Effective date: 17 August 2026 Last updated: 17 August 2026 Version: 1.3
This Privacy Policy explains how the a11yfy platform ("a11yfy", "we", "us") collects, uses, and protects personal data. We keep it deliberately plain: we collect only what is needed to run the Service, we do not sell personal data, and we do not use your documents to train AI models.
What changed in version 1.3: we added two usage-analytics services — Microsoft Clarity (heatmaps and session replay) and Google Analytics 4 — and listed them among our processors. If you accept advertising cookies as well, the Analytics data may also be used to show our advertisements to people who have visited us. Both run only with your consent, which you give separately from advertising and can withdraw at any time; neither receives data from your documents or your account. Addresses that could identify you are stripped before anything is sent to Google. See Section 10 and the Cookie Policy.
1. Data controller
| Field | Value |
|---|---|
| Controller | Zoltan Csordas E.V. (operating the a11yfy platform) |
| Registered seat | Malom utca 11/1, 2367 Újhartyán, Hungary |
| Contact for privacy matters | support@a11yfy.com |
Where you upload documents that themselves contain personal data, you (or your organisation) are the controller of that content and we process it on your behalf, solely to provide the Service (see Section 4).
2. What we collect and why
| Category | Details | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account data | Email address, name, password hash, language preference | Authentication, account management, service notifications | Performance of contract — 6(1)(b) |
| Organisation data | Organisation name, membership, roles | Team collaboration, access control | Performance of contract — 6(1)(b) |
| Billing data | Subscription status, credit balance, transaction references received from Paddle | Billing, credit accounting, support | Performance of contract — 6(1)(b); legal obligation — 6(1)(c) |
| Uploaded documents and outputs | PDF files you upload and the accessible files we generate | Providing the document-remediation service | Performance of contract — 6(1)(b) |
| Usage and job data | Processing history, credit consumption, API usage | Billing, support, abuse prevention | Performance of contract — 6(1)(b); legitimate interest — 6(1)(f) |
| Technical data | IP address, session identifiers, security and audit logs | Security, fraud and abuse prevention | Legitimate interest — 6(1)(f) |
| Support communication | Emails you send to support@a11yfy.com | Handling your requests | Legitimate interest — 6(1)(f) |
| Signup attribution | Campaign parameters (utm_*), referring URL, and landing page from your first visit, recorded when you create an account |
Measuring which marketing channels work — first-party only, never shared with third parties | Legitimate interest — 6(1)(f) |
| Advertising measurement data | Advertisement click identifier, the page where a signup or purchase happened, IP address, browser and device information — collected by the Google Ads tag only if you accept advertising cookies; where you accepted both purposes, also your Google Analytics usage data | Measuring which of our advertisements lead to a signup or purchase, and showing our advertisements to relevant audiences | Consent — 6(1)(a). Withdrawable at any time via "Cookie settings" in the footer |
| Usage-analytics data | Pages visited (with identifying parts of the address removed), scrolling and clicks, approximate location derived from IP, browser and device information — collected by Google Analytics and Microsoft Clarity only if you accept usage-analytics cookies | Understanding how our pages are used and which pages lead to a signup or purchase, so we can fix what does not work | Consent — 6(1)(a). Withdrawable at any time via "Cookie settings" in the footer |
We do not collect more data than listed here.
We do not profile you inside the Service, and we do not use your documents, your uploads, your email address, or any other account data for advertising. The only advertising-related processing is the conversion measurement described in the last row above — it concerns visits to our website, requires your consent, and is off by default. Details, including every cookie involved, are in the Cookie Policy.
3. Payments — Paddle
Payments are processed by Paddle (Paddle.com Market Limited, UK / Paddle.com Inc., USA), our Merchant of Record. When you make a purchase, Paddle acts as an independent data controller of the personal data you provide at checkout — such as your name, email address, billing address, payment card details, IP address, and transaction records. Paddle's processing is governed by its own Privacy Policy.
Paddle shares limited order data with us (transaction references, subscription status, billing country) for order fulfilment, credit accounting, fraud prevention, and support. We never receive or store your full payment card details.
4. Uploaded documents
Documents you upload are processed exclusively to provide the Service: analysis, remediation, validation, certificate issuance, and delivery of the output file.
- We do not read, review, or use your documents for any other purpose.
- We do not use your documents or the generated outputs to train generalised AI models.
- Access to stored documents is restricted and protected by technical and organisational measures.
During processing, document content is transmitted to the specialised document-analysis and AI providers listed in Section 6, strictly for the purpose of performing the conversion.
5. Retention
| Data | Retention period |
|---|---|
| Uploaded input documents | Deleted automatically 7 days after upload |
| Generated output files (and certificates' downloadable copies) | Deleted automatically 30 days after completion |
| Processing caches (intermediate document-analysis results used to avoid re-processing the same file) | Deleted automatically no later than 7 days after creation |
| Account data | Until account deletion (7-day grace period, then permanent erasure) |
| Signup attribution (campaign parameters recorded at account creation) | For the lifetime of your account; deleted when your account is deleted |
| Credit ledger and transaction records | Retained as required by applicable tax and accounting law (typically up to 8 years) |
| Security and audit logs | Up to 12 months |
| Session data | Until session expiry or sign-out |
Cookie choice (a11yfy_consent) |
6 months, then we ask again |
| Advertising measurement cookies (only if you consented) | First-party: up to 90 days. Google's own cookies: up to 13 months, controlled by Google — see the Cookie Policy |
| Usage-analytics cookies and data (only if you consented) | Cookies: up to 2 years (Google Analytics), up to 1 year (Clarity). Event-level analytics data: 14 months, then deleted automatically — see the Cookie Policy |
You can delete uploaded documents earlier at any time. When you delete your account, a 7-day grace period applies (during which you can undo the deletion by logging in); after it, your account data and all stored documents are permanently erased.
