Privacy
What we do with your data
We collect your email address so you can have an account, receive what you bought, or receive our “what breaks next” email if you choose to subscribe. We hold the documents you upload only long enough to convert them, and handle deletion requests as described below. We may send a company one business offer about our pre-release defect hunt, as described below. We do not add the address to a mailing list. If you post a website request on Bark, we may make a free draft from it, and if we respond, Bark shares your contact details with us, as described below. We sell your data to nobody. We also receive information when you request our gated Hugging Face sample, as described below.
Effective 9 November 2026. Last updated 9 November 2026.
9 November 2026: We no longer offer the Canada check, so we removed the section on Canada check requests.
8 November 2026: In "Public PDFs you ask us to tag", we now say that copies we downloaded to prepare an offer before you asked are kept as "Offers to public bodies" says.
7 November 2026: We now say that the public documents we download to prepare an offer to a public body, our measurements of them and the records of our AI agents' work on them are kept in our company records and their backups and are not deleted on a schedule.
7 November 2026: We added a section on the notices we send to authors of papers we check, and listed those notices under "Email we send you".
6 November 2026: We now say that an offer to a public body or to a document-accessibility company can be up to three emails in one thread, that we send none after you reply or ask us to stop, and that a public body may get a free tagged sample made from one of its own documents.
4 November 2026: We now say that emails about a free tagged PDF are kept as long as emails about an order of tagged PDFs.
4 November 2026: We now describe the one business offer we may send to document-accessibility companies, where we get their address and how long we keep the record of it, and how long we keep the sample tagged PDFs we make from public documents to show them our work.
3 November 2026: The “what breaks next” email no longer goes out weekly. We send it before the dated breaks we pick to warn you about.
2 November 2026: We now say that pages we made from public PDFs and published on our website up to and including 30 October 2026, and the copies we made to review them, are kept in our company records and their backups as well as in our website's release history, and what we delete when we take down a page that shows a private person's details.
1 November 2026: We added To Scale, our free museum game: what it keeps on your device, what its daily request tells our server, how we count players from our web logs, and itch.io's role when you play there.
31 October 2026: In the section on our connector for Claude, we now say which daily counts we keep, why we keep them and for how long.
31 October 2026: We added a section on our connector for Claude.
31 October 2026: On 30 October 2026, we used our web logs once to count returning feed and calendar clients before this policy described that use. We now explain how we estimate repeat use by matching an IP address and user-agent string across days.
30 October 2026: We now sell accessible web pages from public PDFs and tagged PDFs for public documents. We added the offers we may send a public body and the contact details we use for them, how invoices for these orders are paid, and how long we keep the PDFs, the files we make and the records of our work on them.
28 October 2026: We now also sell the house cleaning pricing calculator, on the same terms as the pressure washing calculator.
28 October 2026: We added the small business website, which we offer through Bark, and explained the request and contact details Bark shares with us, the draft we may make before we respond, our basis for each use, the materials you send, draft images, the emails we send and how to stop them, payments and retention.
28 October 2026: We now sell the pressure washing pricing calculator, a downloadable spreadsheet, through Link, Stripe's checkout service, as merchant of record. We added what we keep from that purchase, and that our free calculators keep the numbers you type in your browser.
23 October 2026: We added the pre-release defect hunt and explained its one-time business offer, contact sources, service correspondence, payments and retention.
22 October 2026: The weekly email issue now runs on our own website and Amazon Web Services instead of EmailOctopus. We added the optional “What do you run?” answer, and updated newsletter retention, unsubscribe and deletion information.
22 October 2026: We added the Canada check, a paid container-image check, and explained request details, local test copies, payments and deletion.
22 October 2026: We added our Hugging Face sample access requests: the information shared with us, request counting, optional one-time follow-up email, retention and data requests, and Hugging Face's separate processing.
20 October 2026: We added an optional weekly email issue, explained EmailOctopus's processing and international data transfers, and added newsletter retention, unsubscribe and deletion information.
18 October 2026: We added notice of one-time support payments and Team checks interest mail, clarified the payer information we receive and Stripe's own processing, and explained interest-mail retention and data requests without an account.
Changed on 16 October 2026: we now sell Paid For, a downloadable pack. Buying it gives us your email address and a payment record through Link, Stripe's checkout service, and we may email buyers about their purchase. The sections below say what we keep and for how long.
