This Privacy Policy explains what information WCAG.World ("we", "us", "our") collects when you use our website or the AccessRadar accessibility scanning service (together, the "Service"), how we use it, and the choices and rights you have.
1. Information we collect
- Account information: the email address and password (stored as a salted hash, never in plain text) you provide when you create an AccessRadar account.
- Site and scan data: the URLs you submit for scanning, the pages our scanner crawls on those URLs, and the resulting findings, scores, and logs (including page markup snippets needed to show you an issue in context).
- Payment information: if you subscribe to a paid plan, our payment processor, Stripe, collects and stores your card details directly. We receive only your subscription status, plan, and billing metadata from Stripe — we never see or store your full card number.
- Lead and contact information: if you submit a free audit, contact form, newsletter signup, or resource download, we collect the email address, site URL, and any message you provide.
- Usage and analytics data: we use Microsoft Clarity to understand how visitors use our site (page views, clicks, scroll behavior, and session recordings with sensitive form fields masked). Clarity sets its own cookies; see Microsoft's privacy documentation for details on that processing.
- Cookies and session data: we use a session cookie to keep you signed in to your AccessRadar account, and analytics cookies as described above. We do not use cookies for third-party ad targeting.
2. How we use your information
- To operate the Service: running scans, generating reports, enforcing plan limits, and maintaining your account and dashboard.
- To generate AI fix explanations: on Pro and Agency plans, relevant snippets of a scan finding (the failing markup and rule description — not your full site content) are sent to our AI provider, DeepSeek, to produce a plain-language explanation and suggested fix. This is only performed for accounts on tiers where this feature is enabled.
- To send transactional email: scan-complete notifications, regression alerts, billing receipts, and responses to your inquiries.
- To send marketing email you've opted into, such as a requested resource or newsletter; you can unsubscribe from any marketing email at any time via the link in that email.
- To improve the Service, including understanding aggregate usage patterns via analytics.
- To detect abuse and enforce our Terms of Service, including acceptable-use limits on scanning.
3. Third-party processors
We share data with the following third parties, each acting as a processor under our instructions and their own applicable privacy terms:
- Stripe — payment processing and subscription billing.
- Microsoft Clarity — on-site behavioral analytics.
- DeepSeek — AI-generated fix explanations for scan findings, paid tiers only.
- Resend — transactional and account-related email delivery.
- Our hosting and infrastructure provider — runs the servers and database that store your account, scan, and lead data.
We do not sell your personal information to third parties, and we do not share scan data or site content with any party for advertising purposes.
4. Data retention
We retain account and scan data for as long as your account is active, so that you can track trends and regressions across repeated scans. If you delete your account (available from your dashboard), your account, site, and scan history are permanently deleted. Lead and contact submissions (free audits, form fills) are retained until you ask us to delete them, or as needed to respond to your inquiry and meet our own recordkeeping obligations.
5. Your rights
Depending on your location, you may have rights under GDPR, UK GDPR, CCPA, or similar laws, including the right to:
- Access the personal data we hold about you;
- Request a copy of your data in a portable format;
- Request correction of inaccurate data;
- Request deletion of your data (you can self-serve account deletion from your dashboard, or ask us to do it);
- Object to or restrict certain processing, including analytics.
To exercise any of these rights, email experts@wcag.world. We will respond within the timeframe required by applicable law, and may need to verify your identity before acting on a request.
6. Data security
We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) for all traffic to and from the Service, hashed password storage, and access controls limiting who can view account and scan data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Children's privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16.
8. Changes to this policy
We may update this Privacy Policy from time to time. If we make a material change, we will update the "Last updated" date above and, where practical, notify active subscribers by email. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.
9. Contact
Questions about this Privacy Policy, or requests regarding your data, can be sent to experts@wcag.world.