Privacy policy

1. Introduction

AccessGuard is a web accessibility scanning and WCAG compliance service operated by Valerius, a company registered in Bosnia and Herzegovina. We are committed to protecting your privacy and handling your data transparently.

This policy applies to all users of AccessGuard, including free and paid subscribers, and covers data collected through our website at getaccessguard.com.

2. Information we collect

Account data

When you create an account, we collect:

• Name and email address
• Encrypted password (we never store plain-text passwords)
• Avatar image (optional)
• Theme preference (light/dark mode)

Organization data

For team accounts, we collect:

• Account/organization name
• Billing email address
• Team membership information

Scanning data

When you use our scanning service, we collect:

• URLs of pages you scan
• HTML snippets containing accessibility issues
• CSS selectors identifying problematic elements
• Page screenshots for visual reference

Free audits

Anyone can audit a page at getaccessguard.com/scan without an account. For each free audit we record the address of the page, the score and the time. We will also keep the findings, which include short fragments of that page's HTML, and one picture of the page with the failures marked on it. We use them to show you the result, to send you the full report if you ask for it, and, where we get in touch about the audit, to include in that message. We will delete them after 30 days. Each free audit also gets a link of its own, so the result can be sent on or come back to: anyone who has the link can see the result until the findings are deleted, and nobody can find it without the link. We do not record who ran a free audit. If you ask us to email you the report, we keep the address you gave us, the audit it was for, and the date we sent it, so that we have a record of what we sent and to whom. We keep that record for two years and then delete it automatically. You can ask us to delete it sooner at any time. We keep the address, the score and the time for as long as we run the service, so that we can see how the free audit is used.

Usage data

We automatically collect:

• Scan history and timestamps
• Credit usage records
• Issue status changes (marking issues fixed or ignored)

3. How we use your information

We use your information to:

• Provide the scanning service: Analyze web pages for accessibility issues and generate reports
• Process AI suggestions: Generate fix recommendations using your scan data
• Manage subscriptions: Process billing and maintain your account
• Send service emails: Password resets, scan notifications, and important account updates
• Improve our service: Analyze aggregate usage patterns to enhance features

4. Third-party services

We share limited data with the following third-party services:

Lemon Squeezy (payment processing)

When you subscribe to a paid plan, Lemon Squeezy receives your billing email and account name to process payments. Lemon Squeezy is PCI-DSS compliant and handles all payment card data directly - we never see or store your card details.

Anthropic Claude (AI suggestions)

To generate AI-powered fix suggestions and alt text, we send HTML snippets and images from scanned pages to Anthropic's Claude API. This data is processed transiently and is not stored or used for model training by Anthropic.

OpenAI (backup for AI suggestions)

If Anthropic's API is unavailable, we can send the same HTML snippets and images to OpenAI instead, so that a suggestion you asked for still arrives. This is switched off for every account today and will not be switched on for your account without this policy saying so. As with Anthropic, the data is processed to answer the request and is not used to train models.

Cloudflare R2 (file storage)

Images you upload to Alt Wizard are stored on Cloudflare R2 while we generate alt text for them. Each image expires 24 hours after you upload it, and a job that runs every hour deletes the expired ones, so the copy we hold is gone within 25 hours of upload at the latest. You can delete one yourself before that. Cloudflare stores the file and does not read or process what is in it. Where an image is sent to an AI provider to generate alt text, that provider may keep its own copy for a short period under its own terms, which we have set out in section 9.

Google Analytics

We use Google Analytics 4 to collect anonymous usage data such as pages visited, time on site, and general geographic region. Google Analytics does not collect personally identifiable information. For more information, see Google's Privacy Policy.

We do not use:

• Advertising networks
• Data brokers or resellers

5. Cookies

We use essential cookies required for the service to function, as well as analytics cookies:

• Session cookies: Maintain your authenticated session
• Remember-me cookies: Keep you logged in between sessions (optional, based on your preference)
• Analytics cookies: Google Analytics 4 uses cookies (_ga, _ga_*) to collect anonymous usage data

We do not use advertising or retargeting cookies. For full details, see our Cookie Policy.

6. Data retention

• Alt Wizard images: Expire 24 hours after upload, and the copy we hold is deleted within 25 hours
• Free audit findings and pictures: Deleted 30 days after the audit
• Free audit report requests: Two years, then deleted automatically
• Scan data: Retained while your account is active
• Account data: Retained while your account is active
• Deleted accounts: All associated data is permanently purged within 30 days of account deletion

7. Data security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data is transmitted over HTTPS/TLS
• Password security: Passwords are hashed using bcrypt with appropriate cost factors
• Access controls: Data access is restricted on a need-to-know basis
• Logging: Sensitive parameters are filtered from application logs

8. Your rights (GDPR/CCPA)

Regardless of your location, we provide all users with the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your account and associated data
• Data portability: Export your data in a machine-readable format
• Objection: Object to certain processing of your data

For EU residents, these rights are provided under the General Data Protection Regulation (GDPR). For California residents, these rights are provided under the California Consumer Privacy Act (CCPA).

To exercise any of these rights, please contact us using the information below.

9. Where your data is, and who processes it

Your data is in the European Union. The AccessGuard application, its database, and the scans, reports and account data it holds all run on a server in Germany, rented from Hetzner Online GmbH. Database backups taken before each deploy are kept on that same server. Files are the one exception to that server: screenshots of the pages we scan, and images you upload to Alt Wizard, are stored on Cloudflare R2, in its Eastern Europe region. They are listed in the table below.

Our company is not in the European Union. Valerius, which operates AccessGuard, is registered in Bosnia and Herzegovina. Our staff access the application and its data from there. That access is a transfer of personal data outside the European Economic Area, and we would rather say so plainly than leave you to work it out from our address.

Some of the services we rely on are outside the EU. Each one below gets only what it needs to do its job.

What protects the transfers. We rely on the European Commission's standard contractual clauses, which are in the data processing terms of each of these providers, and on the UK and Swiss addenda where they apply. We do not rely on any provider's self-certification alone. We send each service the least we can: Anthropic and OpenAI receive page content and images but never your account details or your clients' contact information, and our billing provider receives no scan data at all.

What we do not do. We do not sell personal data, and we do not share it with advertising networks or data brokers. The AI providers we use process your page content to answer the request and do not use it to train their models.

10. Children's privacy

AccessGuard is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email at least 30 days before the changes take effect. We encourage you to review this page periodically.

12. Contact us