Legal

Privacy policy

This Privacy Policy explains how A11yRemedy collects, uses, shares and protects personal data. It covers our marketing website at a11yremedy.com, the application at app.a11yremedy.com, our free public accessibility scanner, our API and related services (together, the “Service”).

Effective: 29 September 2026 Last updated: 26 October 2026

On this page

In short

We collect what we need to run scans, reports and your account, and nothing for advertising.
We don’t sell personal data.
For data agencies add about their clients, we’re the processor and the agency is in charge.
You can ask to see, fix or delete your data at any time.
Our browser extension runs checks only when you start them, on sites you allow.

1. Who we are

A11yRemedy is operated by Oktohut Solutions Private Limited, a company incorporated in India (“A11yRemedy”, “we”, “us”).

Registered office: AN Square, WG 1-F-3/1120, Unichira Thoppil Road, Marottichuvadu, Edappally, Kochi, Ernakulam, Kerala 682021, India
Email: support@a11yremedy.com
Phone: +91 80894 62726

2. Our role: controller or processor

We are the controller of personal data we collect to run our own business. This includes customer account details, visitors to our website, people who use the free public scanner, and newsletter subscribers.

We are a processor of personal data our customers put into the Service, or that our scanner encounters on customers’ websites. This matters most for agencies that use A11yRemedy under their own brand to serve their own clients. In that case the agency decides which websites to scan and who receives reports. If you are a client of an agency that uses A11yRemedy, please contact that agency first about your data. Our Data Processing Addendum (https://a11yremedy.com/data-processing-addendum/) sets out our commitments as a processor.

Paddle is a separate controller for payments. Paddle.com is our reseller and Merchant of Record. When you buy a subscription, Paddle collects and processes your payment details and billing information under its own privacy policy (https://www.paddle.com/legal/privacy).

3. Personal data we collect

3.1 Account and organisation data

When you register or are invited to a team, we collect:

your name and email address;
your password, stored only as a one-way hash and never in plain text;
your organisation’s name and your role in it;
team invitations you send or receive.

3.2 Billing data

We do not receive or store your card or bank details. Paddle shares limited information with us so that we can manage your subscription:

your name, email address and country;
your postal code and tax ID, if you provided them at checkout;
your plan, subscription status and payment status.

3.3 Websites and scan data

What you give us: the website addresses you add, and your scan schedules and settings.

What our scanner collects from those websites: page addresses, page titles, HTML fragments and CSS selectors of elements with accessibility issues, rule results and related technical data. We need these to show you where an issue is and how to fix it.

Personal data on scanned pages: scanned pages can themselves contain personal data, such as a staff member’s name on a contact page. We process it only because it appears on a page you asked us to scan, and only to produce your results.

3.4 Credentials for authenticated scanning

To scan pages behind a login, you may give us a login address, username and password, or session cookies for the website being scanned. These credentials:

are encrypted before they are stored;
are never returned by our API or shown in the dashboard after you save them;
are used only by the scanner, to reach the pages you configured.

You can delete stored credentials at any time in your site settings.

3.5 Branding, statements and documents

Logos, colours and company details you upload for white-label reports.
The content of accessibility statements and VPAT drafts you create, such as an entity name, contact details and a contact web address.

3.6 Free public scanner

If you use the free scanner without an account, we collect:

the website address you submit;
the email address you give us to receive results;
the scan results;
your IP address, used for rate limiting and abuse prevention.

We send marketing emails to that address only if you tick the opt-in box.

3.7 Marketing website (WordPress)

Contact forms: what you submit through forms built with Elementor, such as your name, email address, company and message. Submissions are stored in our WordPress database.

Newsletter: your email address, and your name if you give it, when you subscribe. We manage the newsletter with MailerLite.

Analytics: we don’t currently run analytics on the marketing website. If we add Google Analytics, it will only run after you agree to analytics cookies (see section 12).

Logs: standard server logs, such as IP address, browser and pages requested, kept by our web host.

Only our staff have WordPress user accounts. Visitors do not need an account.

3.8 Support and communications

Emails and messages you send us.
Records of the alert and notification emails we send you.

3.9 Technical, log and error data

Access data: IP address, browser user agent, request times and pages requested.

Security logs.

Error reports: when something goes wrong in the application, it sends an error report to Sentry. A report can include your user ID, IP address and details of the failed request.

3.10 Browser extension

If you use the A11yRemedy extension for Chrome or Microsoft Edge:

Connection key. When you sign in, we create a connection key for your account and the extension stores it in that browser. We record the browser’s name and when the key was last used. You can sign out in the extension, or disconnect any browser in Settings → Browser extension. A key stops working after 90 days without use, and all keys stop working when you change or reset your password.
Page addresses. The extension reads the addresses of your open tabs and compares them, in your browser, with the sites you monitor. It sends an address to us only when the tab is on one of those sites, or when you start a check of that page.
Checks in your browser. Checks run only when you start them, and only on sites you allow: one site at a time, or all sites if you choose. While you are signed in, the extension sends us the page address and title, the HTML of the elements that failed (each cut to 2,000 characters, including the text inside them), the addresses of the page’s stylesheets and scripts, and the class names on the page’s body element, so we can return fix code. We process this in memory and do not store it. The rest of the page’s text is not sent. You can turn this off with “Get fix code for in-browser checks” in the extension’s Account tab; checks then stay in your browser.
Checks on our servers and actions. When you check a page on our servers, verify a fix, ignore an issue, add a note or create a ticket from the extension, we store the result as we do for the same action in the app (section 3.3). A free check without an account works like the free public scanner (section 3.6), including the IP address we keep for rate limiting.
Prospect checks. On Studio and Agency plans you can check a page that is not yet a client’s. We scan it as we do with the free public scanner (section 3.6). If you add the prospect’s details, we save them to Leads in your account.

