Privacy policy
Last updated 11 November 2026
This policy explains what personal data Legibright uses and why. Legibright is provided by Ironbit Ltd (company NI729290, 15 Longfield Lane, Desertmartin, Magherafelt, BT45 5NW, Northern Ireland; ICO registration ZC265119), which is the controller for the data described here. Contact: privacy@legibright.app.
Your documents
Legibright runs inside Google. It reads only the Doc, Slides deck or Sheet you have open, and only while you use it. Document content is never sent to Ironbit, stored by us or used to train any AI. Fixes are made directly in your file by Google's own services.
When you mark an item as OK, Legibright stores a short code for that item and the rule version in the file's own add-on storage, so everyone editing the file sees the same list. If Google does not offer file storage, it is stored in your own Google account's add-on storage instead.
Reports are created in your browser. The report data travels after the "#" in the report link, which browsers do not send to any server, so the report is never received by us.
What we do receive
- Your email address, when the add-on checks whether you have Pro. We use it to look up your licence and keep it only as part of your subscription record. Lawful basis: contract.
- Billing details, if you buy Pro or a school licence. Payments are handled by Stripe, which receives your card details directly; we never see them. We keep the email address, plan, subscription status and, for schools, the school name, billing email and any purchase order number. Lawful basis: contract and legal obligation (tax records are kept for 6 years).
- Technical logs from Cloudflare, which hosts this site and our licence service: IP address, browser, time and the page requested, kept for a short time for security. The checkout, billing and invoice links you open from the add-on contain your email address, so it can appear in those logs; the regular licence check sends it privately and does not. Lawful basis: legitimate interests in keeping the service secure.
We do not use cookies, analytics or advertising trackers on this site or in the add-on.
Who we share it with
Stripe (payments), Cloudflare (hosting and licence storage) and Google (which runs the add-on). Some of these process data outside the UK; they do so under the UK International Data Transfer Addendum or equivalent safeguards. We do not sell personal data.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it, by emailing privacy@legibright.app. We reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Google user data
Legibright's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described here. It is never sold, used for advertising, used to train or improve AI or machine-learning models, or sent to AI services, and no person at Ironbit reads it.
| Permission | What Legibright accesses | Why | Stored by us? |
|---|---|---|---|
| See and change the Doc, Slides deck or Sheet you have open (documents.currentonly, presentations.currentonly, spreadsheets.currentonly) | The text, headings, lists, tables, images, alt text, colours, links, language and title of that one file, only while Legibright is open in it | To check it against WCAG and, when you click Fix, to make the change in the file. Items you mark as OK are saved in the file's own add-on storage. | No. It stays in Google. |
| Your language setting (script.locale) | Your Google language and region | To show Legibright in your language and pick the WCAG standard for your country | No |
| Your email address (userinfo.email) | The email address you are signed in with | To check whether you, or your school's domain, has Pro | Only if you buy Pro or a school licence, as part of that subscription record |
| Connect to an external service (script.external_request) | Sends only your email address, signed, to our licence service at app.legibright.app | To look up your licence and open checkout, billing and invoice pages | As above |
How we protect your data
All connections use HTTPS (TLS). Document content never leaves Google. Requests from the add-on to our licence service are signed with a secret key, and the service only accepts signed requests. Licence records are stored encrypted at rest by Cloudflare. Card details go straight to Stripe and we never see them. Only the two people who run Ironbit can reach our systems, and their accounts use two-step verification. If a breach affects your data, we will tell you and the ICO within 72 hours.
How long we keep data
- Document content: never stored by us.
- Licence and subscription records: while your subscription is active and for up to 12 months after it ends, so a renewal picks up where you left off. Then they are deleted.
- Billing and tax records: 6 years, as UK law requires.
- Security logs: kept by Cloudflare for a short time, within Cloudflare's own limits.
- Items marked as OK: kept in your file's add-on storage until you delete the file or remove the add-on.
To have your data deleted sooner, email privacy@legibright.app and we will do it within 30 days. You can remove Legibright's access at any time from your Google Account, under Security, Third-party apps and services.
Changes
If this policy changes, we will update the date above and, for significant changes, tell subscribers by email.