This Privacy Policy describes how Base22, LLC, which offers the Ockem products and services (“Ockem,” “we,” “us”), collects, uses, and protects information when you use ockem.com, proof.ockem.com, and the Ockem products and services (the “Services”). Questions or requests can be sent to info@ockem.com at any time.
1. Information we collect
Information you give us.
- Contact and waitlist forms — your name, email address, organization, and message when you contact us or join an early-access waitlist.
- Documents you submit — PDF files you upload or send us for checking, remediation, or certification, which may themselves contain personal data. Ockem Proof is not offered for documents that contain protected health information (PHI) or FERPA-protected student education records, and we do not yet sign Business Associate Agreements, so please do not upload such documents (see Security and procurement).
- Account and billing details — if you create an account or purchase paid services, the information needed to provide and bill them.
Information collected automatically.
- Technical logs — standard server logs such as IP address, browser type, requested pages, and timestamps, used for security and operations.
- Bot check on the free trial and sign-up — the free-trial and sign-up forms on proof.ockem.com use Cloudflare Turnstile to tell people apart from automated abuse. It runs a short check in your browser that sends Cloudflare technical signals about your browser and connection, including your IP address. We use the result only to decide whether to accept that submission.
- Document metadata during assessments — when we assess a website’s published documents, we record metadata about each document (URL, page count, file size, tagging status, encryption flag, producing software, and HTTP caching headers). In the inventory stage each document is processed in memory and discarded, leaving only that metadata. The deep-analysis sample — 12 documents by default, up to 100 for requests we qualify — is stored and deleted 30 days after it is taken. When we prepare an assessment by importing your published documents in full, every stored copy is deleted 90 days after the assessment’s last activity; the analysis results and the assessment report are kept.
2. What we use it for
- providing the Services — checking, remediating, and certifying the documents you submit;
- responding to inquiries and managing waitlists;
- operating, securing, and improving the Services;
- billing and account administration;
- complying with legal obligations.
We do not sell personal data, and we do not use your documents for any purpose other than providing the Services to you — except to train our models where your workspace has turned that on, or has agreed to it for a free evaluation, as described below.
Training our models — only where you turn it on. Separately from operating and fixing the Services, we may use the documents processed in your workspace and the corrections made to them to train and evaluate our own accessibility models — only where an administrator of your workspace has turned that on. It is off by default, and it can be turned off again in workspace settings at any time (except during a free evaluation, below). When it is on, we use the document’s structure tree (the tags describing headings, lists, tables, figures and reading order), page renders, the differences between one version of a document and the next, and the review decisions your team recorded. We use them only to improve our own accessibility models. We never sell them, never share them with other customers, and never give them to a third party to train its own models. Turning it off stops future use; it does not remove material already used before it was turned off. Free-trial uploads are never used for training.
Publicly published documents that Ockem collects itself — for example, the PDFs on a public website we crawl to prepare an assessment — may be used to improve our own accessibility models. They are never sold and never shared with another customer. This does not apply to documents you upload or process in a workspace, which follow the setting above.
What the setting does not cover. Whether or not training is on, we keep records of how our own checks and fixes performed on your documents — which checks failed, which fixes ran, and whether they worked — to operate the Services and fix them when they fail. Those records can include short excerpts of a document, such as the line a check flagged, a heading, or a title, but never a complete copy. When they are not enough to explain a failure, an Ockem engineer may open the document to diagnose it; that access is limited to the people who need it, is used only to fix what went wrong and support you, and is never used to build a training dataset.
Free evaluations. If we provide your organization with a free evaluation of Ockem Proof — a dedicated workspace with an agreed number of free documents for an agreed period — the use of the documents processed in that workspace, and the corrections made to them, to train and evaluate our own accessibility models is a condition of the evaluation. An administrator of your organization accepts it on the organization’s behalf before the workspace opens, or it is accepted in a written agreement with us made before the workspace is set up; we record who accepted it and when. Until then the training setting is off and nothing in the workspace is used for training. While the evaluation runs, including its read-only period, the setting stays on and cannot be turned off in the workspace. You may end the evaluation at any time, in the workspace’s settings or by telling us, which stops future use. If you purchase, the workspace becomes an ordinary paid workspace and the setting stays on until an administrator turns it off, which they may do at any time. If you do not purchase, the workspace and its contents are deleted as described in section 4 and are no longer used for training. The limits in the paragraph above apply in full: we use these materials only to improve our own accessibility models, never sell them, never share them with other customers, and never give them to a third party to train its own models.