What changed on 15 October 2026: we now say that we also use our web logs to count visits, including visits through links that carry a ?ref= marker and fetches of our feed, and that the logs are deleted within 90 days. On 28 September 2026 we added Cloudflare to the list of companies that receive your data, for the domain check on our email authentication page. We should have put a note here at the time. From 23 September to 14 October 2026, when we counted visits, we looked up which network visitors' IP addresses belong to, so that we could leave out mail-security scanners and cloud servers. Those lookups went through Cloudflare's public DNS resolver to Team Cymru, so both received those IP addresses. This page did not say so. We now use a downloaded table instead, so this lookup no longer sends your IP address to anyone.
What we collect, and why
Your email address and password. You give these when you create an account at cybernative.ai/account/. The address identifies your account, is where your confirmation and password-reset codes go, and is how we reply if you write to us. Your password is held by Amazon Cognito, the account directory we use — we never see it and cannot read it.
The documents you upload. When you start a job you upload PDFs. We store them so the conversion can run and so you can download the result. They are encrypted where they sit, are never public, and are opened only by the systems running your job and by a reviewer checking a job that got flagged.
Documents you email us. We do not take documents or files by email for a job; we work from a public link and a description. If you email us a document anyway, it is stored in our mailbox and the support tooling listed below may receive its contents. We never make it public, use it only to answer you, and delete it as described below.
The fields you ask for, and the output. The field names you choose, the rows we extract, and the five files every completed job delivers.
Your payment record. Payments for jobs and one-time support run on Stripe's hosted checkout. Card numbers go to Stripe and never reach us. Stripe collects payment, billing and device information directly. For jobs, we send limited identifiers for the job, account, offer, product, price and referral so we can match the payment to the job; we do not send your PDFs or extracted document content. Support payments buy no job and need no CyberNative account. Orders for accessible web pages and tagged PDFs are paid on an invoice page hosted by Stripe. To issue the invoice, we give Stripe the billing contact's name and email address, the organization's name and billing address, any purchase order number, and the batch and its price; we do not send your PDFs or the files we make. A tax exemption certificate you send us is kept with the payment record. Payment records include the amount, currency, date, payment status and payment or refund references, and the payer's email address, name and card-issuing country when Stripe provides them. We use these records to reconcile payments, handle receipts, refunds and disputes, meet accounting obligations, and count support payments. We do not use payer details for marketing or match them to browsing records.
If you buy Paid For. You pay through Link, Stripe's checkout service, which is the merchant of record. Link collects your email address and payment details, and whatever else it needs for payment and tax, and handles them under its own privacy policy. From Stripe we keep only the payment reference, the date, the amount and currency, and which plan you bought, and we use your email address only for the messages listed under "Email we send you". Your download page is not personalised: it holds no name, email or order details.
If you buy the pressure washing or house cleaning pricing calculator. You pay through Link, Stripe's checkout service, which is the merchant of record. Link collects your email address and payment details, and whatever else it needs for payment and tax, and handles them under its own privacy policy. From Stripe we keep only the payment reference, the date, and the amount and currency, and we use your email address only to answer you about a refund or a problem with the file. The download page is not personalised: it holds no name, email or order details.
Mail about Team checks and sponsorship. If you write to us, we receive your email address, the name you provide and your message. For Team checks, we ask for your team or organization and the runners, base images and runtimes you use. We use this information to discuss that service and decide whether to build it. We keep counts of interest and organization names for that decision, without copying private email addresses or message contents into those records. We use sponsorship mail to answer and discuss the sponsorship inquiry. These messages are stored by Zoho and processed by our support tooling as described below. We do not add you to a mailing list or send unrelated offers. Please send product names and versions only, not code, credentials, configuration files, internal hostnames or private repository or registry links.
Pre-release defect hunt. We obtain a company's published business or sales role address from its own website, and use public company, product and issue-tracker details to prepare the one-time offer described under “Email we send you”. If you reply, we use your message, name and email address to agree the scope, send reports and handle payment, refunds or disputes. Zoho stores these messages and our support tooling processes them as described below. We delete offer and hunt emails from our active mailbox within 90 days after the hunt is paid or closed and any refund or dispute is resolved. If no hunt is agreed, we delete the offer correspondence from our active mailbox within 90 days after our last message. This does not erase every copy: provider recovery copies and support-tool records and backups have the limits described below. We retain payment, refund and legal records where required by law, and the minimum stop record needed to avoid emailing you again. Stripe processes payments under the payment and Stripe disclosures on this page. The technical work uses public repositories and published packages only. Do not send credentials, private code or user data. You can request access, correction or deletion at hello@cybernative.ai without an account, under the process below.
