The controller of your personal data is [PROPRIETOR NAME], a sole proprietorship established in India, trading as StoreA11y, at [FULL POSTAL ADDRESS]. Contact: [CONTACT EMAIL].
We have not appointed a Data Protection Officer, as we are not required to. Enquiries go to the address above.
1. What we collect
When you run a scan
- The website address you submit, and the hostname it resolves to. This is the subject of the service.
- The results of the scan — the pages tested, the accessibility issues found, and small excerpts of the public HTML of those pages as evidence. This is content already published by the site being scanned.
- Your IP address, recorded briefly and solely to enforce rate limits.
- Your email address, if you supply one for delivery.
When you buy
- Your email address, the order identifier, amount, currency and status, returned to us by Lemon Squeezy.
- We never receive your card details. Payment is handled entirely by Lemon Squeezy as merchant of record.
What we do not collect
There are no accounts and no passwords. We run no analytics, no advertising pixels, no session recording and no cross-site tracking. We do not set tracking cookies. Your browser stores two things locally on your own device — your theme preference and the scans you have run from that browser — which never leave it and which clearing site data removes.
2. Why, and on what legal basis
| Data | Purpose | Basis (UK/EU GDPR) |
|---|---|---|
| URL, scan results | To perform the scan you asked for | Performance of a contract |
| Email address | To deliver your results and report | Performance of a contract |
| IP address | Rate limiting and abuse prevention | Legitimate interests |
| Order records | Accounting and tax | Legal obligation |
| Monitoring alerts | To tell you when new issues appear | Performance of a contract |
| Prospecting scans | To contact a business about defects on its public site | Legitimate interests |
3. Prospecting scans and cold outreach
We state this plainly because it is the part people most object to. We sometimes scan the publicly reachable pages of online stores that have not asked us to, and contact the business address published on that store about what we found.
- We only scan pages that are public, and we honour
robots.txt. - We contact business addresses, about that business’s own website.
- Every such message carries a working unsubscribe link and our postal address.
- Unsubscribe and we stop, permanently. You may also object to this processing at any time under Article 21 GDPR, and we will stop and delete the scan.
4. How long we keep it
| Data | Retention |
|---|---|
| Free scans and their results | [90 DAYS] from the scan, then deleted |
| Paid reports and PDFs | [24 MONTHS], so your link keeps working |
| Rate-limit records (IP) | 24 hours, deleted automatically |
| Order records | 8 years, as required by Indian tax law |
| Monitoring subscriptions | Until cancelled, then [90 DAYS] |
Ask us to delete sooner and we will, except where we are legally required to keep an accounting record.
5. Who processes it for us
| Processor | Role | Where |
|---|---|---|
| Supabase | Database and file storage | [REGION] |
| Lemon Squeezy | Payments, merchant of record | United States |
| Resend | Transactional email | United States |
| [HOSTING PROVIDER] | Application and scanner hosting | [REGION] |
We do not sell personal data, and we do not share it for advertising. Transfers outside the UK/EEA rely on the European Commission’s Standard Contractual Clauses, entered into with each processor.
6. Your rights
If UK or EU data protection law applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable format. Where we rely on consent you may withdraw it at any time.
Write to [CONTACT EMAIL]. We answer within 30 days. If you are not satisfied you may complain to your supervisory authority — in the UK, the Information Commissioner’s Office; in the EU, the authority for your country. Indian residents may raise a grievance with us under the Digital Personal Data Protection Act, 2023 at the same address.
7. Security
Data is encrypted in transit. Reports live in a private bucket and are served only through short-lived signed links. Database access is protected by row-level security, and the keys that can bypass it exist only on our server. Reports are reached by an unguessable identifier rather than a password — which means anyone you send the link to can read it, so treat it accordingly.
No system is perfectly secure. If a breach is likely to result in a high risk to you, we will tell you and the relevant authority without undue delay.
8. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
9. Changes
Material changes will be published here with a new effective date. See also our Terms of Service and Refund Policy.