement as a PDF with a fingerprint (SHA-256) of it. We keep these as the record of a contract: to show who signed what and when, to countersign it, and to work out and pay your commission. We never store your bank details in this product; our accounting keeps them.

Support

The messages you send us through the support queue, which are visible to you and to us. There are no internal notes hidden from you on a ticket.

Every assessment, page, finding, document and conversion belongs to one organization, and a request for a resource belonging to another organization is answered as though it does not exist. That decision is made in exactly one place in the code, which is what makes it possible to state plainly.

A handful of screens we use to run the service do reach across organizations — the list of who asked for a scan, what each customer’s account is configured to allow, what we invoiced them and which partner introduced them, and the support queue. None of them can reach an assessment, a document, a page or a finding. Your support messages are the one thing of yours we read across that boundary, and you wrote them to us.

The complete list. Each is used for one thing, and most deployments do not use all of them.

Anthropic — converting documents, describing pictures, drafting example fixes

Where a document is converted to accessible HTML and our own layout reader cannot convert it, or the account has none, its text is sent to Anthropic’s model API. Where picture descriptions are on for that work, each picture a web page version keeps is sent to be described, whether our own reader or AI made the version. Where a structure tree is written into a PDF you fix and picture descriptions are on for your account, each picture in it is sent there too, to be described. Where somebody presses “Show an example fix” on a website finding, the public HTML of that one element of the website and the rule it failed are sent. These are the only places anything leaves our systems for a model. Each happens only when somebody on your account asks for a conversion, a fix or an example, and never as part of an ordinary scan. Reading a PDF’s structure, counting its form fields and adding a text layer to a scan all happen on our own servers and send nothing out; text recognition and the layout reader use machine-learning software there, and neither writes words of its own. An organization can turn AI off on its Account page, and a set of files can be sent with no AI; then nothing from those documents is sent to Anthropic. Exactly what each step sends is on how we handle your documents.

Stripe — invoicing

Your organization name and one email address, so an invoice can be sent and paid. We store no payment method; Stripe holds whatever you use to pay.

Resend — email

Your email address and the message, for sign-in codes, the notice that a scan or a conversion has finished, messages about a support ticket, the welcome to a new account, and the one follow-up after the free PDF page.

Google Ads — advertising measurement, only where configured and only on the public pages

Where this deployment is running advertising, a Google tag is loaded on our public pages and a cookie is set. It reports that somebody started a scan, that the free PDF page produced a repaired file, and that one of those public pages was viewed. It is never loaded on a screen that shows your assessments, findings, documents, invoices or support threads; if a browser carries it towards those screens, the page is reloaded, which ends it. The page address and the page you came from are both rebuilt by us from the list of public pages, so neither can name a screen inside the product. No email address, no organization name and no website address reaches it.

Google Ads — which advertisement led to a purchase

When you arrive from one of our advertisements, Google puts a click identifier in the link. A public page keeps it in your browser for up to ninety days, and if you create an account it is stored with the account. If that account later pays an invoice, we upload to Google the click identifier, the amount and when it was paid, so the campaign can tell which advertisements lead to a purchase. Nothing else is in that upload: no name, no email address, no organization and nothing from your documents or your website.

Google Analytics — visitor counts, only where configured and only on the public pages

Where this deployment is running Analytics, Google is told that somebody viewed one of our public pages: this one, the home page, the free PDF page, the free account page, the videos page, the documents pilot page, pricing, how it works, questions and answers, how we handle your documents, the partner program, contact, terms, security and accessibility. It is never started on a screen that shows your assessments, findings, documents, invoices or support threads, and it is never started for somebody who is signed in. If a browser carries the tag from a public page towards those screens, the page is reloaded, which ends it. The address we report is rebuilt by us from the page name and the advertising parameters of the link somebody arrived on — nothing else in a web address is passed on by the page view we send. A cookie is set on those public pages, and Google receives the internet address your browser connects from, which is how it estimates a country. This tag is configured not to join your visit to a signed-in Google profile and not to feed advertising targeting; that is set on the analytics tag itself, and it is a separate thing from the advertising tag described above.

Microsoft Clarity — session recording, only where configured and only on the public pages

Where this deployment is running Clarity, a recording is made of how people use our public pages: this one, the home page, the free PDF page, the free account page, the videos page, the documents pilot page, pricing, how it works, questions and answers, how we handle your documents, the partner program, contact, terms, security and accessibility. It captures pointer movement, clicks, scrolling and the page as it appeared. It is never started on a screen that shows your assessments, findings, documents, invoices or support threads, and it is never started for somebody who is signed in. If a browser carries a recording from a public page towards those screens, the page is reloaded, which ends it. What you type into the form on the home page is masked and is not uploaded, and so is the panel on the free PDF page that shows your file’s name, what was found in it and the details you type.

Hosting and database

The application, its worker and its PostgreSQL database run on our hosting provider’s infrastructure in the United States.

A PDF you upload to be fixed is kept, with its fixed copy, for a week after fixing finishes so you can compare the two and download them. Only your organization’s accounts can see them. Every PDF you upload is also held in its upload set for three days after you add it. Once a window closes, those files are no longer available, and our worker removes them from our database within about an hour, since it clears expired files every hour. The record that a file was fixed — its name, the date and what happened — stays, so you can show what was done.

Converting a PDF to HTML works on a copy of it, stored on the conversion batch. No part of the product serves those bytes back, and that copy is deleted in the same database transaction that writes the converted result. The PDF you uploaded is not: it stays in its upload set for three days after you add it, like every upload.

A converted document stays downloadable for three days after its conversion finishes, and is then removed the same way. The window is stamped when the conversion is asked for and moved to when it finishes, so a file is cleared even if the conversion never ran. The record that the conversion happened outlives the file, on purpose: “we converted this in March and the copy has been cleared” is a different answer from “we never converted this”.

Assessments, findings, document inventories and support tickets are kept for as long as you have an account, because they are the record you are paying us to keep. There is no button for deleting them: write to us and we delete them.

On the free PDF page, the repaired copy is discarded within minutes: when you download it, or when nobody does. The sales record made when you download it — your email address, and your name and organization if you gave them — is kept until you ask us to delete it. Reply STOP to any email from us and we stop sending you sales and follow-up email. Write to us asking us to delete the record and we delete it. We keep only a scrambled fingerprint of the address, so that we never send it sales or follow-up email again.

• We do not sell your data, and we do not share it with anyone outside the list above.
• We do not send your documents, your findings or your website content to any analytics or advertising platform.
• We do not sign in to your systems. The crawler follows public links with ordinary page requests: it does not submit forms, click buttons, or attempt to get past access controls, bot protection or a site’s robots directives.
• We do not store a password you could use to sign in. Sign-in is a six-digit code emailed to you; where a password exists at all it is a scrypt digest, and session tokens are stored as SHA-256 digests.

Write to us and we will answer: what we hold about your organization, a copy of it, or deletion. jeff@missionlayersystems.com

If your state has a public-records or privacy statute that requires particular language in a contract with us, send it and we will look at it rather than telling you our standard terms cover it.