Privacy Policy

Civessa is a service provided by Quantra Technology & Innovation, Inc.("Quantra," "we," "us"). This Privacy Policy explains how we collect, use, and share information when you use civessa.com and our accessibility-compliance software (the "Service"). By using the Service you agree to this Policy and to our Terms of Service.

1. Information we collect

• Account information. The email address you use to sign in (via a passwordless magic link) and, for your organization, the name and mailing address you provide for reports and mailed letters.
• Content you submit. The website URLs and documents you register for scanning, and the pages and files we retrieve from those public websites in order to run accessibility checks and generate accessible equivalents.
• Billing information. Purchases are processed by Stripe. We receive confirmation of payment and limited metadata (such as the plan and amount); we do not receive or store your full payment-card number.
• Usage and device data. Standard log data such as IP address, browser type, and pages viewed, used for security, rate-limiting, and diagnostics.

2. How we use information

We use information to provide and operate the Service — crawling and scanning the sites you register, generating remediations and reports, maintaining your evidence ledger, sending transactional and digest emails, dispatching optional physical mail, processing payments, providing support, preventing abuse, and complying with law. We do not sell your personal information.

3. Service providers (subprocessors)

We share information with vendors who process it on our behalf, only as needed to run the Service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — transactional and digest email delivery.
• Lob — optional physical mail (attestation letters, certificates).
• OpenAI — generating accessible document equivalents from extracted text.
• Amazon Web Services (Textract, S3) — optical character recognition for image-only documents.

These providers are bound by their own terms and privacy commitments. We may also disclose information if required by law or to protect the rights, safety, and security of Civessa and its users.

4. The evidence ledger

A core function of the Service is an append-only, hash-chained record of scanning and remediation activity. Because the ledger's integrity depends on it being tamper-evident, individual ledger entries are not edited or deleted in the ordinary course. If you close your account, we will delete or de-identify your data as described below, subject to records we must retain for legal, accounting, or fraud-prevention purposes.

5. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. After account closure we delete or de-identify personal information within a reasonable period, except where retention is required by law or necessary to resolve disputes and enforce our agreements.

6. Security

We use administrative and technical safeguards — encrypted transport, scoped access controls, and per-organization data isolation — to protect your information. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

7. Your rights and how to exercise them

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. Residents of California and other U.S. states with comprehensive privacy laws have these rights, and we do not sell or "share" personal information for cross-context behavioral advertising.

• Access and correction. Your organization details, websites, document inventory, remediations, and full evidence ledger are visible and editable on your dashboard at any time.
• Copy of your data. Email privacy@civessa.com from your account address and we will send a machine-readable export within 30 days.
• Deletion. You can remove individual websites and their inventories from the dashboard. To close your account and delete your data entirely, email the same address; we will confirm and act within 30 days, subject to section 4 and to records we must keep for legal, accounting, or fraud-prevention purposes.
• Email preferences. Every digest and update carries an unsubscribe link, and you can opt out at any time at civessa.com/unsubscribe. Essential account messages — payment, delivery, and security notices — are still sent.

8. Cookies

We use strictly necessary cookies to keep you signed in and to secure the Service. We do not use third-party advertising cookies, and we do not run third-party analytics — so there is no consent banner to click through.

9. Children

The Service is intended for public entities and businesses, not for children, and is not directed to anyone under 16. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and, for material changes, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.

11. Contact

Questions about this Policy or your data? Email privacy@civessa.com. Civessa is operated by Quantra Technology & Innovation, Inc., organized under the laws of the State of Florida, United States.