Skip to main content

BetaEncludo is in open beta and free to use while it is. Tell us what breaks.

Privacy Policy

Last updated: 25 August 2026

Our commitment

Encludo is built by Purple Aware Technologies, and designed around what people with disabilities actually need from a website. Privacy is fundamental to trust. We collect the minimum data necessary to provide our service, treat disability information with the strictest legal protections under both GDPR and India's DPDP Act 2023, and never sell your data.

What disability profile means in our system

When a visitor selects a profile in the widget — Reading Comfort (for low vision), Reading Aid (for dyslexia), Focus Mode (for ADHD), Larger View (for seniors), or any of the tone-conditioning profiles surfaced through the AI chat — we treat that selection as data concerning health under GDPR Article 9 and sensitive personal data under DPDP Act 2023. As a result, in our system:

  • The selection is stored on the visitor's device only (browser localStorage).
  • It is never transmitted to our servers as a stored record, never written to a database, and never present in any analytics event tied to a session, device, or visitor.
  • It is never used as an identifier for billing, lookup, lead-gen, or marketing.
  • The dashboard's aggregate profile breakdown is built from anonymous counters (one Redis increment per site per day per profile) — these counters carry no session ID, no device fingerprint, and no IP address. There is no path back to an individual visitor.

What we collect — by surface

Widget visitors (the people using the accessibility tools)

The widget honours three consent levels, inherited automatically from your site's consent management platform (Cookiebot, OneTrust, TrustArc, CookieYes, Osano, or your own implementation):

  • None (default): nothing leaves the device. The widget works fully — accessibility preferences, AI chat, voice input, translation — using only browser storage. No analytics, no session ID, no network call beyond what each feature itself needs.
  • Functional: a single anonymous page-view counter so site owners can see the widget is loading. No event details, no device data, no geography.
  • Analytics: aggregate event stream — which features were used, anonymous random session ID (rotates per browser tab), country only (region/city dropped), parsed browser/OS (raw User-Agent never stored), no IP address ever stored.

Visitors can also use Do Not Track or Global Privacy Control; either signal overrides the site's consent decision and downgrades collection to None.

AI chat interactions

  • The chat message you type is forwarded to a third-party LLM (see subprocessors below) for one inference, then discarded. It is never written to our database, log, or analytics event.
  • Before forwarding, the message is passed through a PII scrubber that masks email addresses, phone numbers, long digit sequences, and Indian PAN numbers as a defence-in-depth layer on top of the provider's zero-data-retention contract.
  • Conversation history (last six turns) lives only in the browser's sessionStorage — it dies the moment the tab closes.
  • The abuse-tracking identifier we send to the LLM provider is a daily-rotating anonymous hash derived from the website ID. It is not a user identifier, not stable across days, and cannot be linked back to any visitor.
  • We never train any AI model on user interactions, ever, even with consent.

Voice input

  • Speech recognition runs in the browser via the Web Speech API. The audio waveform never leaves the device — only the resulting text transcript is transmitted, and only if the visitor sends the message.
  • No biometric voice ID, no voice-print analysis, no speaker recognition.

Translation cache

  • Translated page content is cached in Redis (30-day TTL) to reduce cost and latency.
  • Cache contains text content from your public web pages only — no personal data, no user-tied keys.

Account data (dashboard users)

  • Email address and bcrypt-hashed password for authentication.
  • Organisation name and website domains for service configuration.
  • Billing information processed by a PCI-compliant payment provider — never stored by us.

LLM subprocessors

When you use AI features (chat, simplification, page audit, translation), your text is sent to one of the following providers depending on your plan and region:

  • Anthropic (Claude) — commercial terms. Zero-data-retention configured on our org; the abuse-tracking metadata.user_id we send is the daily-rotating hash described above.
  • OpenAI — API data usage policies. store: false set per request; default API behaviour is no training on inputs.
  • Google Gemini (planned migration to Vertex AI for production traffic with EU residency).
  • Self-hosted Ollama — available for enterprise deployments that require on-premise inference; no third-party data flow.

Speech subprocessor

  • Sarvam AI (Bengaluru, India) — terms. Generates the natural voices used by "Read aloud". Only the assistant's reply text is sent — never your typed message, and never page content. The request is made server-to-server from our backend, so your IP address and device are not disclosed to Sarvam. Generated audio is cached for up to 14 days, keyed on a hash of the spoken text, and carries no identifier for you. Processing is India-resident. On by default since 25 August 2026 (previously off unless the site owner enabled it); site owners can switch it off per domain, after which Read aloud uses your browser's own voices and nothing is sent to Sarvam.

Page content

Some assistant features read the page you are on — summarising it, answering questions about it, taking you to a link you name, or rewriting it in plainer language. For those, the page's text and structure (headings, landmarks, link and button labels, form field labels) are sent to one of the LLM subprocessors above for a single inference and then discarded. Personal details are stripped by the same scrubber applied to chat messages before anything leaves our network. Site owners can turn all of this off per domain with a single Page access switch, after which no page content is transmitted at all.

Storage and security

  • All data is encrypted in transit (TLS 1.2+) and at rest.
  • Passwords are hashed with bcrypt; API keys and widget keys are hashed before storage.
  • Database access is restricted to authorised services; internal access requires SSO + MFA.
  • AI request paths use a redacted JSON logger that strips message, history, content, and profile fields by default. A CI guardrail fails the build if any new code logs raw user input.

Visitor rights — built into the widget

Every accessibility-widget visitor has, without contacting us:

  • A "Reset & forget me" button in widget settings that wipes every Encludo-namespaced key from localStorage and sessionStorage on their device — preferences, onboarding flag, chat history, translation cache, and analytics session ID.
  • A "Clear chat" button to drop the in-tab conversation without affecting other settings.
  • A first-open privacy notice stating that the message will be forwarded to an AI service and never stored.

Dashboard user rights (GDPR / DPDP)

You have the right to:

  • Access your personal data (export from the dashboard or via support).
  • Request deletion of your account and associated data.
  • Export your analytics data in CSV or JSON.
  • Object to processing or withdraw consent at any time.
  • Lodge a complaint with your supervisory authority (e.g. India Data Protection Board, EU member-state DPA, California AG).

Regulatory alignment

  • India — DPDP Act 2023: notice (Sec. 5), consent (Sec. 6), purpose limitation (Sec. 5(7)), data minimisation (Sec. 8(3)), storage limitation (Sec. 8(7)), right to erasure (Sec. 12), and cross-border transfer rules (Sec. 16). Disability information is treated as sensitive and never tied to identity.
  • EU — GDPR (2016/679): Art. 5 principles, Art. 6 lawful basis, Art. 9 special-category protection for disability data, Art. 13 notice, Art. 17 erasure, Art. 20 portability, Art. 28 processor agreements, Art. 44–49 cross-border safeguards.
  • California — CCPA/CPRA: notice at collection §1798.100(b), right to know §1798.110, right to delete §1798.105, opt-out via DNT/GPC per CCPA Regs §7025.
  • Accessibility — RPWD Act 2016 (India), GIGW 3.0, IS 17802, EU EAA, ADA Title III: the widget itself is the compliance instrument; this policy describes the privacy contract under which it operates.

Children

Encludo is general-audience and not directed at children. Under DPDP Act 2023 Sec. 9, processing personal data of any individual under 18 in India requires verifiable parental consent. If a host site embedding our widget is child-directed, the host site must comply with COPPA / GDPR Art. 8 / DPDP Sec. 9 directly — the widget cannot enforce that boundary on the site's behalf.

Contact

For privacy questions or data requests, email privacy@encludo.com. India data principals may contact our designated grievance officer at the same address.