Privacy Policy
Last updated: March 15, 2026
Accessibility Shield ("Accessibility Shield," "we," "our," or "us") operates accessibilityshield.org and provides automated web accessibility testing, compliance reporting, hosted accessibility statements, and lightweight on-site assistive tools.
We are firmly committed to transparency, data minimization, and user privacy. This Privacy Policy outlines what information we collect, why we collect it, how it is processed and protected, and the legal rights available to you under regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
1. Core Privacy Principles
- Data Minimization: We collect only the minimum personal information required to authenticate your account, conduct requested accessibility scans, and process your subscription.
- Zero-Tracking Assistive Widget: Our lightweight (~8 KB) on-site widget does not track visitors, does not use advertising or tracking cookies, and does not profile users across websites.
- No Sale of Personal Data: We never sell, rent, monetize, or trade your personal information or your website visitors' data to data brokers or third parties.
- Secure Infrastructure: All account and compliance data is encrypted in transit using modern TLS (Transport Layer Security) and at rest within our serverless database architecture.
2. Information We Collect
A. Information You Provide Directly
- Account Credentials: When you register for an account, we collect your name, email address, and a securely salted password hash managed through our authentication system (Better-Auth).
- Monitored Websites & Domains: When you add a site to your dashboard, we store the domain name, site label, and optional organization or team metadata.
- Accessibility Barrier Feedback: If a visitor submits an accessibility barrier report via our on-site widget or your hosted statement, we collect the submitted description, the URL of the affected page, the timestamp, and optional contact details if provided by the reporter.
- Customer Support Communications: If you contact our support, we retain records of the correspondence (including email address and message contents) to resolve your inquiry.
B. On-Site Assistive Widget Data Practices
Our on-site assistive toolbar is engineered specifically to respect user privacy:
- Local Storage Only: When a visitor changes text size, contrast, font, link highlighting, motion, or text spacing, those preferences are saved exclusively within their own browser's
localStorage. They are never transmitted to or stored on our servers. - No Third-Party Cookies: The widget loads zero third-party tracking scripts, zero advertising pixels, and zero cross-site identifiers.
- Voluntary Reporting: Diagnostic details (the browser type and the page address) is collected only if a visitor explicitly clicks "Report accessibility barrier" to report a broken element to the site owner.
C. Information Collected Automatically
- Automated Scan Results: When a scan is executed on a customer's domain, our scanner engine inspects public HTML, CSS, and DOM elements to generate WCAG 2.1 AA violation reports, contrast calculations, and compliance scores.
- Technical & Security Logs: For rate limiting, fraud prevention, and system defense, our serverless edge network automatically logs request IP addresses, browser user-agent headers, and request timestamps. These logs are retained temporarily for security auditing.
D. Payment & Billing Information
Paid subscriptions are processed through Polar (Polar Software Inc.), our Merchant of Record.
- Polar handles payment card tokenization, tax calculation, invoicing, and subscription renewals.
- Accessibility Shield does not collect, process, or store full credit card numbers or banking details. We only store non-sensitive customer and subscription identifiers provided by Polar to verify active plan status.
3. How We Use Your Information
We process your data for the following legitimate business purposes:
- Platform Delivery: To authenticate users, operate the customer dashboard, execute scheduled accessibility scans, and host live accessibility statements.
- Alerts & Communications: To deliver transactional emails, password reset links, team invitations, and weekly compliance monitoring summaries.
- Barrier Resolution: To deliver visitor-reported accessibility barriers to site owners so engineering teams can remediate real-world obstacles.
- Security & Integrity: To detect automated abuse, prevent Server-Side Request Forgery (SSRF) against internal networks, and ensure platform availability.
- Legal Compliance: To maintain accounting records and satisfy statutory legal obligations.
4. Third-Party Subprocessors
We partner with reputable infrastructure providers who process data strictly under our direction:
| Subprocessor | Purpose | Location |
|---|---|---|
| Neon (Neon Inc.) | Serverless PostgreSQL Database | United States / EU |
| Vercel (Vercel Inc.) | Serverless Hosting & Edge Routing | Global Edge Network |
| Polar (Polar Software Inc.) | Merchant of Record & Payment Processing | Sweden / Global |
| Resend / Google (Gmail SMTP) | Transactional, alert, and contact form email delivery | United States |
| Google Analytics (Google LLC) | Website usage statistics, only after you click "Accept All" | United States |
| PostHog | Product analytics and session replay on accessibilityshield.org, only after you click "Accept All" | United States / EU |
Each provider processes data under its own published data processing terms. The analytics tools never run on websites that embed our widget or link to a hosted statement.
5. Data Retention & Erasure
- Account Data: Maintained for the duration of your active subscription.
- Scan History: Retained in your dashboard to generate historical compliance trajectories and timestamped audit logs.
- Account Deletion: You may request permanent deletion of your account, monitored domains, and associated scan history at any time by contacting our privacy team. Upon request, data is securely purged within 30 days, except where retention is required for legal, tax, or fraud mitigation purposes.
6. Your Rights (GDPR & CCPA/CPRA)
Depending on your geographic jurisdiction, you have the following enforceable rights:
- Right to Access: Request a portable copy of the personal data we hold about you.
- Right to Rectification: Update or correct inaccurate or incomplete account information.
- Right to Erasure ("Right to Be Forgotten"): Request permanent deletion of your personal records.
- Right to Restrict or Object: Object to or restrict specific forms of data processing.
- Non-Discrimination: You will never be denied services or charged different rates for exercising your privacy rights.
To exercise any of these rights, email accessibilityshieldorg@gmail.com with the subject line "Privacy Rights Request". We verify and fulfill requests within 30 days.
7. Security Safeguards
We enforce strict technical and organizational measures to safeguard your information:
- Strict SSL/TLS encryption for all data in transit.
- Multi-tenant data isolation and role-based access control.
- SSRF network validation blocking private and internal IP ranges.
- Minimum 12-character password entropy enforcement with cryptographic salting.
8. Updates to This Policy
We may periodically update this Privacy Policy to reflect changes in our platform or applicable privacy laws. Material changes will be communicated via your dashboard or email notification prior to taking effect.
9. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:
- Email: accessibilityshieldorg@gmail.com
- Organization: Accessibility Shield
- Address: 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, United States