The extension does not change the pages you visit, does not read the content of pages you do not check, and does not record your browsing. We do not sell this data or use it for advertising.

4. How we use personal data, and our legal bases

Purpose

Legal basis (GDPR / UK GDPR)

Create and run your account, run scans, and generate reports, statements and documents

Performance of our contract with you

Manage subscriptions with Paddle; keep accounting and tax records

Contract; legal obligation

Send service emails: scan alerts, regression alerts, password resets, team invitations, billing notices

Contract

Send free-scanner results to the email address you gave us

Your request

Reply to contact form messages

Steps taken at your request before entering a contract; legitimate interests

Send newsletters and product news

Consent (you can unsubscribe at any time)

Secure the Service, prevent abuse (including unauthorised scanning), enforce rate limits

Legitimate interests

Diagnose errors and improve the Service

Legitimate interests

Comply with the law and respond to lawful requests

Legal obligation

Under India’s Digital Personal Data Protection Act, 2023, we process personal data for the purposes above either on the basis of your consent or for legitimate uses permitted by the Act, such as a purpose for which you voluntarily provided the data.

We do not use your scan data or Customer Content to train machine-learning models. On plans that include AI-drafted alt text and ARIA guidance, we send the relevant HTML snippet from a scanned page to OpenAI to produce a draft for a person to review. Under OpenAI’s API terms, this data is not used to train its models.

5. Our scanner and third-party websites

Our scanner visits websites using an automated browser. It identifies itself with a user agent that links to a11yremedy.com/bot, where website owners can learn what it does and how to contact us.

Customers must only scan websites they own or are authorised to test (see our Terms of Service). If you run a website and believe it was scanned without authorisation, email support@a11yremedy.com. We will investigate and, where appropriate, stop further scans and delete the results.

6. Public accessibility statements

If you publish an accessibility statement through the Service, it becomes publicly available at a web address on our domain, together with any linked PDF. Anything you include in it, such as a contact name, email address or phone number, will be visible to anyone. Only include contact details you are happy to make public. You can unpublish a statement at any time.

8. International transfers

We are based in India. The application’s servers and backups are in the EU. Our marketing website and some providers are in the United States. Our team in India accesses data to operate and support the Service. Where the GDPR or UK GDPR applies, we protect these transfers with appropriate safeguards. These include the European Commission’s Standard Contractual Clauses (with the UK Addendum), the EU–US Data Privacy Framework where a provider is certified, or an adequacy decision where one exists. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

Data

Retention

Account and organisation data

For the life of the account, then deleted within 30 days of account closure

Scan results and reports

For the life of the site or account, unless you delete them sooner; deleted within 30 days of account closure

Authenticated-scan credentials

Until you remove them, delete the site or close the account

Browser extension connection keys

Until you sign out or disconnect the browser, after 90 days without use, or when you change or reset your password

Free public scanner submissions

90 days, unless you create an account

Contact form submissions

24 months after our last contact with you

Newsletter subscriptions

Until you unsubscribe

Billing and invoice records

For as long as tax and accounting laws require (in India, generally 8 years)

Server and security logs

30 days

Error reports (Sentry)

Up to 90 days

Database backups

Rolling 30 days, then deleted automatically

Deleted data can remain in backups until those backups expire. Paddle keeps transaction records under its own retention policy.

10. Security

We use reasonable technical and organisational measures to protect personal data, including:

encryption in transit (HTTPS);
hashed passwords;
encryption of stored website credentials;
separation of each organisation’s data;
role-based access controls;
off-site backups in the EU.

No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as the law requires.

11. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct inaccurate or incomplete data;
have your data deleted;
restrict or object to certain processing, including direct marketing;
receive your data in a portable format;
withdraw consent at any time (this does not affect processing already carried out);
complain to a data protection authority.

India (Digital Personal Data Protection Act, 2023): You may also nominate another person to exercise your rights if you die or become incapacitated. You can seek redress of grievances through our Grievance Officer (section 15) before approaching the Data Protection Board of India.

US state privacy laws: Where they apply, you may have the right to know, delete and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your rights.

How to exercise your rights: Email support@a11yremedy.com. We may need to verify your identity. We will respond within the time the applicable law requires, which is one month under the GDPR. If an agency or other customer provided your data to us, we may pass your request to them.

For payment data held by Paddle, you can also contact Paddle directly through paddle.net.

12. Cookies

Application (app.a11yremedy.com): We use only strictly necessary cookies, which keep you signed in securely and protect against abuse. These do not require consent.

Marketing website (a11yremedy.com):

Google Analytics: we don’t use it at the moment. If we add it, it will set cookies (such as _ga) only after you accept them in a cookie banner, and we will update this Policy first.
MailerLite and Elementor: may set cookies needed for their forms to work.
WordPress: sets login cookies only for our staff.

Checkout: Paddle sets its own cookies at checkout, governed by its own policies.

We do not use advertising or cross-site tracking cookies.

13. Children

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. If a change is material, we will notify account holders by email or in the app before it takes effect. The “Last updated” date above shows when it last changed.

15. Contact and Grievance Officer

Oktohut Solutions Private Limited

AN Square, WG 1-F-3/1120, Unichira Thoppil Road, Marottichuvadu, Edappally, Kochi, Ernakulam, Kerala 682021, India

Email: support@a11yremedy.com

Phone: +91 80894 62726

Grievance Officer (India): Srijidh KM, hello@a11yremedy.com. We will acknowledge grievances promptly and resolve them within the time required by law.