Privacy Policy

This Privacy Policy explains how Talivio Technology OÜ (registry code 16991406, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia — "Talivio", "we") processes personal data in connection with the A11yProof accessibility-scanning service. We are the data controller for the data described below, except where this policy says we act as a processor. For privacy questions, contact [email protected].

1. Data we collect

• Scan input: the URLs you submit to the scanner.
• Account data: name, email address and a hashed password.
• Billing data: subscription and purchase records. Payments are handled by Stripe; we never see or store full card numbers.
• Monitoring and scan history (accounts): the domains and pages you add, the accessibility findings derived from them over time, and the reports we generate. Findings include short HTML excerpts of the failing page elements.
• Manual review data: if you request an AI pre-check or expert review, a rendered copy of the reviewed page and the evidence extracted from it for each review criterion.
• Technical data: IP address, browser information and server logs, used for security and to operate the service.

2. Why we process it and our legal bases (GDPR)

We process data on the following legal bases under Article 6(1) GDPR:

• Contract (Art. 6(1)(b)): to provide the service — loading the pages you submit, running automated WCAG checks, operating monitoring, generating reports and evidence files, and managing your account and billing.
• Legal obligation (Art. 6(1)(c)): to keep accounting records required by Estonian law.
• Legitimate interest (Art. 6(1)(f)): to keep the service secure and reliable (for example abuse prevention, logging and blocking scans of private networks) and to send service-related communications.

3. Scanned pages — our role

The pages you scan or monitor may contain personal data of people other than you (for example names or photos published on the scanned website). You decide which pages to submit; for any personal data contained in scanned page content and in the findings derived from it, you are the data controller and we act as your processor, handling that content only to provide the service. On request, we will enter into a GDPR Article 28 data processing agreement with business customers covering this processing; our standard DPA is available at [email protected].

4. On-demand scans

When you run a free one-off scan without an account, we load the target page in a headless browser, evaluate it, and show you the results. We do not store the results or the page content of such scans after the result is produced; only ordinary server logs remain.

5. Who we share it with

We do not sell personal data. We share it only with the recipients needed to deliver the service.

Processors (act on our behalf). These providers process personal data only on our instructions:

• Google (Gemini API), which receives scan findings and — for AI pre-checks — the rendered content of the reviewed page, to generate report narratives and review evidence. We use the paid Gemini API tier; under Google's terms and the Google Cloud Data Processing Addendum, prompts and outputs are not used to train or improve Google's models.
• Our hosting provider and mail infrastructure, which store data and deliver messages on our behalf. These operate within the EU.

Independent controllers (act on their own account).

• Stripe, our payment provider, which acts as an independent (separate) controller for the payment data it needs. We do not sign a controller–processor DPA with Stripe for the payment flow; Stripe's own privacy terms govern that processing.

6. Where your data is held and transfers

We host within the EU, and we do not transfer your personal data outside the EEA. Some of our sub-processors process data outside the EEA under appropriate safeguards. In particular, Google (Gemini API) may process data in the United States: this transfer relies on Google's EU–US Data Privacy Framework certification, backed by the EU standard contractual clauses in Google's Cloud DPA as an additional safeguard. Stripe, as an independent controller, transfers payment data under its own safeguards (standard contractual clauses and/or an adequacy decision).

7. How long we keep it

• One-off scans without an account: not stored (see section 4).
• Scan history, monitoring data and reports: kept while the related domain remains in your account; deleted when you remove the domain.
• Account data: kept while your account is active and deleted or anonymised within 90 days after your account is closed or you request deletion.
• Invoices and billing records: retained for seven years as required by Estonian accounting law.
• Server logs: retained for a short rolling period for security purposes.

8. Your rights

Under the GDPR you may request access to your data, rectification, erasure, portability, restriction of processing, and object to processing. You may lodge a complaint with a supervisory authority — for us that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), but you may also contact the authority in your own country. To exercise a right, email [email protected]. Where we process scanned page content as your processor (see section 3), we will refer requests concerning it to you.

9. Security

Passwords are hashed, traffic is served over TLS, and access to production systems is restricted. No system is perfectly secure, but we apply technical and organizational measures appropriate to the risk.

10. Cookies

We use only essential first-party cookies: a session cookie that keeps you signed in, a CSRF cookie that protects forms against abuse and — if you choose "remember me" — a persistent sign-in cookie. We do not use analytics or advertising cookies.

11. Changes

We may update this policy from time to time. The date at the top shows when it last changed; material changes will be communicated where appropriate.