3. Cookies and analytics
Our public pages — ockem.com and the free-trial pages on proof.ockem.com — use Google Analytics to understand how visitors find and use them: which pages are viewed, where visits come from, and where the free-trial flow is abandoned. We configure it with IP anonymization and without Google advertising signals, and we use it for no advertising purpose. If you are visiting from a region whose law requires consent, no analytics run until you allow them in the banner; everyone can decline or change their choice at any time via the Analytics preferences link in the page footer. Analytics never run on the signed-in application surfaces, and Google never receives your documents.
Beyond that, we use no advertising trackers or social-media pixels, and the only other cookies set are strictly necessary ones — for example, a session cookie when you sign in to the application.
4. How long we keep it
- Free-trial files and assessment triage samples — automatically deleted within 30 days.
- Documents imported in full to prepare an assessment — deleted 90 days after the assessment’s last activity. The analysis results and the assessment report are kept.
- Free-evaluation workspaces — if the evaluation period ends without a purchase, the workspace stays read-only for 30 days (unless your evaluation offer states otherwise) and is then scheduled for deletion 30 days later. Purchasing before deletion keeps the workspace. An evaluation you end early stays read-only until you purchase or ask us to delete it.
- Assessment metadata — retained for the duration of the engagement so re-crawls can skip unchanged files, then deleted on request.
- Form submissions — kept as long as needed to respond and maintain our business records; deleted on request.
- Paid-service documents and certificates — retained as agreed in your order or engagement; certificates and their verification records are retained so issued certificates remain verifiable.
- Server logs — retained for a limited period for security and troubleshooting.
5. Who we share it with
We share personal data only with service providers who process it on our behalf to run the Services. The current list is:
- Cloudflare — edge network and TLS termination for ockem.com and proof.ockem.com. Sees traffic in transit, including pages and files served to you; stores none of your documents.
- Stripe — payments and checkout. Receives your name, email and billing address. Stripe never receives your documents.
- Microsoft 365 — our email. Receives your email address and the content of messages you send to @ockem.com addresses. Microsoft never receives your documents.
- Anthropic — AI inference for Ockem Read only. For Ockem Proof, document content does not leave Ockem infrastructure: all Proof model inference runs on hardware we operate, and the external provider is not in the Proof inference path. For Ockem Read, generation uses Anthropic’s API, which receives the prompt and, where the task requires it, a rendered image of the page.
- Sentry — error reporting on the Proof application (proof.ockem.com), where enabled. Receives diagnostic context that can incidentally include identifiers. ockem.com does not use Sentry.
- Google (Google Analytics) — visitor analytics on our public pages only, as described in section 3. Receives technical usage data such as pages viewed, referrer, and an anonymized IP address. Google never receives your documents, your account data, or anything from signed-in surfaces.
- Cloudflare (Turnstile) — the bot check on the free-trial and sign-up forms, as described in section 1. Receives your IP address and technical signals about your browser. The check never sends Cloudflare your documents or your email address, and Cloudflare states it does not use this data for advertising or to track you across sites.
Your documents are not hosted by a third party. No cloud hosting provider stores your documents: the Services run on infrastructure Ockem operates. Cloudflare sits in front of both sites as an edge network, as listed above. Apart from that traffic in transit, the single exception in which document content can leave our infrastructure is Ockem Read’s generation, described above; Ockem Proof documents do not leave it.
We will update this list before adding a new subprocessor. We may also disclose information if required by law, or as part of a corporate transaction involving Ockem or Base22, in which case this policy continues to apply to previously collected data. We do not sell your data, and we do not share it for anyone else’s advertising or model training.
6. Security
Traffic to the Services is encrypted in transit (TLS). Access to submitted documents and personal data is restricted to personnel who need it to provide the Services. No method of transmission or storage is 100% secure, but we work to protect your information with measures appropriate to the risk.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise any of these rights, email info@ockem.com — we will respond within the timeframe required by applicable law. If you are a customer’s end user and your data appears in a document a customer submitted to us, we will refer your request to that customer, who controls the document.
8. International transfers
We are based in the United States, and the Services are provided from there. If you use the Services from elsewhere, your information will be transferred to and processed in the United States.
9. Children
The Services are for business use and not directed to children under 16. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date above reflects the current version, and material changes will be posted on this page.
11. Contact
Privacy questions and requests: info@ockem.com, or through the contact form.