Collect less. Explain it clearly. Keep it only as long as needed.

Effective September 3, 2026

1. Information you provide

When you use the contact form, we collect the name, email address, website URL, service interest, and message you choose to provide. We use this information to review the request, respond, prevent abuse, and maintain a reasonable record of the conversation.

Please do not include Social Security numbers, government identification numbers, financial account details, payment-card information, medical information, biometric data, passwords, or confidential third-party information.

2. Public website scan data

A free mini-scan observes a publicly available home page and may record the URL, page markup needed to evaluate the checklist, visible technology signals, accessibility candidates, page size and element counts, security-header results, and screenshots or element references needed to explain a finding.

Unsolicited or pre-engagement scans are limited to a public home page, honor robots.txt and X-Robots-Tag, use per-domain rate limits, and are generally cached for approximately 30 days to avoid repeated requests. A request not to scan is added to a permanent suppression list.

From that same page — from that page and no other, and without any request beyond the ones the check has already made — we also pick out any email address published on it, together with where on the page it appeared. We do that so that if we write to you at all, we write to an address you chose to publish rather than one we guessed at.

3. Authorized client assessments

Multi-page, interactive, authenticated, or deeper technical assessment begins only after a signed agreement confirms the client controls the site and authorizes the scope. The agreement may describe additional client data, retention, access, and deletion terms. If the agreement conflicts with this general policy, the agreement controls for that engagement.

4. Scan-library publication

The public library may display a business name, public website address, scan date, checklist version, directional score, and category scores from a public-page scan. Screenshots, detailed findings, contact information, and client materials remain private unless the owner approves publication.

5. Technical request data

The hosting and security infrastructure may process ordinary request information, such as IP address, browser type, device information, request time, and pages requested, to deliver the site, maintain security, and diagnose failures. Uditus does not intentionally deploy advertising or cross-site tracking cookies on this site.

6. How information is used

• Respond to inquiries and provide requested services.
• Perform and explain scans within the applicable scope.
• Improve the checklist, report quality, and recognized defect patterns.
• Protect the service, prevent duplicate scans, and honor opt-outs.
• Meet contractual, accounting, insurance, and legal obligations.

7. Email we send you

If we email you, our mail provider tells us what happened to that message: whether it was delivered, whether it was opened, and whether a link in it was followed. We record those three signals against the message.

They are used for one thing: deciding whether to write again, and what to say. We will write to any one address at most three times in total — the first message and at most two follow-ups — and a reply, a bounce, a spam report or an unsubscribe stops the sequence permanently and immediately. The signals never appear in the text of an email we send you.

Unsubscribing stops the recording as well as the sending. This is ordinary email delivery reporting; it tells us nothing about you beyond what you did with our own message, and nothing about your visits to this website or to yours.

8. Who else sees your data

Uditus may share information with hosting, database, monitoring, document, and other service providers that process information to operate the service. We may also disclose information when required by law, to protect rights or safety, or as part of a merger, financing, acquisition, or transfer of the business subject to appropriate protections.

We do not sell personal information, rent contact lists, or provide scan findings to third parties for advertising.

9. Retention and security

We retain information only as long as reasonably necessary for the purposes above, to honor suppression requests, and to satisfy contractual or legal requirements. Suppression records may be retained indefinitely so a request not to scan or contact is not forgotten.

Uditus uses reasonable administrative, technical, and organizational safeguards. No online service can guarantee absolute security, and this policy does not make such a guarantee.

10. Your choices

You may ask Uditus to stop contacting you, stop scanning a domain you control, correct contact information, or delete information when no retention obligation applies. Use the business record request formand identify the domain or request clearly. We may need to verify that you control the affected email address or website.

Adding an address or a domain to our suppression list stops what happens next: no further contact, and no further scanning. It does not by itself erase what is already recorded. Say in the same message that you want it deleted and we will delete what we hold about your site, including any email address we picked off a page we scanned, and write back when it is done. Ask at help@uditus.com or through the form above; no explanation is needed and none will be requested.

11. Children

The Uditus service is intended for businesses and adults. It is not directed to children under 13, and Uditus does not knowingly collect personal information from children under 13.

12. Changes to this policy

We may update this policy as the service changes. The effective date above identifies the current version. Material changes will be presented through a reasonable notice on the site or through the client relationship when appropriate.

13. Contact

Questions, privacy requests, and scanning opt-outs can be submitted through the Uditus contact form.