Privacy Policy
1. Who we are
This Privacy Policy explains how NY Digital Accessibility Compliance Group ("NY Digital Accessibility," "we," "us," or "our"), collects, uses, and protects information in connection with this website and our intake process. It applies to information collected through this website; it does not cover information collected offline, under a signed services agreement, or by third-party websites we do not control.
2. Information submitted through forms
When you submit the "Request an Accessibility Review" form, we collect what you provide: name, work email, optional telephone number, organization name and role, website URLs and additional digital properties submitted for assessment, optional counsel-representation information and counsel contact details you volunteer, preferred service and objective, timeline, description, preferred contact method, and your policy consent. The form also records a Terms version, Privacy Policy version, form version, and a client-side submission timestamp.
When you run the free quick check at /scan, we store the website address you enter, the results of the check, and a keyed one-way hash of your IP address, which we retain in order to investigate abuse of the check. To limit how often the check can be run, we also use your IP address itself, held in memory for about an hour and not stored with the check. Your IP address is also sent to Cloudflare, whose Turnstile challenge protects the form from automated abuse. If you choose "Email me my results" and tick its box, we also collect that email address, may check that it can receive mail, and use it to email your results and up to two short follow-up emails about them. A person on our team reviews each of those emails before it is sent; every email includes a way to opt out, and opting out stops all further email from us.
Do not submit passwords, private source code, confidential legal communications, settlement materials, medical information, or other sensitive information through the public intake form. If an engagement requires exchanging confidential material, we will arrange an appropriate channel.
3. Technical and usage data
This site loads no third-party analytics or advertising scripts and sets no cookies. Links to this site in emails we send may carry a short code (for example ?r=…). When a page is opened from such a link, a small first-party script (visit.js) removes the code from the address bar at once. If the page then remains visible for a few seconds, the script notifies our system that the email's link was opened, so that a person on our team can follow up. With that notice we record which email's link was opened, the time, how long the page was visible, your browser's user-agent string (which identifies the browser, its version, and the operating system), and a keyed one-way hash of your IP address. The IP address itself is held in memory for about an hour, to limit the number of notices from any one address, and is not stored with the notice. We use the timing and the user-agent string to distinguish a genuine visit from an automated link checker. A genuine visit may lead to up to three short follow-up emails, each reviewed by a person on our team before it is sent and each including a way to opt out. The code identifies the email, not your device; the script stores nothing in your browser, and on a page opened without a code it does nothing.
Our hosting provider (Netlify) may log standard technical data — such as IP address, browser type, and requested pages — as part of operating the service and processing form submissions. We do not falsely claim to capture data we do not capture: the intake form itself records only the fields described above.
4. How information is used
- To review your request and respond with a scoped proposal and service communications
- To learn when a link in one of our emails has been opened, so that a person on our team can follow up, and to distinguish genuine visits from automated link checkers
- To perform, document, and administer engagements you enter into
- To create and maintain verification records (see Section 6)
- To operate, secure, and improve this website
- To comply with legal obligations
5. Vendors and service providers
We use service providers to operate this website and our business: hosting providers (Netlify, which hosts this website and processes its forms, and Render, which runs the systems behind the free quick check and the link codes described in Section 3); Cloudflare, whose Turnstile challenge protects the free quick check; Stripe, which processes checkout payments; an email-verification provider, which checks that an address entered for quick-check results can receive mail; an AI writing-assistance provider, which helps us draft emails from check findings; a messaging service used for our team's internal notifications, such as the website checked, any results email address entered, or the fact that a link in one of our emails was opened; and email providers. These vendors process information on our behalf and are not authorized to use it for their own marketing. We do not sell personal information, and we do not share personal information with third parties for their own advertising purposes.
6. Verification records: public vs. private
Public verification records contain business-level information about an engagement: organization name, assessed domain, verification ID, status, dates, defined public scope, methodology, milestone summaries, known public limitations, and status history. They never contain source code, credentials, private issue details, confidential legal materials, personally identifying complainant data, private communications, or settlement information. Detailed reports are confidential and are shared only with the client and parties the client authorizes, subject to the engagement terms.
7. Data retention
The following retention periods apply:
- Free quick check. The website address checked, the results of the check, any answers to the three quick questions, the hashed IP address, and any email address entered for results are deleted 24 months after our last contact with you. If no further contact follows a check, that period runs from the date of the check.
- Emails we send about an organization's website. Our records of these emails — the contact details used, the findings of our automated check of the organization's website, the emails themselves and any replies, and the link notices described in Section 3 — are deleted 24 months after our last contact with the organization.
- Pending emails. If an email to you is still pending when one of the periods above ends (for example, awaiting review or scheduled to be sent), the related records are retained until it is no longer pending.
- Clients. Where an organization becomes a client, the records described above that relate to it are retained with the engagement documentation instead.
- Verification records and engagement documentation. Records we file in the Accessibility Registry, and the engagement documentation supporting them, are retained for the term of the record plus three years, so that each record's documented history remains accurate.
- Opt-out requests. If you opt out of our emails, we retain your email address on a suppression list, without time limit, solely to ensure that we do not contact you again. If the email was one we sent on our own initiative about your organization's website, rather than results you requested through the free quick check, the list also retains that website's domain.
- Copies held elsewhere. The deletions described above apply to information held in our own database and file storage. They do not extend to copies of emails held in our email accounts, our team's internal notification messages, form submissions held by our website host (Netlify), including intake requests, or our hosting providers' server logs. You may request deletion of such copies as described in Section 9.
8. Security
We use reasonable administrative and technical safeguards appropriate to the information we hold. No method of transmission or storage is completely secure, and we do not promise absolute security.
9. Your choices
You may request access to, correction of, or deletion of your submitted information by emailing remediation@nydigitalaccessibility.com. We will respond as required by applicable law. Note that verification records must remain accurate; deletion requests cannot be used to alter a record's documented history.
10. State privacy rights
Depending on your state of residence, you may have rights under state privacy laws, including rights to know, correct, delete, or opt out of certain processing. Whether a particular statute applies to us depends on factors such as revenue, data volume, and the business-to-business nature of the information we collect.
11. Children's privacy
This website is a business-to-business service and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted information, contact us and we will delete it.
12. International visitors
This website is operated from the United States and intended for U.S. organizations. If you access it from elsewhere, you understand that your information is processed in the United States.
13. Changes to this Policy
We may update this Privacy Policy from time to time. The effective date above shows the most recent revision. Material changes will be reflected on this page.
14. Contact
NY Digital Accessibility Compliance Group
Email: remediation@nydigitalaccessibility.com