Privacy Policy

1. Data controller and contact details

1.1 The data controller is Hasan Tayem, a sole trader established in Italy, trading as "Accessibility Pro" (the "Controller", "we", "us"). References to "you" are to the individual whose personal data is processed.

1.2 All privacy enquiries and requests to exercise the rights in clause 10 must be addressed to support@accessibilitypro.app

1.3 The Controller has not appointed a Data Protection Officer, none being required under Article 37 GDPR for processing of this nature and scale.

2. Scope

2.1 This Policy applies to personal data processed through the website at accessibilitypro.app, the scanning service accessible through it, and the Accessibility Pro GitHub Action (together, the "Service").

2.2 This Policy does not apply to the websites you instruct us to scan. Where a scan of a third party's website causes personal data to be processed, you act as controller in respect of that data and we act as processor on your instructions, in accordance with clause 12.

3. Categories of personal data processed

3.1 Account data. Your email address and a hashed password, held on our behalf by Supabase Auth. Where you sign in with Google, Google sends us your name, your email address and whether Google has verified it, the address of your profile picture, and an identifier for your Google account; we do not receive your Google password or any other data from your Google account, and such an account has no password with us unless you set one. Where you enable two-factor authentication, the authenticator secret is held in the same store. We do not at any time receive or store your password in plain text. When a password is set or changed it is checked against known breach corpora using a partial-hash protocol under which only the first five characters of its SHA-1 digest are transmitted, so the password itself is not disclosed to the checking service.

3.2 Scan data. The URL you submit, the pages reached by the crawler, the findings produced (rule identifier, WCAG success criterion, element selector, an HTML fragment of the element concerned, and contrast measurements), the resulting score, and the time of each request made to the target site. Scan data may incidentally contain personal data where such data is present in the markup of the page scanned.

3.2A Page screenshots. Where the page-screenshot feature is in operation, a scan requested from an account also stores one picture of each page scanned (up to 500 pages per scan), together with the position on that picture of each element a finding concerns, so that the report can show where the finding is. A picture shows the page as any visitor would see it and may therefore contain personal data that the page displays. Pictures of pages reached behind a sign-in are treated differently, as set out in clause 3.3. Scans made by the free checker, by the GitHub Action and by scheduled monitoring store no pictures.

3.3 Authentication credentials for login-gated scans. On the Developer, Team and Business plans you may supply a login URL, a username and a password so that the scanner can reach pages behind a sign-in form. Those credentials are used for the single scan session for which they are supplied. They are not written to the scan record and are not otherwise retained. The full source of pages reached behind a sign-in is not retained; the findings from those pages are kept as described in 3.2, including the short HTML fragment, accessible name and page title of each element concerned. A picture of a page reached behind a sign-in (clause 3.2A) is stored only after all text, images and drawn graphics on the page have been hidden, so that it shows the layout of the page and not its content; where that cannot be confirmed for a page, no picture of that page is kept. The sole exception is a scan for which you tick "This is a test account: do not blur screenshots": the pictures of that scan are then stored as the pages appear, and you should tick it only where the account holds no personal data.

3.4 Billing data. Payment card details are collected and held by Stripe and are never received by us. We store your Stripe customer identifier, the plan you hold, and the subscription events Stripe sends to us.

3.5 Usage data. A count of scans performed per account per month, for the purpose of enforcing plan limits, and the cost of each artificial-intelligence request made on your behalf.

3.6 Enquiry data. Where you submit your email address on the pricing page, that address and the plan you enquired about.

3.7 Feedback data. Any rating you give a finding, together with any free-text comment you add.

3.8 Analytics data. Only where you accept analytics cookies: a pseudonymous identifier stored in a cookie, the type of page you view (for example "report", never which report), campaign tags present in the link you followed, the website that referred you (its domain only), and the device, browser, approximate location and time information that Google Analytics derives from each request. Also which of our own buttons and forms you use (for example that the free checker was run, that a plan was chosen, or that an account was created), never the address you checked, the text you typed or your email address.

3.9 Free checker data. Where you use the free checker without an account: the address you submit, the short result, and your IP address as a counter for the daily limit. None of it is written to a database; it is held in the memory of the scanning server only. If you ask for the result by email, see clause 3.10.

3.10 Checker result emails. Where you ask the free checker to email you a result: your email address and the result of the check you ran, used to send that one email. Your address is not stored once the email is sent. If you also tick the box asking for occasional updates, we store your email address, the address of the page you checked, the exact wording you agreed to and the time you agreed.