Offers to public bodies. To offer accessible web pages and tagged PDFs, we use a contact address that a public body publishes on its own website for its web pages, accessibility or general questions, or the name and work address its site gives for a staff member responsible for those questions or for the document. We use public documents from its site to prepare an offer, described under "Email we send you". The public documents we download to prepare an offer, our measurements of them (such as page counts and accessibility check results) and the records of our AI agents' work on them are kept in our company records and their backups and are not deleted on a schedule. This stays true if you later ask for a free tagged copy of one of them: we make that copy from a new download. If you ask, we make a free tagged copy of one public document and send it only to you; we keep and delete it as "Public PDFs you ask us to tag, and the tagged files" says. If you reply, we use your message, name and email address to agree the work, deliver it and handle invoices, payment, refunds or disputes. Zoho stores these messages and our support tooling processes them as described below. We keep a record of each offer (the public body, the name and address we used, the date, and any reply or stop request) in our company records until you ask us to delete it. We then remove your name and address from our current records and keep only the minimum stop record needed to avoid emailing you again; earlier copies remain in those records' history and backups. You can request access, correction or deletion at hello@cybernative.ai without an account, under the process below.
Accessibility providers. To offer wholesale tagged PDFs, we use a business email address that a document-accessibility company publishes on its own website, or the name and work address that a public contract award lists as the company's contact. We use public details of its contracts, services and job postings to prepare a business offer, described under "Email we send you". We do not add the address to a mailing list. If you reply, we use your message, name and email address to answer you and, if you order, to do the work and handle invoices, payment, refunds or disputes. Zoho stores these messages and our support tooling processes them as described below. We keep a record of each offer (the company, the name and address we used, the date, and any reply or stop request) in our company records until you ask us to delete it. We then remove your name and address from our current records and keep only the minimum stop record needed to avoid emailing you again; earlier copies remain in those records' history and backups. You can request access, correction or deletion at hello@cybernative.ai without an account, under the process below.
Small business website requests through Bark. When you post a website request on Bark, Bark shows it to professionals, including us. Before we respond, we may read it and make a free homepage draft from it, using only what the request says; we do not put your private contact details in the draft. If we respond, Bark shares the contact details you gave Bark with us, which can include your name, email address, phone number and location. Bark and CyberNative AI LLC each handle this information as independent controllers; Bark's own processing, including the chat messages it stores, is covered by its privacy policy.
What we use it for, and our basis for each use:
- Reading your request and making the draft before you reply to us: our legitimate interest in answering a quote request you published to professionals. You can object at any time by replying STOP in the Bark chat or to our email, or by writing to hello@cybernative.ai; we then stop and handle the draft as if you had declined (see the deadlines below).
- Sending you the draft, agreeing the page list and quoting, after you reply: steps you ask us to take before a contract.
- Building and delivering your website after you pay, and handling changes, refunds and disputes: performing our contract with you.
- Keeping payment, refund and tax records: our legal obligations.
- Answering your other messages and keeping ordinary business correspondence: our legitimate interest in handling business contacts.
We do not phone or text you, add you to a mailing list or send you offers for anything other than the website you asked about. If you send us business details, a logo, photos or text, we use them only to build your site, not to train models, build datasets or advertise. We send your homepage draft and page previews as images by email; we do not publish them on any website.
We delete our active working copies of your request, your materials, the draft and the preview images, meaning the copies under our control, within 60 days after delivery; within 30 days after you decline, or after our last message if you do not reply; within 30 days after a paid job is cancelled or refunded before delivery; and within 30 days after we make a draft if we do not respond to your request. The finished files stay with you. These deadlines do not reach every copy. Records of our AI agents' work sessions (transcripts and run logs) can include your request and anything an agent viewed while working on it, including the draft; we delete them, together with the short extract of them held in our database, within 30 days after your job ends. Your job ends at the latest of these: our last message about a draft you declined or did not answer, delivery of your paid site, the day your paid job is cancelled or refunded before delivery, or, if we never respond to your request, the day we made the draft. The AI services we use to write and build (an image service and an AI model provider) process your request and images under their own terms. Emails we exchange about your website, including the draft and preview images in them, are deleted from our mailboxes within 30 days after your job ends; after we delete them, our email provider (Zoho) can restore them for up to 30 days, and then they are permanently purged. If you write to us from an email address that you have not given to us or to Bark, we add that address to your job once we see that the email is about your website, and from then on those emails and our copies of them are deleted on the same schedule. Our database backups can keep that extract for about 90 days after we delete it. We keep your materials out of our other company records; if a copy gets in by mistake, it can stay in backups for about 90 days after we delete it. Emails about your website are stored by Zoho and processed by our support tooling as described below. If you reply STOP, we send you no more email and keep a record of your STOP so that we can honour it.
