Privacy and data retention

What we collect, and why

• Contact-form inquiries - your name, email, organization and message. Used only to reply to you and route your request to the right person. Never sold, never used for marketing lists.
• Free PDF sample requests - your organization, work email, public PDF link, page count, permission confirmation and campaign attribution. Used to review suitability, prepare an accepted sample and quote, and track whether you later purchase. The form does not upload or automatically fetch your document and does not sign you up for promotional email. We retain hashed organization/email identifiers to enforce the one-sample limit for the pilot.
• Order details - the website address or document package you ask us to work on, your email, organization and package choice. Used to deliver the service you bought and to invoice you.
• Source documents - the PDF, Word or PowerPoint files you send for remediation. Used only to complete, verify and support the work you ordered; access is limited to the team members fulfilling and reviewing that order.
• Campaign attribution - first-touch source tags and advertising click identifiers attached to a genuine inquiry or order. Used to understand which campaigns produced real outcomes; not used to build a cross-site profile.
• Optional free-scan email - if you ask us to email a completed ABLE screening, we store the email address, scanned public URL, aggregate issue counts and first-touch campaign attribution with a lead reference. We use it to send that one result and alert the service team; it does not add you to a newsletter.
• Payment information - handled entirely by PayPal on their own secure pages. Your card or account details never touch our servers; we receive transaction references, payment status and limited payer information needed to reconcile the order.
• Scan results - the accessibility findings for the pages you asked us to check. Used to prepare your report and verify fixes on re-test.
• Display preferences - text size, theme and similar settings are stored in your own browser, not on our servers.
• AI agent logs - our operational agents record the actions they take on each order (scoping, scanning, drafting, scheduling, invoicing) so every decision is auditable. Logs reference order IDs, not personal profiles.

Optional conversations with Tara

Tara uses Google's paid Gemini services to understand messages and generate replies and voice. Selecting Talk to Tara or Start voice conversation requests microphone permission, welcomes you and then enables listening. Merely visiting a page starts no speech or listening. Your browser may use its speech-recognition provider; where that is unavailable, a short recording is sent to Gemini for transcription. Stop voice, Type instead, closing Tara or hiding the page stops the conversation. Text mode remains available. Do not share passwords, card numbers, API keys, medical information or confidential files.

The active conversation and draft details are held temporarily in server memory for up to two hours of inactivity and can be cleared with Start over. They may be lost when the service restarts. A reviewed form handoff is kept in this browser tab's session storage until it is applied, expires after fifteen minutes, or the tab closes. Only details you submit through an existing form become a normal inquiry or order under the retention rules below. PayPal sandbox demonstration records are separate from real orders; new records contain a short reviewed order summary and verified transaction status, and do not trigger service fulfillment, customer email or revenue reporting. Use synthetic details for demonstrations.

Overview and TARA demonstration videos connect to YouTube only when you choose to play them, or follow a YouTube link. Embedded playback uses YouTube's privacy-enhanced domain; Google/YouTube then receives playback requests under its own privacy terms. No video autoplays.

Maya and Saarthi

Maya: browser speech recognition can use your browser vendor’s service. Answers and questions used for optional AI feedback are processed by Amazon Bedrock; spoken feedback uses Google Cloud voice services. The app explains its current-tab and prototype limits. Maya controls and limits.

Saarthi browser demo: screen images, questions and the supplied transcript are sent to Nebius Token Factory for answers; meeting audio is sent to Sarvam for transcription. Use only non-confidential material with permission. Capture stops after three minutes and the browser demo does not save meetings. The full Windows app uses your own configured provider accounts and stores meeting files locally under your control. Windows setup and demo limits.

These providers have their own processing and retention terms. We do not promise that third-party processing has zero logging or that the browser demo reproduces every Windows feature.

Our data commitments

• No cross-site advertising trackers and no profiling of you across the web. We use Google Analytics 4 to understand how people find and use this site; it sets a first-party cookie and reports aggregate traffic to us. We do not sell or rent your data to anyone.
• We do not use your website's scan results or documents to train our own AI models. Our paid Gemini API service processes prompts and responses under Google's paid-services data terms, which state that Google does not use that content to improve its products.
• We do not send newsletters or promotional email - you hear from us only about your inquiry, order, or a free-scan result you explicitly asked us to email.

Data retention

• Inquiries: kept for up to 24 months so we can pick up the conversation where it left off, then deleted.
• Orders and invoices: kept for 7 years, as financial and tax rules require.
• Scan results and reports: kept for 12 months after delivery so we can support you on re-tests and remediation questions, then deleted on request or on schedule.
• AI app drafts: kept for up to 12 months for validation and creator support, then deleted on schedule unless a longer engagement requires them.
• Documents you send for remediation: working copies are deleted within 90 days of delivering the remediated versions.
• Agent logs: retained as operational evidence, with personal details minimised.

Want something removed sooner? Email info@visionaid.org and we will delete your data within 30 days wherever the law allows.

Where your data lives

Ability Bazaar runs on Google Cloud. Durable records are stored in Google Cloud Firestore. Website administration requires a named, approved staff email, a one-time email link and an authenticator code. Site traffic measurement uses Google Analytics 4. AI-assisted workflows use Google's paid Gemini API. Payments are processed by PayPal under their own privacy policies.

Questions

Anything unclear, or a request about your data? Contact us or email info@visionaid.org - a human reads every message.