Privacy Policy

This describes what we collect through Allcess ("the Service"), why, who else handles it, and what you can ask us to do with it.

Who we are

Allcess is operated by Ayaz Ata Türkmen, who is responsible for your data under this policy (the "controller"). For anything about your data, email [email protected].

What we collect

• Your email address and a hashed version of your password (we never store your password itself)
• The site names and URLs you add for scanning
• Scan results: the accessibility issues found, their severity, and the page content axe-core needed to identify them
• Your settings, such as scan schedules and email preferences
• If you buy a paid plan: your name, email, country, and the plan and billing status Paddle sends us. Paddle collects your payment details; we never see or store card numbers.

Why we use it

• To provide the Service you signed up for: signing you in, running the scans you ask for, showing and emailing your results, and managing your plan. The legal basis is our contract with you.
• To keep the Service secure and working, such as screening new passwords against known breaches and preventing abuse. The legal basis is our legitimate interest in running a safe service.
• To keep records the law requires, such as for payments. The legal basis is legal obligation.

We don't sell your data, and we don't use third-party analytics or advertising trackers.

Who else handles it

We share data only with the services we need to run Allcess, and only what each one needs:

• Paddle (Paddle.com Market Ltd), our online reseller and merchant of record, which processes payments, invoices and sales tax and receives the details you give at checkout.
• Railway, which hosts the Service and its database.
• Resend, which sends our emails, such as email verification and password-reset links and scan results, and so receives your email address and the email content.
• Have I Been Pwned, used to check new passwords against known breaches. Only the first five characters of a hash of the password are sent, which can't be used to work out the password or link it to you.
• Google, whose favicon service supplies the small icon shown next to each site, and so receives the domain names of the sites you add.

Some of these services are outside your country, including in the United States and the United Kingdom. Where that applies, they handle data under their own safeguards for international transfers.

How scanning works

When you run a scan, our server loads the URL you submitted in an automated browser and runs axe-core against it, the same way a visitor's browser would load that page. This happens on our own infrastructure. We don't send the URL or the page content to a third-party scanning service.

Cookies

We use one cookie to keep you signed in. We don't use tracking or advertising cookies. Paddle's checkout may set its own cookies when you pay.

How long we keep it

We keep your account data and scan history for as long as your account is open. When you delete your account, from Settings or by asking us, we delete it and everything in it. Payment records are kept by Paddle for as long as tax and accounting law requires.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Email [email protected] and we'll reply within 30 days. You can also complain to the data protection authority where you live.

Security

Passwords are hashed with bcrypt before they're stored, connections are encrypted, and access to the database is limited to what runs the Service. No method of storage or transmission is perfectly secure, but we take reasonable steps to protect your data and will tell you promptly if a breach affects it.

Children

The Service isn't directed at children, and we don't knowingly collect data from anyone under 16.

Changes

We may update this policy as the Service changes. We'll post the updated version here with a new date, and email you about significant changes.

Contact

Questions about this policy, or requests about your data: [email protected].