If you pay, Stripe processes the payment and provides the payer and payment details described above for support payments; we use them to match your payment to your website and handle receipts, refunds, disputes and accounting. Our business records keep counts that do not identify you, without names, contact details or message contents. You can ask for access, correction or deletion at hello@cybernative.ai without an account, under the process below. Do not send passwords, card numbers or identity documents.
The “what breaks next” email. If you subscribe, CyberNative AI LLC uses your email address to send the “what breaks next” email. We ask for no name. We send a confirmation email, and the issue starts only after you press Confirm on the page it links to. Buying something or writing to us does not subscribe you. When you confirm, you can tell us what you run (for example the CI runners, base images and runtimes you use). That answer is optional. We use it to choose what each issue covers and count answers only in total, including when we decide what to build next. We never use it to email you separately or publish it, and we delete it if you unsubscribe. We store your address, the page you signed up on, the dates you signed up and confirmed, and whether you are subscribed, unsubscribed or your address bounced or complained. We do not keep the bounce and complaint notices themselves. We do not store your IP address, browser or location with your subscription. To limit abuse we use a keyed code derived from your IP address for one hour, separate from your subscription; it is then deleted automatically, normally within a few days. We keep aggregate subscriber counts, without copying addresses into those counts. When you follow a confirmation or unsubscribe link, our ordinary web logs record that request, including the code in the link, like any other page request. Each time we try to send you one of these emails, we keep a record of that attempt, which we use to avoid sending you the same issue again while the record is kept. It holds a keyed code of your address (not the address itself), the outcome of the attempt, and Amazon's message ID when Amazon returned one.
Hugging Face sample access requests. If you request access to our gated task sample on Hugging Face, Hugging Face shares your username, email address, Organization, Intended use, and your answer to “May we email you once about further tasks of this kind?” with CyberNative AI LLC, the owner of the CyberNative-AI repository. Its access records may also show your public profile name, the request date and access status. We use this information to provide access, count requests and the organizations requesting the sample, and assess interest in further tasks. If you choose Yes, we may send you one follow-up email about further tasks of this kind. Choosing No gives you the same access. Neither choice subscribes you to our newsletter, and we do not use the request to send unrelated offers or link it to your browsing activity.
The request records are held on Hugging Face and are available to the people and systems we authorize to manage the sample. We do not publish requester details or keep a separate requester mailing list. If we make a private export to count requests, we delete it after counting and within 24 hours. Our retained business records contain counts and organization names that do not identify an individual, without usernames, email addresses, profile names or raw field answers. We use a Yes answer only for the one follow-up; you can withdraw it before we send that email by writing to hello@cybernative.ai.
If we send the follow-up, our email provider and support tooling listed below process the email. We delete it from our active mailbox within 90 days after the last message if the discussion ends; mailbox recovery copies and support-tool records and backups have the limits described below. We keep a request to stop optional email only for as long as needed to honour it.
Hugging Face operates the platform under its own privacy policy, including its cookies, processing in the United States and other countries, and retention of platform records. Our 24-hour export limit does not delete those platform records, which can remain after dataset access ends. You can ask us for access, correction or deletion at hello@cybernative.ai from the address used for the request; no CyberNative account is needed. We handle requests about what we hold within 30 days and confirm what we did. For Hugging Face's own records, contact privacy@huggingface.co; we will assist with a request where we can.
Ordinary web logs. Our host records the usual: IP address, time, the page requested, the page you came from if your browser sends it, and your browser's user-agent string. Cookies are excluded from those logs. We use them to keep the site up, to spot abuse, and to count visits: how many visits from outside the company each page gets, how many arrive through a link we posted or emailed that carries a ?ref= marker naming where we shared it, and how many times our feed and calendar files are fetched. A marker on a link we emailed to one person can show us that the link was followed. We keep those counts; the logs themselves are deleted automatically within 90 days.
To estimate repeat use of our feed and calendar files, we temporarily match the IP address and user-agent string on requests to the same file across UTC days. A matching pair seen on at least two days counts as a returning client. This estimates clients, not people or confirmed subscriptions. We use only our web logs for this calculation, keep aggregate counts, and do not keep the matching pairs after the analysis. We do not link the pairs to accounts, email addresses or payments, or track them across other websites.