3.11 Academy waitlist. Where you join the waitlist on the Academy page: your email address, the answer to "What do you do?" if you give one, the exact wording you agreed to and the time you joined. We do not ask about disability or the assistive technology you use.

4. Purposes and legal bases

4.1 Provision of the Service - creating and maintaining your account, running the scans you request, producing and storing reports, and making prior reports available for comparison. Legal basis: performance of a contract to which you are party, Article 6(1)(b) GDPR.

4.2 Billing and plan administration - taking payment, applying plan limits, and maintaining the subscription. Legal basis: Article 6(1)(b) GDPR, and Article 6(1)(c) GDPR in respect of the retention of accounting records.

4.3 Security, abuse prevention and service integrity - rate limiting, detecting and preventing misuse of the Service, and diagnosing errors. Legal basis: our legitimate interests in protecting the Service, our users and third party websites from misuse, Article 6(1)(f) GDPR.

4.4 Improving detection accuracy - using feedback you submit on a finding to refine the precision of the rule that produced it. Legal basis: our legitimate interests in improving the accuracy of the Service, Article 6(1)(f) GDPR.

4.5 Responding to enquiries - contacting you about a plan you asked about. Legal basis: steps taken at your request prior to entering into a contract, Article 6(1)(b) GDPR.

4.6 Measuring use of the website - counting visits to each page and where visitors arrive from, using the analytics data in clause 3.8. Legal basis: your consent, Article 6(1)(a) GDPR, given through the cookie banner and withdrawable under clause 11.3.

4.7 Sending a checker result you ask for - emailing the result under clause 3.10. Legal basis: performing the service you requested, Article 6(1)(b) GDPR.

4.8 Occasional updates - news about Accessibility Pro, sent only where you ticked the box in clause 3.10. Legal basis: your consent, Article 6(1)(a) GDPR. You may withdraw it at any time by replying to any update or writing to the address in clause 1.2, and every update will carry a link that withdraws it in one step.

4.9 Academy news - one email confirming you joined the waitlist in clause 3.11, then news of the Academy's opening and occasionally of its courses before then. Legal basis: your consent, Article 6(1)(a) GDPR. You may withdraw it at any time with the link in every such email, by replying to one, or by writing to the address in clause 1.2.

4.10 Where we rely on legitimate interests, you may object at any time under Article 21 GDPR by writing to the address in clause 1.2.

5. What we do not do

5.1 We do not operate advertising technologies on the website, and analytics run only with your consent under clause 4.6. Google Signals and advertising features are disabled in our Google Analytics configuration. We do not sell personal data, and we do not share it for advertising or marketing purposes.

5.2 We do not scan websites other than those you instruct us to scan.

5.3 We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Artificial intelligence is used to draft explanatory text and proposed code changes for findings; it is not used to make decisions about you.

6. Recipients and processors

6.1 We disclose personal data to the following categories of recipient, each acting as our processor under Article 28 GDPR and each bound to process it only on our documented instructions:

• Supabase - database and authentication services.
• Railway - hosting of the scanning backend that retrieves and analyses pages.
• Cloudflare - hosting and delivery of this website.
• Stripe - payment processing and subscription management. Stripe acts as an independent controller in respect of payment card data it collects directly.
• Anthropic - the artificial-intelligence model that generates plain-language explanations and proposed code changes. It receives the finding and the HTML fragment surrounding it. Where the alt-text accuracy check is switched on for your plan, Anthropic also receives a picture of the image being checked, together with its alt text, so the two can be compared; see clause 6.4. It does not receive your account details.
• Google Analytics (Google Ireland Limited) - website analytics, only where you have consented under clause 4.6. It receives the analytics data in clause 3.8 and does not receive your account details.
• Resend - email delivery for the emails we send you: account and plan emails, a checker result you ask for, and Academy waitlist emails. It receives your email address and the content of the email.
• Sentry - error reporting, which may include the URL of the page on which an error occurred.
• Have I Been Pwned - the partial-hash breach check described in clause 3.1.
• GitHub - where you use the GitHub Action, GitHub issues the signed token that attributes the run to your repository.

6.2 We may also disclose personal data where required to do so by law, or where necessary to establish, exercise or defend legal claims.

