Privacy Notice

The short version

We collect the minimum needed to run an account: your name, email address and username.
Your documents are processed to produce your output and are deleted automatically after 24 hours.
We do not sell your data, run advertising, or use third-party analytics or tracking cookies.
The only cookie we set is the one that keeps you signed in.

What we collect

Account information

Your username, display name and email address, the date you created the account, and which version of the Terms you accepted. Your password is stored only as a salted one-way hash — we cannot read it, and neither can anyone who obtains the file.

Documents you upload

The files you submit, the document properties you enter (title, author, subject and so on), the remediation options you choose, and the outputs and reports produced from them.

Operational logs

Standard server records: timestamps, IP address, account name, the action taken, and errors. These exist to keep the Service secure and working — for example to rate-limit sign-in attempts and investigate failures.

We do not use analytics services, advertising networks, tracking pixels or third-party cookies.

Why we hold it

To provide the Service — process your documents and return the results to your account and nobody else's.
To secure the Service — authenticate you, limit abuse, and investigate security incidents.
To communicate about your account — confirm your email address, reset your password, and notify you of material changes to the Terms. We do not send marketing email.

How your documents are processed

Uploaded files are processed on the server that hosts this Service. Each job is bound to the account that created it; other users cannot see or download it.

Where AI-assisted features are enabled — such as generated alt text or suggested document properties — the relevant text is sent to a language model hosted on infrastructure operated for this Service. It is never sent to a commercial AI provider.

Quality improvement. When the automated checks go badly — failed compliance checks, an unusual number of warnings, a low audit score, or a processing error — a copy of that document, its outputs and its reports may be retained beyond the normal deletion window and used to improve this Service's own remediation models. These copies are accessible only to administrators, are used only to improve this Service, and are never shared with or sold to anyone else.

Documents are not shared with any third party except where we are legally required to do so.

How long we keep it

Uploaded files and outputs: removed from the server as soon as you download them (unless you untick the delete-after- download option), when you sign out, or after about 30 minutes of inactivity — whichever comes first, and about 24 hours after processing at the very latest. You can also delete any job manually at any time. Exception: documents the automated checks flagged as problematic may be kept longer for quality improvement, as described above; those copies are deleted once reviewed.
Account record: kept until you ask us to delete your account.
Server logs: retained for a limited period for security and troubleshooting, then rotated out.

Cookies

One cookie, used to keep you signed in. It is HttpOnly, SameSite=Lax, marked Secure over HTTPS, and expires when your session does. It contains no personal information beyond your session state. There are no advertising or analytics cookies, so there is nothing to opt out of.

Security

Traffic is served over HTTPS. Passwords are hashed. Sign-in attempts are rate limited, forms are protected against cross-site request forgery, and a strict Content Security Policy is applied. Uploads are checked by content — not just by file extension — and macro-bearing files are rejected. Each job is isolated to its owner.

No system is perfectly secure. Please do not upload classified, export-controlled or highly sensitive personal data.

Your choices

Access and correction — change your password under Account. Your account holds only the name, username and email address you supplied at signup.
Deletion — delete any job from its page to remove its uploaded file and outputs from the server immediately. Everything else is deleted automatically after 24 hours in any case.
Minimising what we hold — the Service keeps nothing you do not give it. If you would rather we held no record of you at all, do not create an account.

Depending on where you live, you may have additional statutory rights over your personal data. Because the Service is operated as an unattended tool with no support channel, the practical way to exercise them is to delete your jobs and stop using the Service; the account record itself contains only what is listed above.

Changes to this notice

If this notice changes materially we will update the effective date at the top of this page and show a notice in the Service. We do not send announcement email — the only messages the Service sends are address confirmation and password resets.

No contact channel

EZ508 is an unattended, self-service tool. It publishes no support or contact mailbox, and it will never email you except to confirm your address at signup or to send a password-reset link you asked for. Those messages come from an unmonitored no-reply address; replies to them are not read.