To Scale, our museum game. The game at toscale.cybernative.ai, also playable on its itch.io page, keeps your scores, the day you first played and the days you have finished in your browser's local storage on your device. It sets no cookies and gives you no ID or account. Each day the game asks our server for that day's objects. That request carries how many whole days ago you first played and how many days you have finished, each counted up to 30. It also carries a marker if you arrived from someone's shared result, or, on your first visit, a marker naming where you found the game: itch.io, or the place where we posted the link you followed. Our web logs record this request like any other. We use them to count players from outside the company: new players, players who come back one and seven days later, players who finish more than one day, and arrivals from shared results, from itch.io and from each place we posted. To count each browser once a day, we temporarily match the IP address and user-agent string within a single UTC day; we do not match them across days for the game, we keep only the counts, and the logs are deleted within 90 days as above. Clearing your browser's data for the site resets the game.
The free calculators on our tools pages run in your browser. The numbers you type are not sent to us and are not stored.
How long we keep it
| What | How long |
|---|---|
| Documents you upload | Deleted 30 days after upload |
| Documents you email us for a job | Deleted within 30 days of receipt |
| Job output files | Deleted 30 days after they are produced |
| A document-job download link | Expires 15 minutes after you ask for it |
| The Paid For download page | Does not expire; it holds no personal data |
| The pressure washing or house cleaning calculator download page | Does not expire; it holds no personal data |
| Your account and email address | Until you ask us to delete it |
| Payment records | As long as tax and accounting law requires |
| Paid For purchase details (payment reference, date, amount, plan) | While your purchase or subscription is active, then deleted within 90 days after it ends and any refund or dispute is settled; the payment record itself as long as tax and accounting law requires |
| Email about a purchase, refund or support request | Deleted within 90 days after it is resolved |
| Website requests: your request and contact details, the materials you send, draft and page preview images (active working copies under our control) | Deleted within 60 days after delivery; within 30 days after a paid job is cancelled or refunded before delivery; within 30 days after you decline, after our last message if you do not reply, or after we make a draft if we do not respond. These deadlines do not reach every copy. Records of our AI agents' work sessions (transcripts and run logs) can include your request and anything an agent viewed while working on it, including the draft; we delete them, together with the short extract of them held in our database, within 30 days after your job ends. Your job ends at the latest of these: our last message about a draft you declined or did not answer, delivery of your paid site, the day your paid job is cancelled or refunded before delivery, or, if we never respond to your request, the day we made the draft. The AI services we use to write and build (an image service and an AI model provider) process your request and images under their own terms. Emails we exchange about your website, including the draft and preview images in them, are deleted from our mailboxes within 30 days after your job ends; after we delete them, our email provider (Zoho) can restore them for up to 30 days, and then they are permanently purged. If you write to us from an email address that you have not given to us or to Bark, we add that address to your job once we see that the email is about your website, and from then on those emails and our copies of them are deleted on the same schedule. Our database backups can keep that extract for about 90 days after we delete it. We keep your materials out of our other company records; if a copy gets in by mistake, it can stay in backups for about 90 days after we delete it. Bark keeps its own copy of your request and chat under its own policy. |
| Public PDFs we turn into accessible web pages, and the pages we make from them | The unlisted links stay up 60 days after delivery, or for as long as you ask; our working copies of the PDF and of the pages are deleted no later than 30 days after the links come down. Records of our AI agents' work sessions (transcripts and run logs) can include the PDF's content; we delete them, together with the short extract of them held in our database, on the same schedule. Our database backups can keep that extract for about 90 days after we delete it. Except for the published pages described later in this row, we keep these documents out of our other company records; if a copy gets in by mistake, it can stay in backups for about 90 days after we delete it. The AI model provider we use processes the PDF and the pages under its own terms. Emails about these documents are kept as "Email about a purchase, refund or support request" says. Pages we made from public PDFs and published on our website up to and including 30 October 2026 (free sample pages, the check and defect reports we published with them, and the example pages we hosted to show a public body one of its own documents) are kept in our website's release history and its backups. Copies of those website releases that we made to review our work are also kept in our company records and their backups. We do not delete these copies on a schedule, and we take a link down when you ask. If we take a page down because it shows a private person's name, home address or similar personal details, we delete the copies in our company records within 30 days after the link comes down, and backups can keep a copy for about 90 days after we delete it; a copy stays in our website's release history and its backups. These documents are already public; we do not ask for or keep other documents. |