6.3 A current list of processors is maintained in this clause. It is updated when a processor is added or removed.

6.4 Images sent for the alt-text accuracy check. One check compares an image against the words that describe it, which cannot be done without looking at the image. Where it runs, we send Anthropic a screenshot of that image as it appeared on the page, together with its alt text, and ask only whether the two could describe the same thing. If the answer is no, the same screenshot and alt text are sent once more, alone, to a second Claude model, and the finding is reported only if it agrees. This is the only feature that sends any part of a scanned page as a picture rather than as text.

6.5 That check is off unless we have switched it on for your plan, and it is bounded: at most forty images per scan, at most eight from any one page, and never an image that is marked decorative or hidden from assistive technology. If a page you scan contains photographs of people, or a screenshot showing someone else's data, those images are what would be sent. Scan only what you are entitled to scan, and if that is not acceptable for a given site, switch AI off under clause 6.7.

6.6 Anthropic processes this material as our processor under Article 28 GDPR, on our documented instructions and for no other purpose. It is not used to train their models. Anthropic may keep it for a limited period under its commercial terms, for example to detect misuse of its service, and then deletes it. We keep no copy of the image: what we store is the finding's text.

6.7 You decide whether your scans use AI. Your Account page has a setting, "Use AI in my scans", which is on unless you switch it off. While it is off, no scan of your account sends anything to Anthropic, and each report states that AI was not used. A single scan requested through the API or the GitHub Action can also be run without AI. A scan that signs in to your site uses no AI, unless you have allowed it with the second setting on your Account page, which is off unless you switch it on.

7. Transfers outside the European Economic Area

7.1 Certain of the processors named in clause 6 are established outside the EEA, or process data on infrastructure located outside it. Where personal data is transferred outside the EEA, that transfer is made on the basis of an adequacy decision of the European Commission under Article 45 GDPR where one applies to the recipient country or framework, and otherwise on the basis of the European Commission's standard contractual clauses adopted under Article 46(2)(c) GDPR.

7.2 You may request further information about the safeguards applied to a particular transfer by writing to the address in clause 1.2.

8. Who can read a report

8.1 Every report is private to the account that requested the scan. A person who is signed out, signed in to a different account, or in possession of the report's address alone receives the same response, which is that the report does not exist. Reports additionally carry instructions to search engines not to index them.

8.2 You may share an individual report by generating a share link from the report itself. That link carries a secret of its own. A person holding it may read that one report, comprising the findings, the score, the pages scanned and the page pictures described in clause 3.2A. They do not obtain access to your account, to your other reports, or to the stored copy of the page source, and they cannot generate a further link of their own.

8.3 A share link ceases to function 30 days after it is generated, unless you renew it, which makes the same link function for 30 days from the renewal. A share link may also be withdrawn at any time, which causes it to cease to function, or replaced, which withdraws the previous link and issues a new one. None of these operations affects the report. Until a link is generated, no such link exists.

8.4 Scans initiated by the GitHub Action are the sole exception, and only to the extent necessary: the Action writes a link to the report into your pull request, where the reader has no account with us. Those scans are therefore created with a share link already attached, unless the Action is configured to request none or share links are switched off for the account. The report's address without that link remains inoperative.

8.5 A share link is a credential. You should treat a link you distribute as you would treat the document it opens.

8.6 When a report is opened through a share link, we record the time of that opening and which link was used, and we show the owner of the report how many times the link has been opened and the date of the most recent opening. Openings within the same minute are recorded once. We do not record who opened it: no IP address, browser details or other identifier of the reader is stored in that record. The record is deleted together with the report.

9. Retention

9.1 Account data and scan data are retained for as long as your account subsists, so that comparison between successive scans of the same site remains possible, unless you delete them sooner under clause 9.1A, 9.1B or 9.2.

9.1A You may delete any of your reports at any time, from the report or from your dashboard. The scan, its findings, its page pictures and any manual test results saved for it are deleted, its share link ceases to function, and none of this can be restored. Three things remain. Where the scan counted towards a monthly allowance of your plan, we keep its date and which allowance it used, so that deleting a report does not give the allowance back; that record holds no address and nothing from the report, and it is deleted two months after the scan, or with your account if sooner. For about a week we also keep the identifier of the deleted report, so that a scan still in progress cannot bring it back. AI explanations of its findings are kept for reuse, under a code computed from each finding, with no link to the report or your account.

9.1B You may set a retention period of 30, 90, 180 or 365 days on your Account page. No period applies unless you set one. While a period is set, a process that runs every hour deletes each report older than it, in the same way as under clause 9.1A, except that the most recent report of each scheduled monitor is kept.

