Privacy Policy

This Privacy Policy explains how Includoc ("we," "us" or "our") collects, uses and shares personal information when you visit includoc.com, use our document checker and free tools, or use the Includoc app. It also explains your choices and rights.

The short version

• We collect what we need to run Includoc: your account details, the files you ask us to check or fix, and basic information about how the service is used.
• We don't sell personal information, and we don't use your files to train AI models.
• Files you check without an account are deleted within 24 hours. Files in an account are deleted after 30 days by default.
• When an organization uses Includoc, we process the documents it uploads on its behalf, under our Data Processing Addendum.

1. Our role

For most of the information in this policy, such as your account details and how you use our website, we decide how and why it's used.

For documents and other content that organizations upload, link to or have us crawl, we act on the organization's behalf, as its processor or service provider. We handle that content according to the organization's instructions and our Data Processing Addendum. If your information appears in a document an organization uploaded, please contact that organization with questions or requests. We'll help them respond.

2. Information we collect

Information you give us

• Account information: your name, email address, organization and role. If you sign in with Google or Microsoft, we receive your name, email address and profile picture from them. We don't use passwords. You sign in with a link or code we email you, or with Google or Microsoft.
• Documents and images: files you upload or link to for checking or fixing, images you submit to the alt-text generator, and the text you enter on the review screen, such as edited alt text. Documents can contain personal information about you or other people.
• Messages and forms: what you send us through the contact form, support email, accessibility feedback, quote requests, pilot requests and the healthcare waitlist. This can include your name, organization, email address and message.
• Free tool answers: the email address you give to unlock a full report, your answers in the deadline finder (such as your type of organization and population or employee count) and the numbers you enter in the cost calculator.
• Marketing preferences: whether you've opted in to our newsletter or product updates.
• Billing information: Stripe collects your payment details. We receive your billing name, email and address, your tax-exempt status and limited card details, such as the card brand and last four digits. We never see or store your full card number.

Information collected automatically

• Usage and device information: pages you visit, the page that referred you, campaign tags in links, your browser and device type, and actions in the app, such as starting an upload or completing a check.
• IP address: we use it for security, abuse prevention and rate limits. For rate limits, we store a one-way hash of your IP address rather than the address itself.
• Error reports: when something breaks, our error monitoring records technical details, such as the page, browser and time.
• Bot protection: Cloudflare Turnstile checks signals from your browser to tell people from automated abuse on our free tools and forms.

Information from others

• Sign-in providers: Google or Microsoft, if you sign in with them.
• Stripe: payment status and billing details.
• Your organization: an admin may invite you, which gives us your email address and role.
• Public websites: for websites an organization has verified with us, IncludocBot collects links to documents, document details and the documents themselves. When someone asks us to check a document at a public web address, we fetch that file. See IncludocBot.

3. How we use information

The "legal basis" column matters mainly for people in the European Economic Area and the United Kingdom. We're happy to explain any of it.

Email. We send newsletters and product updates only if you opt in, and we confirm your choice with a link before we add you. Every marketing email has an unsubscribe link. We also send emails about your account, your files and features you use. You can turn off the non-essential ones in your preferences.

4. AI processing

When you fix a document, we send page images, cropped images of figures, and text and structure information from the document to an AI model. The model suggests headings, reading order, table headers and alt text. Images submitted to the alt-text generator are processed the same way, and we don't keep them: each image is sent to the model and discarded once the alt text comes back.

• Requests go through OpenRouter and are routed only to Anthropic's Claude models.
• We use zero-data-retention routing, refuse providers that collect data, turn off prompt logging and opt out of training.
• Your files are never used to train AI models.
• We use your files to improve Includoc, for example in quality audits, only with your permission.

5. How we share information

• Service providers. We use a small set of providers, called subprocessors, to run Includoc. They process information only to provide their services to us. See our subprocessors list.
• Your organization. In an organization account, owners and admins can see the organization's files, activity and audit log, including what you uploaded and approved.
• Human-verified specialists. If you order human verification, an accessibility specialist bound by confidentiality reviews the files you send for review.
• Legal reasons. We share information when the law requires it, such as in response to a valid court order, or when needed to protect the rights, property or safety of our users, the public or Includoc.
• Business changes. If Includoc is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal. We'll tell you before your information becomes subject to a different privacy policy.
• With your consent. We share information in other ways only if you ask us to or agree.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We don't show ads.

6. How long we keep information

Reports can include short excerpts, such as an image's alt text or a heading, so you can see what changed. When you delete a file, we remove those excerpts and keep only the record that the check or fix happened.

7. Security

We protect information with encryption in transit and at rest, private storage with short-lived links, isolated processing, least-privilege access and multi-factor authentication. Our trust page explains these safeguards. If we confirm a security incident that affects your data, we'll notify affected customers within 72 hours of confirming it.

8. Your choices and rights

You can:

• Access the personal information we hold about you
• Correct information that's wrong
• Delete your information, including any file at any time with "Delete now"
• Export your files and reports
• Object to or restrict certain uses
• Withdraw consent, such as for newsletters, at any time
• Unsubscribe from marketing emails using the link in any of them

US state privacy rights. Depending on where you live, such as California, you may have the right to know what personal information we collect and how we use it, to correct and delete it, and to opt out of its sale or sharing. We don't sell or share personal information, and we don't use sensitive personal information to infer things about you. We won't treat you differently for using your rights. You can use an authorized agent to make a request.

People in the European Economic Area and the United Kingdom have rights under data protection law, including the right to complain to a data protection authority. We'd appreciate the chance to address your concern first.

How to make a request. Email support@includoc.com with "Privacy request" in the subject line. We'll verify your identity before acting, and we'll respond within the time the law requires. If we decline your request, we'll explain why, and you can appeal by replying to our decision.

Organization content. For documents an organization uploaded, please make your request to that organization. We'll help it respond.

9. Children

Includoc is for organizations and professionals. It isn't directed to children under 13, and we don't knowingly collect personal information from them. If we learn we have, we'll delete it.

Schools and colleges may upload documents that contain information about students. The school controls that information, and we process it on the school's behalf.

10. Cookies and similar technologies

We use a small number of cookies and browser storage items:

• Essential: keeping you signed in, protecting forms and free tools from abuse (Cloudflare Turnstile), remembering your light or dark theme, and remembering the anonymous checks you've run in this browser so you can return to your results and claim them when you sign up.
• Product analytics: PostHog stores an identifier in your browser so we can understand how the product is used, such as how many people finish a check. Session replay is turned off. We don't use analytics for advertising.

We don't use advertising cookies or cross-site tracking. You can block or clear cookies and browser storage in your browser settings. Blocking analytics won't affect the service, but clearing browser storage will remove your list of anonymous checks.

11. Where we process information

We store and process information in the United States. If you use Includoc from outside the United States, your information is transferred to the United States. For customers subject to European or UK data protection law, our Data Processing Addendum includes the transfer terms.

12. Changes to this policy

We may update this policy. We'll post the new version here with a new "Last updated" date. If a change is material, we'll tell you by email or in the app before it takes effect.

13. Contact

For privacy questions and requests, email support@includoc.com with "Privacy request" in the subject line. For security issues, email security@includoc.com.