This policy explains how CompliAccess collects, uses, discloses, and protects personal information when you visit our website, contact us, create an account, run accessibility scans, or purchase services.
1. Information we collect
We may collect account and contact details such as your name, email address, organization, password hash, support messages, and communication preferences. We collect service data such as submitted website URLs, scan results, issue details, reports, remediation records, and settings. We also collect technical information such as IP address, browser type, device information, request logs, session identifiers, and security events.
2. Payments
Payments are processed by Stripe. We may receive transaction identifiers, payment status, billing contact details, invoice information, plan, and limited card details such as brand and last four digits. We do not store full payment card numbers.
3. How we use information
We use information to create and secure accounts; run scans; generate reports; provide remediation and support; process purchases; send verification, service, scan, and billing messages; improve reliability; prevent abuse; meet legal obligations; and understand use of the platform.
4. Website scanning
When you submit a URL, our systems request and analyze publicly accessible website content and may create a screenshot or store relevant HTML snippets to explain findings. You are responsible for having authority to scan the submitted website. Do not submit private areas or pages containing sensitive personal information unless expressly authorized and appropriately protected.
5. Service providers and disclosure
We may share information with providers that help us operate the service, such as cloud hosting, database, email delivery, security, analytics, and payment providers. Current core providers may include Stripe for payments and Resend for transactional email. Providers receive only information needed for their role and process it under their own terms and contractual safeguards. We may also disclose information where required by law, to protect rights or security, or in connection with a business transaction.
6. Cookies and sessions
We use essential cookies or similar storage to keep you signed in, remember account state, protect sessions, and operate the dashboard. We may use limited measurement tools to understand service performance. Browser settings can block cookies, but essential features may then stop working.
7. Retention
We retain information for as long as needed to provide the service, maintain security and business records, resolve disputes, and meet legal obligations. Retention periods vary by data type and account status. We delete or de-identify information when it is no longer reasonably required, subject to backups and legal requirements.
8. Safeguards
We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including access controls, encrypted connections, protected credentials, and logging. No online system can guarantee absolute security.
9. International processing
Our service providers may process information outside Ontario or Canada. Information processed in another jurisdiction may be subject to that jurisdiction’s laws and lawful access requirements.
10. Your choices and rights
Depending on applicable law, you may ask to access or correct personal information, withdraw consent where consent is the basis for processing, or request deletion of eligible information. We may need to verify your identity and may retain information where law permits or requires it.
11. Children
The service is intended for organizations and adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13.
12. Changes
We may update this policy as the service or legal requirements change. We will post the revised effective date and provide additional notice for material changes where appropriate.
13. Contact us
For a privacy question or request, use our contact page or email privacy@compliaccess.ca.