| Public PDFs you ask us to tag, and the tagged files | Deleted within 60 days after delivery, or within 30 days after we deliver a fix if that is later: the unlisted links, our copies of your PDF, of the tagged file and of its check report, and the records of our AI agents' work sessions (transcripts and run logs) that include them, together with the short extract of them held in our database. If you order nothing after our quote, deleted within 30 days after the quote. Our database backups can keep that extract for about 90 days after we delete it. Except for copies we downloaded to prepare an offer before you asked, which are kept as "Offers to public bodies" says, we keep your documents out of our other company records; if a copy gets in by mistake, it can stay in backups for about 90 days after we delete it. The AI model provider we use processes your PDF under its own terms. Emails about your order or a free file are kept as "Email about a purchase, refund or support request" says; we ask for links to your PDFs, not attachments. |
| Sample tagged PDFs we make from public documents to show public bodies and accessibility providers our work | To show public bodies and accessibility providers our work, we make tagged copies of documents that US public bodies publish. For each one, we host the tagged copy, our check report (with images of its pages and of each figure in it), the PAC 2024 report and the veraPDF result at unlisted links that search engines are asked not to index. These files can show the names of people that the public document itself prints, such as officials, staff or authors; they reproduce information in the public source documents, but we do not add the recipient's contact details or our outreach records to them. We take each link down 30 days after the reply period ends for the last offer that links to it (10 US business days after our last email about that offer), unless a body or company we wrote to asks us to keep it up or has an order open, and sooner if you ask. The original PDFs as we downloaded them, the tagged copies, the reports, our notes on the figures and the source links are also kept in our company records, and the hosted files in our website's release history; these copies and their backups are not deleted on a schedule and cannot be removed from that history. The AI model provider we use processes the documents under its own terms. If a sample shows a private person's name, home address or similar personal details, tell us at hello@cybernative.ai and we take its link down; you can also request access or correction there, under the process below. |
| A request to stop optional email | Kept for as long as we might otherwise email you, so we keep honouring it |
| Web logs | Deleted automatically within 90 days |
| Team checks interest mail in our active mailbox | While we discuss it with you; deleted within 90 days after the last message if the discussion stops, or within 90 days after we decide not to build, whichever deadline comes first. |
| Unconfirmed newsletter signups | No longer used after 21 days; deleted within 30 days of signing up |
| Newsletter subscriptions | Kept while you subscribe. If you unsubscribe, or your address bounces or complains, we delete your address and your “What do you run?” answer and keep only a keyed code of the address, so we never mail it again (for a bounce or complaint, Amazon SES also keeps the address itself; send records of past issues also stay until they expire; see the next rows). We keep that code while the newsletter operates and delete it within 30 days after the newsletter closes, unless the law requires longer. You can ask us to delete it sooner, as described below. |
| Newsletter send records | A record of each attempt to send you a “what breaks next” email, used to avoid sending the same issue again while it is kept: a keyed code of your address, the outcome of the attempt, and Amazon's message ID when available. Deleted about 90 days after that email, even if you unsubscribe; the deletion is automatic and can take a few days longer. If you ask us to delete your data, we delete these records then. |
| Newsletter exports | Only if we must move the list to another email service: deleted after use and within 24 hours |
| Newsletter bounce and complaint notices | Processed automatically and not kept. Before we process a notice, it can wait in Amazon's delivery queues: Amazon SNS retries delivery for up to about 23 days, and AWS Lambda's queue can then hold it for up to 6 more hours. If your address bounces or complains, Amazon SES also keeps it on its suppression list so we never email it; we remove it when you ask us to delete your data, and within 30 days after the newsletter closes. |
| Newsletter deletion copies | We keep no backup copies of our newsletter database; a deletion from it is final when we make it. Web logs, Amazon SES's suppression list and notices still in Amazon's queues follow the rows above. Legally required retention can last longer; if this applies to a deletion request, we explain what we must keep and why. |
The 30-day deletions of uploads and output files are an expiry rule on the storage itself, not a promise that somebody remembers to run something. Documents emailed to us for a job are deleted from our mailbox once the job is delivered, and never later than 30 days after they arrive. That deletion does not reach every copy: our email provider keeps deleted messages for a recovery period under its own policy, and the text of a message can remain in our support tooling's records and backups for longer. The Paid For download page works for anyone who has its address. Treat it like a shared link: anyone you send it to can download the pack. The same is true of the pressure washing or house cleaning calculator download page.
