# Pageloom Privacy Policy Last updated: July 28, 2026 ## 1. About This Policy This Privacy Policy explains how Pageloom ("Pageloom," "we," or "us") collects, uses, and protects your personal data when you use our service (the "Service"). If you have any questions about this Privacy Policy or our data practices, you can contact us at hello@pageloom.ai. ## 2. Who This Policy Applies To This Privacy Policy applies to registered users of the Pageloom service (the "Service"). The Service is an AI-powered tool that remediates PDF documents for accessibility by adding structural tags. If your documents contain personal data about other people, you are responsible for ensuring you have the right to upload and process that data, including providing any required notices to those individuals. Pageloom processes your documents on your behalf to provide the Service. ## 3. Data We Collect and Sources We collect the following categories of personal data: - Account data: your email address, hashed password, and (if you sign up with Google) the name and email associated with your Google account. - Document content: the PDF files you upload and the remediated PDFs we produce. These may contain personal data of you or third parties. - Metadata: file names, page counts, file sizes, upload and processing timestamps, job status, credit balance, pages remediated, and storage usage. - Analytics data: approximate region (derived from your IP address), browser type, language, pages viewed, and referral attribution (which link or post you arrived from), collected through our first-party analytics. We do not use cookies for analytics. - Billing data: your email address and name are passed to our payment processor to create a customer record. We collect this data directly from you when you create an account, upload documents, or purchase credits. Analytics data is collected automatically when you interact with the Service. ## 4. How We Use Your Data and Legal Bases We use your personal data for the following purposes: - To provide the Service: creating and maintaining your account, processing and remediating your documents, and delivering the tagged output. Legal basis: we need this to provide the service you requested. - To process payments: managing credit purchases and recording transactions via our payment processor. Legal basis: we need this to provide the service you requested. - To communicate with you: sending verification emails, password reset links, and transactional notices. Legal basis: we need this to provide the service you requested, and, where applicable, your consent. - To operate, secure, and improve the Service: monitoring usage, detecting and preventing fraud or abuse, troubleshooting, and maintaining system security. Legal basis: our legitimate interests in operating and protecting the Service. - To comply with legal obligations: retaining records as required by law. Legal basis: we need to do this to comply with our legal obligations. ## 5. Recipients and Sub-Processors We share personal data with the following categories of recipients, each acting under appropriate contractual obligations: - Hosting and infrastructure: Hetzner (cloud hosting for our backend, database, and analytics). - Object storage: Cloudflare (storage for uploaded and remediated PDF files). - AI compute and inference: Modal, OpenRouter, and Google. - Payment processing: Stripe. - Transactional email: Zoho ZeptoMail. - Product analytics: Umami (first-party, no third-party tracking). We do not sell your personal data. We do not share your personal data for cross-context behavioral advertising. We may disclose personal data where required by law or to protect our rights and safety. ## 6. International Data Transfers Some of our service providers may be located outside your country. Such transfers are subject to safeguards under applicable data protection law. ## 7. Retention We retain your personal data as follows: - Account data: retained for as long as your account is active, until you request deletion. - Document content (uploaded and remediated PDFs): retained for as long as your account is active, until you request deletion. - Metadata: retained for as long as needed to operate the Service and until you request deletion of your account. - Analytics data: retained for as long as needed to operate and secure the Service. - Billing records: retained as required by law and per the retention practices of our payment processor. We maintain nightly encrypted backups of our database for disaster recovery. These backups are retained for approximately 7 days. If you request deletion of your data, we will remove it from our live systems promptly, and it will be permanently removed from all backups within approximately 7 days as the backup rotation cycles. We do not restore deleted data from backups except to recover from a verified system failure. ## 8. Security We implement administrative, technical, and physical safeguards designed to protect your personal data, including encryption in transit, access controls, and secure storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. For questions about our security practices, contact hello@pageloom.ai. ## 9. Artificial Intelligence Processing The Service uses artificial intelligence and machine learning models to analyze and remediate your documents. Key points: - We do not use your documents or their contents to train, fine-tune, or improve any AI models, whether our own or those of our providers. - LLM inference is routed through OpenRouter with zero data retention (ZDR) enforced, so inference requests are only sent to providers that do not retain prompt or response content and do not use it for training. - Document analysis runs on ephemeral GPU compute infrastructure (Modal), where your documents are processed in memory and exchanged directly with our object storage. Your documents are not stored on our AI processing infrastructure after remediation completes. - Processing is automated; we do not use AI to make decisions about you that produce legal or similarly significant effects. ## 10. Automated Decision-Making We do not engage in automated decision-making that produces legal or similarly significant effects concerning you. The AI processing described above analyzes document content you provide; it does not evaluate or make decisions about you personally. ## 11. Your Privacy Rights If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR, including the rights to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with your local data protection supervisory authority. If you are a California resident or a resident of another U.S. state with a comprehensive privacy law, you may have rights including the right to know, delete, or correct your personal data, opt out of its sale or sharing, and limit the use of sensitive personal information. We do not sell or share your personal data. To exercise any of these rights, contact us at hello@pageloom.ai. We will verify your identity and respond within the timeframe required by applicable law. ## 12. Sensitive Personal Information Your documents may contain sensitive personal information (such as health data, racial or ethnic origin, or other special categories). We process such content only as necessary to provide the Service. We do not knowingly collect sensitive personal information from you beyond what is contained in documents you upload for remediation. ## 13. Children's Data The Service is not intended for children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected personal data from a child, contact hello@pageloom.ai and we will delete it. ## 14. Cookies and Analytics We use first-party, privacy-focused analytics (self-hosted Umami). Our analytics does not use cookies and does not track you across other websites. It collects anonymized usage data such as pages viewed, browser type, language, and approximate region derived from your IP address. We use your browser's local storage to remember your theme preference (light, dark, or system). This is stored only on your device and is not used for tracking. We do not use third-party advertising or tracking cookies. ## 15. Links to Third-Party Sites, Changes, and Contact The Service contains links to third-party websites (such as our payment processor and calendar booking service) that are not operated by us. We are not responsible for their privacy practices. We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. If we make material changes, we will provide notice where reasonably appropriate. For any questions or requests regarding this Privacy Policy, contact us at hello@pageloom.ai.