Privacy Policy

1. Introduction and Scope

Accessibility Conformance ("we", "us", or "our"), a trade name of Quiet Loud Creations LLC, provides web accessibility auditing, scheduled monitoring, reporting, accessibility statement generation, and related tools through accessibilityconformance.com (the "Service").

This Privacy Policy explains what information we collect, how we use and protect it, when we disclose it, how long we keep it, and the choices and rights you have. By using the Service, you acknowledge the practices described here.

2. Information We Collect

We collect only the information reasonably necessary to provide, secure, support, and improve the Service:

• Account and identity information: When you create an account, we collect your first name (and, optionally, last name), email address, and sign-in credentials. Passwords are held by our authentication provider in hashed form. If you turn on two-factor sign-in, your authenticator enrollment is stored there as well.
• Websites and scan data: The website URLs you submit, your display names, entity classifications, scan schedules and settings, remediation notes, and the scan results, findings, criteria evaluations, reports, and VPAT and other documents we generate, so you can review trends and progress over time.
• Content retrieved from scanned websites: When we scan a website, we retrieve and process publicly accessible content from the pages we are authorized to access, such as text, images, links, metadata, and scripts. That content can include personal information about people who are not account holders. We process it only to perform the requested testing, generate results, monitor changes, and provide the Service. You are responsible for having the right to authorize us to scan the websites you submit.
• Team members: If you invite people to your account, we store their email addresses, their role (Viewer or Editor), and when they joined. Account owners can see the email addresses and roles of the people on their team. If you are invited, the account owner can see your email address and role.
• Subscriptions and payments: Payments are handled by Stripe. We never see or store your full card number. We store your plan, your Stripe customer and subscription identifiers, your subscription status, and the email on your billing record. Stripe processes payment details under its own privacy practices.
• Site ownership confirmation: To publish a statement or generate a VPAT, you confirm that you control a website. We store the confirmation code we issued for the site, how and when it was confirmed, and who confirmed it.
• Technical and security data: We process IP addresses, browser and device information, authentication and session information, request timestamps, and error and performance information to run the Service and keep it secure. For free scans requested without an account, we use your IP address and email address to apply a limit of one free scan every 24 hours. Our hosting and network providers also process this kind of information in routine operating and security logs.
• Public statement content: If you use our Accessibility Statement Generator to publish a statement, we store and publicly display the organization name, contact email, commitment text, and anything else you choose to include, at your unique statement URL. Anyone with the link can see it.
• Free scan requests: If you request a free scan from our home page without an account, we collect your name, email address, the website URL, and your organization type, and we email the report to you. We keep a backup copy of the request and a contact record (name, email address, website, and whether you opted in) for about two weeks, then delete both (our cleanup job runs weekly, so deletion can take up to three weeks). If you opt in to our mailing list, we keep your contact record until you unsubscribe or ask us to remove it. We use your address for the report only, unless you also opt in to our mailing list.
• Mailing list (optional): If you tick the optional mailing-list box when requesting a scan or creating an account, we store your email address and the date you opted in, and we may send you accessibility deadline and compliance updates. Every message includes an unsubscribe link, and unsubscribing stops all marketing email immediately. Account and scan-report emails are not marketing and are not affected.
• Communications: When you contact support or use our contact form, we collect your name, email address, and message, and we use them to respond, investigate issues, and keep appropriate business records.

3. How We Use Information

We use information as reasonably necessary to:

• Run accessibility audits and monitoring, and generate reports, VPATs, and statements.
• Create and secure accounts, authenticate you, and manage team access.
• Send reports, scan completion alerts, and essential account and security notices.
• Process subscriptions and payments, and provide support.
• Enforce scan quotas and plan limits.
• Detect and prevent fraud, abuse, unauthorized scanning, and security threats, and keep the Service reliable.
• Create aggregated or de-identified information that does not reasonably identify an individual or customer.
• Send marketing email only to people who opted in, and only until they unsubscribe.
• Comply with law and protect our rights, users, and property.

You keep ownership of the content and information you submit. We do not use it for unrelated advertising, and we do not sell it.

5. Analytics, Search Console, and Cookies

We use a few tools to measure aggregate performance and keep the Service safe:

You can change or withdraw your analytics choice at any time by clicking Cookie Settings in the site footer.

6. Service Providers and Subprocessors

We use third-party providers to deliver and secure the Service. They process information on our behalf, on our instructions, and under their standard data processing terms:

• Supabase Inc.: Authentication, database, and data storage.
• Google LLC: Google Analytics 4 (subject to your consent) and Google Search Console.
• SMTP2Go: Transactional email delivery for account confirmations, reports, and notifications.
• Stripe: Payment processing and subscription billing for paid plans.
• Railway: Application hosting and scan compute.
• Cloudflare: DDoS protection, edge services, bot protection, and Turnstile on forms.

We may add or replace providers as the Service changes. We expect each one to use personal information only as needed to provide its services to us and as the law permits.

7. Legal and Safety Disclosures, and Business Transfers

We may disclose information when reasonably necessary to:

• Comply with law, regulation, legal process, a subpoena, a court order, or a governmental request.
• Protect the rights, property, or safety of our users, the Service, our company, or others.
• Detect, investigate, and prevent fraud, abuse, security incidents, or other unlawful conduct.
• Enforce our Terms of Service or other agreements.

If we are involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information associated with the Service may be transferred as part of it, subject to applicable law. A successor will remain bound by applicable privacy obligations for the information it receives.

8. Data Retention

We keep information for as long as reasonably necessary to provide the Service, meet the purposes in this policy, comply with legal obligations, resolve disputes, enforce agreements, and prevent fraud and abuse. In particular:

• Scan results and reports: 30 days on the Free plan, 6 months on Monitor, and 12 months on Pro, then deleted automatically.
• Free scan requests: the request backup and your contact record are deleted about two weeks after you request the scan, unless you opted in to the mailing list. The cleanup job runs weekly, so deletion can take up to three weeks. Opted-in contacts are kept until they unsubscribe or ask us to remove them. If you unsubscribe, we keep only your email address and that choice.
• Account information: for as long as your account is open. Accounts whose email address is never confirmed are deleted after seven days.
• Security and technical logs: for periods reasonably necessary for security, troubleshooting, and fraud prevention.
• Marketing suppression: if you unsubscribe, we keep only your email address and that choice so we never email you again.

When you delete your account, your sites, scan history, reports, team memberships, and profile are permanently erased and any paid subscription is canceled, apart from information we must keep for legal, accounting, or security reasons. Some information may remain in backups for a limited time before it is overwritten or deleted.

9. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect information, including Transport Layer Security (TLS) encryption in transit, encryption of stored data and backups at rest by our database provider, authentication and access controls, monitoring and logging, and protections against automated attacks and abuse. No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. If a security incident affects personal information, we will investigate and give any notices the law requires.

10. Your Privacy Rights

Depending on where you live, you may have rights over your personal information under laws such as the GDPR, UK GDPR, the CCPA/CPRA, and the Texas Data Privacy and Security Act (TDPSA). Wherever you are, we extend these rights where reasonably applicable:

• Access and portability: You may ask for the personal information tied to your account and, where technically feasible, a machine-readable copy.
• Correction: You can update your profile and site settings in your dashboard, or ask us to correct inaccurate information.
• Deletion: You may delete your account yourself or ask us to delete it and its associated data, except information we are allowed or required to keep.
• Withdraw consent and opt out: You can change your analytics choice through Cookie Settings and unsubscribe from marketing email at any time.
• Other rights: Depending on your location, you may also be able to ask us to restrict or stop certain processing, or to appeal a decision about your request.
• Non-discrimination: We will not deny services, charge different prices, or lower the quality of service because you exercise a privacy right.

To make a request, email privacy@accessibilityconformance.com with enough detail for us to understand it. We may ask for information to verify your identity or authority first, and we will respond within the time the law requires (for Texas residents, within 45 days, which we may extend once by 45 more days when reasonably necessary). If we decline a request, you may appeal by replying to our response or emailing the same address with "Appeal" in the subject line. We will answer the appeal in writing within 60 days and explain the reasons for our decision. We do not sell personal data, use it for targeted advertising or profiling, or process sensitive data as defined in the TDPSA.

11. International Users

The Service is operated from the United States, and our providers may process information in the United States and other countries where they operate. Where the law requires safeguards for international transfers, we use recognized transfer mechanisms appropriate to the circumstances.

12. Children

The Service is for businesses, organizations, and public entities. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us at privacy@accessibilityconformance.com and we will investigate and delete it.

13. Changes to This Policy

We may update this policy as the Service, technology, or legal requirements change. We will change the "Last updated" date above, and for material changes we will give notice by email or in the dashboard.

14. Contact and Inquiries

For privacy questions, requests, or data-related inquiries, contact our Privacy Team: