Your privacy, handled plainly.

1 Who we are

AccessProofAI (“AccessProofAI,” “we,” “us”) is operated by Arann Tech Cybersecurity Solutions, based in Toronto, Ontario, Canada. This policy explains what information we collect through accessproofai.com and our scanning service, why we collect it, how long we keep it, and the choices you have.

This policy applies to everyone who uses AccessProofAI, including the free tier — using the free scan means this policy already applies to you, not just to paying customers.

2 Information we collect

Account information

When you create an account, we collect your business email address, name, company name, and password (stored as a secure hash, never in plain text). We ask for a business email as a light signal that you're scanning a site you're professionally connected to — it doesn't by itself prove authorization (see Section 5).

The domain you submit

The one thing you type into AccessProofAI is a domain or URL. That single field drives everything else the service does.

Content our scanner retrieves

Once you submit a domain, our automated crawler fetches pages from it — up to the page limit for your plan — and reads the structural content relevant to accessibility: HTML/DOM structure, ARIA attributes, image alt text, heading order, color and contrast values, and form labels. If the pages we scan contain personal information placed there by the site itself — a staff bio, a contact form, a comment thread — our crawler may incidentally encounter it as a byproduct of reading the page. We treat that content the same way we treat everything else the crawler touches: analyzed for accessibility issues, then deleted on the schedule in Section 7.

AI-generated content

The findings, explanations, and suggested code fixes that Claude produces from your scan are stored in your account so you can review them in the sandbox.

Payment information

If you subscribe to a paid plan, payment is handled by Stripe, our payment processor. Stripe collects and stores your payment details directly and manages PCI DSS compliance for card processing on our behalf — we receive a plan status and transaction record from Stripe, and we do not store your full card number.

Usage and log data

Like most web services, we automatically log things such as IP address, browser type, pages visited, and timestamps, for security and troubleshooting.

3 How we use information

• To run the scan you requested and show you the results.
• To generate accessibility findings and suggested remediation code using the Claude API.
• To operate your account: authentication, billing, plan limits, and support.
• For the Monitoring plan, to run scheduled scans and email you when something changes.
• To detect abuse — for example, repeated scans of domains a user hasn't verified they control.
• To maintain and improve the security and reliability of the service.
• To meet our own legal and accounting obligations.

We do not sell your personal information, and we do not use the content of your scans to train our own AI models.

4 AI processing & the Claude API

AccessProofAI uses Anthropic's Claude API to evaluate the structural content our crawler retrieves against WCAG accessibility criteria, and to draft suggested code fixes. This applies to every plan, including the free tier.

• What we send: structural, accessibility-relevant excerpts of the pages we scan — not full-page screenshots, and not the values you or your visitors typed into forms.
• Training use: under Anthropic's commercial terms, content submitted through the API is not used to train Anthropic's models by default.
• Retention at Anthropic: API inputs and outputs are automatically deleted from Anthropic's systems within 30 days of processing.
• Where it's processed: this processing takes place on Anthropic's infrastructure, which may be located outside Canada — see Section 9.

Claude acts here as an analysis and drafting tool. It does not make any decision about you as an individual, and using it does not affect your rights or account status based on an automated profile of you.

5 Domain verification

A 2-page free scan runs without extra steps. Before we run a deep scan (Pro), a recurring monitoring scan, or generate a report intended for a government submission, we ask you to demonstrate that you control the domain — typically by adding a DNS record or a file at a well-known path, the same approach used by services like Google Search Console.

This protects you (so no one else can generate compliance reports about your site, or point our crawler at your infrastructure without your knowledge) and it protects the people who own the sites we're asked to scan.

6 Human review of AI suggestions

AccessProofAI never edits or deploys code on your website. Every suggested fix appears in a sandbox for a person on your team to read, judge, and — if they choose — copy into your actual codebase. We keep a record of what was suggested and what you did with it, both to improve our own accuracy and as part of the evidence trail you may want if you're using our reports to support a compliance submission.

A clean scan result is a professional starting point, not a legal certification of accessibility compliance. Some things — like whether alt text is actually meaningful, or how a screen reader experiences your site in practice — need human and assistive-technology testing that automated analysis can't fully replace.

7 How long we keep information

You can ask us to delete your information sooner at any time — see Section 11.

8 Who we share information with

We share information only with the service providers who help us run AccessProofAI, each bound by a contract that limits how they may use it:

• Anthropic — processes scan content to generate accessibility findings and suggested fixes (Section 4).
• Stripe — handles billing and card details for paid plans, and manages PCI DSS compliance for that data.
• Our hosting and infrastructure providers — store your account and scan data.
• Our email delivery provider — sends account and monitoring-alert emails.
• Google Analytics and Meta Pixel — receive website usage and advertising-related data from website visitors; see Section 12.

We may also disclose information if required by law, or to protect the rights, safety, or property of AccessProofAI, our users, or the public. We do not sell your personal information to anyone.

9 International data transfers

Some of our service providers — including Anthropic, Stripe, Google, and Meta — may process information outside Canada, typically in the United States. Where that happens, we require contractual safeguards from the provider (terms limiting their use of the data, protecting it to a comparable standard, and requiring them to notify us of any breach), and we remain responsible for your information under Canadian privacy law regardless of where it's processed.

10 How we protect information

• Encryption in transit (TLS) and at rest for account and scan data.
• Access to customer data is limited to what's needed to operate and support the service.
• Suggested code is always treated as inert text — never executed against your site by us.
• Our scanner is restricted from probing private/internal network addresses.
• We review our security practices on a regular schedule, including periodic independent testing.

No method of storage or transmission is perfectly secure, and we can't guarantee absolute security — but we design the service to minimize what could go wrong and how much would be exposed if it did.

11 Your privacy rights

You can ask us to:

• Access the personal information we hold about you.
• Correct information that's inaccurate or out of date.
• Delete your account and associated data, ahead of the standard retention schedule.
• Export your scan reports before deletion.

To make a request, contact us using the details in Section 16. We aim to respond within 30 days. If you believe we haven't handled your information properly, you can also complain to the Office of the Privacy Commissioner of Canada.

12 Cookies & similar technologies

We use essential cookies to keep you signed in and to remember basic preferences. We also use Google Analytics and Meta Pixel to measure and improve our website performance and advertising effectiveness.

13 Children's privacy

AccessProofAI is a business tool intended for web developers and business professionals. It is not directed at children, and we do not knowingly collect personal information from children.

14 If something goes wrong

If a security incident creates a real risk of significant harm to you, we will notify you and, where required, the Office of the Privacy Commissioner of Canada, as required under Canadian law.

15 Changes to this policy

We may update this policy as our service or applicable law changes. We'll update the “Last updated” date above, and for material changes we'll take reasonable steps to let account holders know — for example, by email.

16 How to reach us

Questions, requests, or concerns about this policy or your information: