Privacy Policy

1. Who we are

A11ySolutions is a service provided by Just-Solutions, a company registered in the Netherlands. We operate the accessibility-monitoring platform available at this website. If you have any questions about this policy, please contact us at privacy@a11y-solutions.online.

2. What data we collect

• Account data: username and email address from registration, and anything you choose to add to your profile (first and last name, date of birth, interface language, avatar) plus the billing name, company and address needed for a valid invoice.
• Website and scan data: for each website you register we store its name, base URL and crawl settings, and for each scan the URLs and titles of the pages visited, their HTTP status, and for every accessibility issue found the axe-core rule id, impact, WCAG tags, the CSS selector and a short HTML fragment of the offending element. Those fragments are copied from your pages, so if a page of yours contains personal data the fragment may contain it too — keep that in mind when you register pages behind a login or with user-generated content.
• Client records (Agency plan): the client name, contact email and notes you enter to group your websites. You are responsible for having a basis to store your own clients' contact details with us.
• Payment data: subscription and payment status, and invoice records. All card and bank payment details are processed exclusively by Mollie B.V. We do not store any card or payment credentials on our servers.
• Security log: account events (sign-in, failed sign-in, account lockout, password change, subscription changes) with the IP address the request came from, so we can investigate abuse and account takeovers.
• Technical data: a session refresh token in an HttpOnly cookie, and authentication state, interface language and theme preference in your browser's local storage.

We do not track the visitors of the websites you monitor. Our crawler reads your pages; it does not collect anything about the people who use them.

3. Purpose and legal basis

We process your data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b)): to create and manage your account, crawl and test the websites you register, produce statements and reports, and process payments.
• Legitimate interest (Art. 6(1)(f)): to keep the Service secure (the security log above), to send you the regression and score-drop alerts your plan includes, and to improve the Service using aggregate usage figures.
• Consent (Art. 6(1)(a)): cookie-based website analytics, which is off until you opt in — see our Cookie Policy.
• Legal obligation (Art. 6(1)(c)): to retain payment and invoice records as required by Dutch tax law.

4. Data retention

• Account data: retained as long as your account is active. Deleted within 30 days of an account-deletion request.
• Website, statement and report data: retained for as long as you keep the website in your account. Deleting a website deletes its scans, issues, statements and reports with it; deleting your account deletes all of them.
• Scan history: individual scans — the pages visited and the issues found — are retained for a maximum of 24 months, after which a daily automated job removes them. Your site and its settings stay, but trend charts and scan lists therefore reach back at most 24 months. A scan is never removed while an evidence report or a published accessibility statement still relies on it, so a document you have published keeps its underlying evidence.
• Security log: retained while the account exists and deleted with it.
• Payment and invoice records: retained for 7 years as required by Dutch tax law.

5. Third-party processors

• Mollie B.V. (Netherlands) — payment processing. Data processed under Mollie's own privacy policy.
• Contabo GmbH (Germany) — hosting and infrastructure. Your account, website and scan data are stored on servers in the EU (Germany).
• TransIP B.V. (Netherlands) — domain registration.
• Email/SMTP — transactional email (activation, password reset, alerts, invoices) delivered from our own SMTP server on the same EU infrastructure.
• Google Ireland Limited (US parent Google LLC) — website analytics via Google Analytics 4, only if you opt in via the cookie banner. Data may be processed outside the EEA (including the USA) under the EU Standard Contractual Clauses. See our Cookie Policy.
• ALTCHA — privacy-friendly bot protection (proof-of-work) on the authentication and contact forms. It is self-hosted: verification runs entirely on our own servers, no data is sent to a third party and no cookie is set.

The accessibility tests themselves (axe-core, run in a headless browser) execute on our own servers. Your pages and scan results are not sent to any third-party scanning service.

6. Your rights

Under the GDPR you have the following rights with respect to your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data (subject to legal retention requirements).
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: turn analytics back off at any time from your cookie preferences.

To exercise any of these rights, please email privacy@a11y-solutions.online. We respond within 30 days.

7. Contact

Data Controller: Just-Solutions, KvK 42024979, VAT NL005439088B10, Panna 3, 5126 DJ Gilze, the Netherlands.
Email: privacy@a11y-solutions.online
Given the nature and scale of our processing we are not legally required to appoint a Data Protection Officer; please direct privacy queries to the address above.
The Service is not directed at children under 16 and we do not knowingly collect their personal data.
You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.