Deleting interest mail from our active mailbox does not erase every copy. Zoho keeps deleted messages for a recovery period under its own policy, and message text may remain in our support tooling's records and backups for longer.
Cookies
On CyberNative pages, two cookies, both first-party, both strictly necessary:
sid— keeps you signed in. JavaScript cannot read it.csrf— stops another site acting as you.
On CyberNative pages: no third-party analytics, no advertising, no third-party cookies, no cross-site tracking. Signed out, these pages set no cookies at all. These statements describe CyberNative pages. Stripe-hosted checkout and Link use their own cookies and collect information under Stripe's privacy policy.
Do Not Track
On CyberNative pages, we do not track you across other websites, so there is no cross-site tracking for a Do Not Track signal to switch off, and we do not change what we collect when a browser sends one. Stripe's hosted checkout and Link are covered by Stripe's privacy policy.
What we measure about how the product runs
We keep operational numbers about jobs, and they are linked to your account: how long a job waits, how long it takes, whether it failed, whether it was paid or refunded, and how much storage a job used. We use them to see whether the product works, and we do not use them to profile you, target advertising, or build audiences.
Who else sees it
Some of your information reaches companies we use to run the product:
- Amazon Web Services — hosting, file storage, the account directory, and the email it sends you on our behalf. Data for these website services is stored in the United States; this includes the “what breaks next” email: your subscription is stored and each issue is sent from AWS in the United States.
- Stripe — payments, when you buy a job or choose to support our work, and the matching identifiers described above. Stripe processes information on our instructions and also for its own purposes, including fraud prevention, security, legal compliance, and improving and developing its products and services. See Stripe's privacy policy for its data practices and your rights and choices, including when you use Stripe-hosted checkout or Link. For Paid For and the pressure washing or house cleaning pricing calculator, Stripe's Link service is the seller of record: it receives your payment and tax details as the seller, not only as our processor, and handles requests to delete them. Ask Stripe, or write to us and we pass the request on.
- Zoho — our email provider. If you write to us, Zoho stores that message.
- Cloudflare — only if you use the domain check on the email authentication page. Your browser asks Cloudflare’s public DNS resolver (1.1.1.1) for that domain’s public records, so Cloudflare receives the domain you type and your IP address. We receive neither.
- Bark — the marketplace where you posted a website request. It shares your request and contact details with us and stores its chat messages, as an independent controller under its own privacy policy.
- itch.io — only if you play To Scale on its itch.io page. itch.io runs that page under its own privacy policy and cookies. The game inside it asks our server for its objects, so our web logs record that request as described above. itch.io shows us totals for the page, such as views and plays.
- Our support tooling — where a message you send us is read and worked on, it is processed by the tools we use to answer support mail, which receive its contents. The same kind of tools write and build a website you ask us for, and receive your request and the materials you send.
We do not sell your data, and we do not share it with advertisers or data brokers. We would hand data to a court or a government only where the law requires it.
Email we send you
We send the following kinds of email:
- the codes that let you confirm your account or reset your password;
- a reply when you write to us;
- if you buy Paid For: one email when Pack 1 is ready if it was not ready when you paid, and messages about refunds, cancellation or a security problem with what you bought;
- if you subscribe to Paid For: at most one email a month with a link to that month's new rules, while your subscription is active.
- if you buy the pressure washing or house cleaning pricing calculator: only replies about a refund or a problem with what you bought.
- if you request our Hugging Face sample and choose Yes to the optional follow-up question: at most one email about further tasks of this kind; choosing No does not affect access.
- if you post a website request on Bark and reply to our response: messages about your request, draft, quote, payment, delivery and changes. Before you pay, these emails offer you the website you asked about, so they say so, give our postal address and tell you how to stop them: reply STOP and we send no more email to that address. We send no offers for anything else;
- For the pre-release defect hunt, we may send one offer to a company's business or sales role address published on its own website, after a maintainer has taken a non-rejecting action on our free public defect report. This action does not subscribe the company to email. We send no follow-up offer. Reply “stop” and we will send no more offers to that address.
- For accessible web pages and tagged PDFs, we may email an offer to a public body at an address its own website publishes, as described under "Offers to public bodies". Each offer is at most three emails in one thread: the first names one of the body's public PDFs, offers to make a free tagged copy of it if you ask, and may link to a sample we made from another public document, and we may send up to two short follow-ups about the same offer, about 4 and 10 business days later. We send none after you reply or ask us to stop. This does not subscribe the body to email. Reply "stop" and we will send no more email to that address.
- For wholesale tagged PDFs, we may send an offer to a document-accessibility company, as described under "Accessibility providers". It may link to a sample we made from a public document and offer to tag one public PDF of your choice free. The offer is at most three emails in one thread: the first and up to two short follow-ups about the same offer, about 4 and 10 business days later. We send none after you reply or ask us to stop. This does not subscribe the company to email. Reply "stop" and we will send no more email to that address.
Stripe sends payment receipts for support payments. We may reply about the inquiry you sent us, including telling you whether we build Team checks.
Your job's progress lives in your account, not in your inbox — we do not send job notifications.
If you separately subscribe and confirm, we also send the “what breaks next” email. Each of those emails has an unsubscribe link; using it needs no CyberNative account. We disable open and click tracking for newsletter emails: no open-tracking pixels and no tracking redirects on content links. Necessary confirmation and unsubscribe links still work. Links to our site may carry one common marker for that issue so we can count visits under “Ordinary web logs”; the marker does not identify a subscriber, and we do not link those visits to subscriber records. To stop optional Paid For monthly email, reply “stop” and we stop before the next one. That does not cancel your Paid For subscription or remove your download; to cancel, see the Paid For section of the terms.
Our connector for Claude
If you use our "public PDF accessibility check" connector in Claude, Claude sends us the tool you used and the links you gave it. We do not receive your conversation, your name or your account details.
What we do with them: we download each PDF from its public website, check it, and send the result back to Claude. We keep no copy of the PDF after we answer.
What we log: the tool used, the host name of the website (for example www.example.gov, not the full link), the result and the time. The logs are set to expire after 7 days. Amazon Web Services then deletes them, usually within 3 more days and in rare cases later. We also keep a count of calls per day for each tool, and how many of them were our own test calls. From these we note whether anyone other than us used each tool in the period we are measuring. The counts hold no host names, links, results or times of day. We use them only to see whether the connector is used, and we keep them with no set end date.
Who else is involved: the connector runs on Amazon Web Services, which hosts it for us. We do not sell or share this information with anyone else. Your use of Claude itself is covered by Anthropic's privacy policy.
If you then email us for a confirmed quote, the sections above headed "Offers to public bodies", "Your payment record" and "How long we keep it" apply.
Questions or deletion requests: hello@cybernative.ai.
Getting your data, and getting it deleted
- Delete my account. Write to hello@cybernative.ai from the address on your account, or the address you paid with. We handle it manually: within 30 days we delete your account and email address from our directory, your uploaded documents and output files, your operational job records, and the support email you sent us. We keep the payment, refund and legal records we are required to keep. As with emailed documents, our email provider keeps deleted messages for a recovery period, and the text of your messages can remain in our support tooling's records and backups for longer. We write back to confirm when it is done. For a Paid For, pressure washing calculator or house cleaning calculator purchase, we delete what we hold except the payment and refund record the law requires us to keep; Stripe holds its own records as seller and handles requests to delete them. A deletion request to Stripe also cancels any Paid For subscription.
- Send me my data. We send you what we hold about you.
- Fix something. Tell us what is wrong and we correct it.
- No account needed. If you subscribed to the newsletter, emailed us or made a support payment, you can ask for access, correction or deletion by writing to hello@cybernative.ai from the address you used. We handle the request within 30 days and confirm what we did. A newsletter deletion request removes the contact record, rather than merely unsubscribing it, subject to the legal and backup limits described above. We retain payment, refund and legal records that we are required to keep; mailbox recovery copies and support-tool records and backups have the limits described above. Stripe handles requests about its own processing under its privacy policy. Do not send card numbers or identity documents with your request.
You do not have to give a reason, and it costs nothing.
Children
Our paid products are for businesses and not for anyone under 16. To Scale, our free museum game, is a general-audience game, not made for children: it has no accounts, chat or free text, so it collects nothing beyond the request log and counts described above. We do not knowingly hold data about children.
Changes to this page
This policy takes effect on the effective date shown at the top, and that date changes whenever the page changes.
If we make a material change — a new kind of information collected, a new purpose, a new company that receives your data, or a shorter list of things you can ask us to do — we say so on this page: for thirty days after a material change, a dated summary sits at the top of this policy describing what changed. Checking this page is enough to find out; you do not have to ask us.
Who we are
CyberNative AI LLC, a California LLC. Write to hello@cybernative.ai.