Privacy Policy

Account information. When you sign in with Google, we receive your email address, name, and profile picture from Google. We do not request or access your Gmail, contacts, or any other Google data beyond basic identity.

Client and site data you provide. Names, logos, and brand colors for the clients you manage, and the URLs of the sites you scan.

Scan data. The URLs you scan, the pages we crawl, and the accessibility findings we detect — including a short, truncated, and sanitized snippet of the offending HTML for each finding (not the full page source).

Public scanner data. If you use the free scanner on our homepage without signing in, we store the URL you entered and your IP address, used only to enforce our 3-scans-per-day rate limit.

Payment information. Subscriptions are billed through Polar.sh, our payment processor and merchant of record. We never see or store your card details — Polar handles that directly.

Technical and error data. We use Sentry to catch and diagnose errors, and Vercel Analytics/Speed Insights to understand aggregate traffic and page performance. Neither is used to build cross-site advertising profiles.

• To operate the Service: run scans, generate reports, and manage your account and subscription.
• To send you transactional email (scan complete/failed notices, team invitations, billing receipts) via Resend.
• To enforce plan limits and prevent abuse of the public scanner.
• To improve the Service based on aggregate, non-identifying usage patterns.

We do not sell your personal information, and we do not use it for third-party advertising.

We share data only with the service providers that help us run Accessibility Scanner, each acting on our behalf:

• Supabase — database, authentication, and file storage (hosted on AWS, us-east-1).
• Vercel — application hosting.
• Railway — hosting for the scan worker.
• Polar.sh — payment processing and billing (merchant of record).
• Resend — transactional email delivery.
• Sentry — error monitoring.
• Google — sign-in only (OAuth); no other Google services are used.

If you’re an agency, the accessibility reports you generate are yours to share with your own clients — we don’t share them on your behalf.

We keep scan and report data for up to 24 months, after which it’s deleted automatically. You can delete your entire account and everything in it — clients, sites, scans, and reports — at any time from your Account page’s Danger Zone, or email us at robertoagudeloc@gmail.com to request deletion sooner.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information. To exercise any of these rights, email robertoagudeloc@gmail.com — we’ll respond within a reasonable time.

Our infrastructure is hosted in the United States. If you’re accessing the Service from outside the US, your information will be transferred to and processed in the US.

Accessibility Scanner is not directed at children, and we do not knowingly collect personal information from anyone under 16.

We use industry-standard measures — encrypted connections, database-level row-level security so organizations can’t see each other’s data, and access controls — to protect your information. No method of transmission or storage is 100% secure, and we can’t guarantee absolute security.

We may update this policy from time to time. If we make material changes, we’ll update the “Last updated” date above.

Questions about this policy? Email robertoagudeloc@gmail.com.