6. Recipients and international transfers
We use the following categories of service providers ("recipients") to operate a11yfy:
| Recipient | Role | Location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, storage, CDN, security | EU data centres (with US parent) | EU Standard Contractual Clauses (SCCs); EU Data Boundary controls |
| Google Cloud (Google Ireland Ltd.) | Document-conversion compute | EU (europe-west1, Belgium) | GDPR-compliant EU processing; SCCs where applicable |
| Specialised document-analysis and AI service providers | Layout analysis, OCR, AI-generated descriptions during processing | EU and USA | EU Standard Contractual Clauses (SCCs); data processed transiently, not retained for training |
| Functional Software, Inc. (Sentry) | Error diagnostics — technical error reports so we can detect and fix failures | EU ingest endpoint (US parent) | EU Standard Contractual Clauses (SCCs); configured to exclude personal data (no PII sent) |
| Paddle | Payment processing (Merchant of Record) | UK / USA | Independent controller — see Section 3 |
| Google Ireland Ltd. / Google LLC (Google Ads) | Measuring the effectiveness of our advertising — only if you accept advertising cookies | Ireland / USA | Your consent (Art. 6(1)(a)); EU–US Data Privacy Framework certification and Standard Contractual Clauses. No account data and no document content is sent |
| Google Ireland Ltd. / Google LLC (Google Analytics) | Website usage analytics — only if you accept usage-analytics cookies. Where you also accepted advertising cookies, the same data may be used to build advertising audiences (remarketing) | Ireland / USA | Your consent (Art. 6(1)(a)); EU–US Data Privacy Framework certification and Standard Contractual Clauses. Identifying parts of addresses are removed before sending; Google Signals is switched off; advertising use requires your separate advertising consent; no account data and no document content is sent |
| Microsoft Ireland Operations Ltd. / Microsoft Corporation (Clarity) | Heatmaps and session replay on our marketing pages — only if you accept usage-analytics cookies | Ireland / USA | Your consent (Art. 6(1)(a)); EU–US Data Privacy Framework certification and Standard Contractual Clauses. Password and payment fields are masked before leaving your browser; uploaded documents are never recorded |
To protect the free document scanner on our website from automated abuse, we use Cloudflare Turnstile (a privacy-preserving bot-detection service by Cloudflare, Inc.). Turnstile evaluates browser signals to distinguish humans from bots; it does not track you across sites and does not build advertising profiles. See the Cookie Policy for details.
All transfers of personal data outside the European Economic Area take place under Standard Contractual Clauses approved by the European Commission, or another valid transfer mechanism under Chapter V GDPR. A current, detailed list of processors engaged for document processing is available on request at support@a11yfy.com.
We do not sell personal data. Apart from the consent-based advertising measurement listed above — which concerns visits to our website and never your account data or your documents — we do not share personal data with any third party for their own marketing purposes.
7. Your rights (GDPR)
Under Articles 15–22 GDPR you have the right to:
- Access your personal data and receive a copy;
- Rectify inaccurate data;
- Erase your data ("right to be forgotten") — account deletion is available self-serve in the account settings;
- Restrict processing;
- Data portability — a self-serve export of your account data is available in the account settings;
- Object to processing based on legitimate interest;
- Withdraw consent at any time, where processing is based on consent (Art. 7(3)) — for advertising cookies this is one click, under Cookie settings in the footer of any page. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
To exercise any right, use the self-serve controls in the application or contact support@a11yfy.com. We respond within one month.
Complaints
If you believe our processing infringes the GDPR, you may lodge a complaint with a data protection supervisory authority — in particular in the EU/EEA member state of your habitual residence, your place of work, or the place of the alleged infringement. A list of all EU/EEA supervisory authorities is available on the European Data Protection Board website.
8. Users outside the EEA
United Kingdom
For users in the UK, the UK GDPR applies with the same lawful bases and rights as described above. You may lodge complaints with the Information Commissioner's Office (ico.org.uk).
California (CCPA/CPRA)
California residents have the right to know what personal information we collect (see Section 2), to request deletion, and to non-discrimination for exercising these rights. We do not sell personal information within the meaning of the CCPA/CPRA.
Our advertising measurement (Section 2 and the Cookie Policy) may amount to "sharing" for cross-context behavioural advertising under the CPRA. It is opt-in everywhere, including in California: nothing is shared unless you accept advertising cookies in our consent banner. The Cookie settings link in the footer of every page lets you withdraw at any time and serves as our "Do Not Sell or Share My Personal Information" mechanism.
Submit requests to support@a11yfy.com; we respond within 45 days.
9. Security
We protect personal data with industry-standard measures, including encryption in transit (TLS) and at rest, access controls, audit logging, scoped API keys, and the automatic deletion schedules described in Section 5.
10. Cookies
We use strictly necessary cookies (which the Service cannot work without), cookieless traffic analytics, and — only if you consent, purpose by purpose — Google Ads advertising cookies for measuring our advertising, plus usage analytics (Google Analytics 4, and Microsoft Clarity for heatmaps and session replay) for finding what does not work on our pages.
Before you consent, neither script is loaded at all: no request reaches Google or Microsoft, no cookie is written, and no data is transmitted. You choose on your first visit — separately for each purpose — and can change your mind at any time via Cookie settings in the footer of any page.
Every cookie, its purpose, its retention period and the third parties involved are listed in the Cookie Policy.
11. Children
The Service is not directed at children under 16, and we do not knowingly collect their data.
12. Changes to this policy
If we make material changes to this policy, we will post the updated version here and notify registered users by email before the changes take effect.
Questions? Contact us at support@a11yfy.com.