Privacy policy.

When you create an account. Your name and email address identify the workspace that holds your scans and orders. Your password is stored only as a one-way salted hash; verification, password-reset and sign-in tokens are stored as hashes and expire or are revoked. We never store the password you typed.

When you order an audit. Your name, your email address and your website address, which is the minimum we need to reach you, scope the audit and invoice you. Your company name, the pages you list and any notes you write are optional, and the form says so next to each of them. We keep whichever of them you fill in.

When you contact us. Your name, email address, the website you give us, what kind of visitor you say you are, and your message. That is how we reply, and the same applies to anything you email to hello@wcagrules.com. The form has one more field labelled for a company name that no human ever sees, because it is a trap for automated spam, and anything typed into it is discarded rather than stored.

When you run the free scan. The URL you enter and the results of the scan are attached to your verified account. We use the name and email already on that account to show your private history and email you when the result is ready. Queue records also hold progress and enforce one active scan and three accepted scans in a rolling 24-hour period. For abuse prevention, the application turns the request IP address into a keyed pseudonymous fingerprint; it does not retain the raw address in the scan record, and the fingerprint expires shortly after that rolling day. We do not use your scan details for marketing.

When you apply for a job. We collect your name, email address, phone number if provided, city, screen-reader and testing experience, selected role and recruiting location, and the resume you upload or paste. WCAGrules uses this information to review your application and contact you about recruitment. Applications and resumes are stored privately and are available only to authorized administrators. They are included in our private database backups. We record a submission reference and time, and use short-lived hashed request identifiers to limit spam. Do not include medical details or identification numbers. To ask about or withdraw your application, email hello@wcagrules.com with your application reference.

When you browse the site. Google Tag Manager loads the analytics tags we select. They can record the pages you visit, how you reached us, browser and device information, and site interactions such as following a link or completing a form. Published tags may use cookies or similar browser storage. We use this information to understand what works and improve the site, not to target advertising.

In our operational records and logs. Contact-form logs contain the random message reference and visitor category, not the email address, website or message. Scan-worker logs use the random scan identifier and a bounded error category rather than the target URL. We keep email delivery status, provider identifiers, message category, recipient address and timestamps so a failed notification can be investigated; we do not copy the message body or verification and reset links into that delivery table. Payment event and refund identifiers, amounts, currency and outcomes form an append-only accounting ledger. An administrative operation records the administrator, bounded internal subject and correlation IDs, action, outcome and time, never the target address or a credential.

That is the complete list of information we deliberately collect. We do not build advertising profiles from your visit.

No advertising trackers and no social-media buttons that phone home. We do not use analytics to target advertising. No selling, no renting, and no "sharing with carefully selected partners". Analytics exists here to help us improve the site, not to treat visitors as inventory.

A free scan has a long, randomly generated address, but the address is not the key: only you can open it while signed in to the account that started it. Other customers receive the same not-found response as a missing report, so the page does not reveal who scanned what. Want a result removed before it expires? Email us the link and we delete it.

The scanner also refuses to look at private and internal addresses on purpose, so it will not follow a link into a company network, a loopback address, or a cloud provider's metadata endpoint. That is there to stop the free tool being used to probe somebody else's infrastructure, and it is the reason a staging site on an unusual port gets rejected rather than scanned.

Your account, order records, messages and temporary scan results are stored on infrastructure we run. The exception worth naming is the notification email, which goes through the provider in section 5 and is held on their systems as well as ours. Order records stay while we are working together and for as long as our accounting obligations need them; this includes receipts, payment events, delivery metadata and paid reports. Messages stay while the conversation is live. Job applications and resumes are retained while recruitment is active; contact us to request removal sooner. Administrative audit metadata is retained for security and support accountability. Free scan results and their queue records expire automatically after seven days. Ask us to delete something sooner and we will, unless a legal obligation such as tax records says otherwise.

Four, and that is the whole list. Our hosting provider processes traffic to serve you the site. Our transactional email provider, Resend, delivers notifications when a scan completes, when you place an order, when you send a message, or when the hiring team receives an application notification, which means those email details reach their systems. Resend is based in the United States, so if you are writing from the UK or the EU your message crosses the Atlantic to reach us.

Google provides Tag Manager and the analytics services we configure through it. When those tags run, the browsing and interaction data described in section 1 reaches Google's systems and is handled under Google's terms and our analytics retention settings.

And when you pay for an audit, the order sends your browser to Stripe's hosted checkout, so card numbers go to that payment provider and never to us. This site has no card field: Stripe takes the card payment and sends us payment and refund status. Beyond those four we share data only if the law compels us, and we would tell you unless we were legally barred from doing so.

Wherever you are, and whatever acronym applies, whether that is GDPR, UK GDPR or CCPA, the deal is the same. Email hello@wcagrules.com and we will send you a copy of your data, correct it, or delete it, within 30 days. This is currently a manual request rather than a self-service account button. We confirm that you control the account before exporting or deleting anything, and retain records that we must keep for accounting, fraud prevention or another legal duty.

This site is a business service and is not directed at children. We do not knowingly collect data from anyone under 16, and if that has somehow happened, tell us and it is gone the same day.

If our practices change, this page changes first and the date at the top moves with it. Questions go to our contact page, where a human replies within one business day, and the commercial terms live in the terms and conditions.