Privacy Policy

ADAWCAG.org is operated by UAIU Holdings Corp, a U.S. corporation (CAGE 1AUK4, UEI WNZJXHNPC2K3). For privacy questions, contact contact@adawcag.org or call 530-808-5208. Our founder is Justin Zaragoza.

We collect only what we need to deliver accessibility scans, audits, and reports.

• Account information. Email, name, password hash, organization name, and (optionally) phone, when you sign up or request a free pass.
• Site & scan data. URLs you submit for scanning, the resulting HTML snapshots, accessibility findings, screenshots, and PDF reports we generate for you. We do not proxy or store visitor data from your scanned site beyond what is needed to render the report.
• Payment information. Card numbers and bank details are collected and stored by Stripe (our payment processor). We only retain the last four digits, billing email, and Stripe's opaque customer/session identifiers.
• Page-view analytics. When you browse the public site, we record the path you visited, your locale, and a one-way HMAC-SHA256 hash of your IP address (salted with a server secret). The raw IP is never written to disk. This is used solely to count distinct anonymous visitors.
• Quiz funnel data. If you take the “Find your fit” quiz, we record the answers you give, your device type and browser (parsed from the User-Agent), UTM parameters from the inbound URL, and your approximate city/region (looked up from your IP via IPinfo). If you submit the report-by-email form, booking form, or grant form, your email and name are linked to the quiz session.
• Cookies. Two strictly-necessary cookies only — see our Cookie Policy for details. We do not use Google Analytics, Facebook Pixel, Hotjar, or any third-party advertising or session- replay tracker.

• To run the accessibility scans and audits you request.
• To send the operational and transactional emails you opt into (scan results, billing receipts, dispute alerts, audit deliverables).
• To detect abuse, rate-limit our APIs, and prevent fraud.
• To improve the product through aggregate, de-identified usage trends.
• To comply with our legal, tax, and accounting obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use your data to train third-party AI models. (Anthropic and OpenAI are used to generate report summaries and remediation suggestions — those vendors are contractually prohibited from training on customer inputs under their enterprise terms.)

For visitors in the EU/UK, we rely on the following lawful bases:

The following service providers process limited categories of personal data on our behalf under written data-processing agreements (DPAs). Each is bound by confidentiality, security, and purpose-limitation obligations consistent with GDPR Art. 28 and the EU Standard Contractual Clauses (SCCs) where applicable.

We will notify active customers by email at least 14 days before adding or replacing a sub-processor that handles personal data.

We honor the Global Privacy Control browser signal. When your browser sends GPC (via the JavaScript flag navigator.globalPrivacyControl), we treat your visit as a deny-all opt-out: no analytics fire, the Calendly script is not loaded, and the cookie banner does not appear. The preferences modal still opens from the footer link, but non-essential toggles are locked off and a notice explains why. California (CCPA/CPRA), Colorado (CPA), and Connecticut (CTDPA) all legally require us to honor this signal as a valid opt-out.

We do not engage in “automated decision-making, including profiling” that produces legal or similarly significant effects on you under GDPR Art. 22. Our AI features generate human-reviewable summaries; they do not deny service, set pricing, or make eligibility decisions automatically.

• Account & tenant records: for as long as your account is active, plus 7 years for tax records.
• Scan results & reports: retained while your subscription is active; deleted within 30 days of account closure on request.
• Page-view rows: 24 months, then aggregated.
• Quiz sessions: 24 months, then deleted.
• Audit logs: 7 years (compliance requirement for procurement-grade work).
• Stripe payment records: retained by Stripe per their policy; we keep only metadata.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to or opt out of certain uses.

• California (CCPA / CPRA): right to know, delete, correct, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising — see our Do Not Sell or Share My Personal Information page.
• EU / UK (GDPR): rights of access, rectification, erasure, restriction, portability, and objection.
• Other U.S. states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island): comparable rights.

To exercise any right, email contact@adawcag.org or use the form on our Do Not Sell or Share page. We respond within 45 days (CCPA) or one month (GDPR), and we will not retaliate against you for exercising any privacy right.

We hash passwords with bcrypt, encrypt sensitive customer fields with AES-256-GCM envelope encryption (master key in a dedicated secret store), enforce per-tenant isolation in PostgreSQL, sign all webhooks, and rotate session tokens. The full technical posture is published at /security.

ADAWCAG.org is a B2B accessibility-compliance product. It is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact contact@adawcag.org and we will delete it.

Our infrastructure is hosted in the United States. If you access the service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on the EU Standard Contractual Clauses where applicable.

We may update this policy as the product evolves. The “Effective” date at the top reflects the most recent revision. Material changes will be announced by email to active customers at least 14 days in advance.

UAIU Holdings Corp
Attn: Privacy
contact@adawcag.org
530-808-5208