9.2 You may delete your account yourself, from your Account page. Any paid subscription is cancelled first, and the account is then deleted at once, together with every scan attached to it. You may instead ask us to delete it by writing to the address in clause 1.2; deletion is then effected without undue delay and in any event within one month of the request.

9.3 The credentials described in clause 3.3 are retained only for the duration of the scan session for which they are supplied.

9.4 Stripe retains invoice and transaction records for the period required by applicable tax and accounting law, independently of any deletion of your account.

9.5 Free checker data in clause 3.9 is kept for at most 24 hours, and is lost sooner whenever the scanning server restarts. Your IP address is used only to apply the daily limit, under clause 4.3.

9.6 An email address given only to receive a checker result is not stored once the email is sent. Where you asked for updates under clause 3.10, the details stored there are kept until you withdraw your consent or ask us to delete them.

9.7 Academy waitlist details in clause 3.11 are kept until you leave the waitlist or ask us to delete them. Leaving marks the record as withdrawn, and nothing more is sent to that address.

9.8 The page pictures in clause 3.2A are kept for the three most recent scans of a site that have them; those of older scans are deleted when a newer scan of that site completes, and the older reports remain available without pictures. The pictures of a scan that fails or is cancelled are deleted. All of them are deleted with your account. A picture is served only through a link that expires after ten minutes, issued to a person entitled to read the report under clause 8.

10. Your rights

10.1 Subject to the conditions and exceptions in the GDPR, you have the right to obtain confirmation as to whether your personal data is processed and access to it (Article 15); to obtain rectification of inaccurate data (Article 16); to obtain erasure (Article 17); to obtain restriction of processing (Article 18); to receive the data you have provided in a structured, commonly used and machine-readable format and to have it transmitted to another controller (Article 20); and to object to processing carried out on the basis of legitimate interests (Article 21).

10.2 Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

10.3 Requests should be made to support@accessibilitypro.app We will respond without undue delay and in any event within one month of receipt, which period may be extended by two further months where necessary having regard to the complexity and number of requests, in which case we will inform you within the first month.

10.4 You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The Italian supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it.

11. Cookies and local storage

11.1 Strictly necessary. Cookies that establish and maintain your sign-in session, and values in your browser's local storage recording your light or dark theme preference and your answer to the cookie banner, and one value in session storage recording that you closed the banner with the Escape key, which your browser deletes when you close the tab. These are necessary for the provision of a service explicitly requested by you and are therefore exempt from the consent requirement in Article 5(3) of Directive 2002/58/EC as transposed by Article 122 of the Italian Personal Data Protection Code.

11.2 Analytics, with consent. The Google Analytics cookies _ga and _ga_PYF5M6ZND5, which distinguish visits and expire after two years. They are not set, and the Google Analytics script is not loaded, unless you choose "Accept" in the cookie banner. Choosing "Decline", closing the banner with the Escape key, or leaving the site without choosing, sets neither.

11.3 You may change your choice at any time through "Cookie settings" at the foot of every page. Withdrawing consent stops further collection and deletes the analytics cookies from your browser.

12. Where we act as your processor

12.1 In performing a scan we process the content of the website you nominate on your instructions. To the extent that content contains personal data, you are the controller and we are your processor within the meaning of Article 4(8) GDPR.

12.2 In that capacity we process such data only to perform the scan and produce the report, apply confidentiality to it, engage the sub-processors listed in clause 6, apply the security measures in clause 13, assist you so far as reasonably practicable with requests made to you by data subjects, and delete the data on termination of your account.

12.3 You warrant that you are entitled to instruct a scan of each website you submit, as required by clause 4 of the Terms of Service

13. Security

13.1 We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR. These include transport encryption for all traffic to the website and the API, storage of passwords in hashed form only, authentication of every request for report data against the account that owns it, and restriction of scan targets so that private and internal network addresses cannot be reached.

13.2 No method of transmission or storage is wholly secure, and we do not represent that the Service is immune from compromise. Where a personal data breach occurs we will notify the competent supervisory authority, and where required you, in accordance with Articles 33 and 34 GDPR.

14. Children

14.1 The Service is intended for use by businesses and by professionals acting in the course of their trade. It is not directed to children, and we do not knowingly process the personal data of a person under the age of eighteen. If you believe such data has been provided to us, write to the address in clause 1.2 and it will be deleted.

15. Changes to this Policy

15.1 We may amend this Policy from time to time. The date of the current version appears at the head of this page. Where an amendment materially affects the processing of your personal data, we will notify account holders by email before it takes effect.