Cookie-szabályzat

Effective date: 17 August 2026 Last updated: 22 August 2026 Version: 2.3

This policy explains which cookies the a11yfy platform ("a11yfy", "we") uses and why. The short version: the cookies we need to run the Service are set automatically; advertising and usage-analytics cookies are set only if you consent, you decide on each purpose separately, and you can change your mind at any time. Our own traffic measurement remains cookieless.

1. What are cookies?

Cookies are small text files stored by your browser on your device. They allow a website to remember your session and preferences between page loads. This policy also covers similar technologies, such as data stored in your browser's localStorage.

2. Your choices — the consent banner

Cookies fall into three groups on a11yfy:

• Strictly necessary cookies (Section 3) are set without asking, because the Service cannot work without them. This is permitted by Art. 5(3) of the ePrivacy Directive; the related processing is based on GDPR Art. 6(1)(b) — performance of contract.
• Advertising cookies (Section 4) are set only after you give consent (GDPR Art. 6(1)(a)).
• Usage-analytics cookies (Section 5) are likewise set only after you give consent, and consent to them is separate from consent to advertising.

On your first visit you see a consent banner with the two optional purposes listed separately, each with its own checkbox, and three equally presented buttons — Accept all, Reject all, and Save my choice. Nothing in either optional category happens until you choose:

Before you consent, none of these scripts — the Google advertising tag, Google Analytics, or Microsoft Clarity — is loaded at all. No request is made to Google or Microsoft, no cookie is written, and no data — not even your consent status — is transmitted. For Google this is its "basic consent mode"; for Clarity we go beyond its own consent mode, which would keep the script running without cookies.

Your choice is stored in a first-party cookie on your own device (see Section 3) and is remembered for six months, after which we ask again. When we add a new optional purpose — or a new provider for an existing one — earlier consent cannot cover it, so the banner reappears and asks again. That is what happened when usage analytics was introduced on 16 August 2026, and again on 17 August 2026 when Google Analytics joined it: a yes given to one provider is not a yes to another.

Changing or withdrawing your choice is as easy as giving it: select Cookie settings in the footer of any page, and choose again. Withdrawing consent stops any further cookies in that category immediately and deletes the cookies previously stored on our domain for it. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

3. Strictly necessary cookies

a11yfy sets only the essential cookies listed below. Core platform functionality — signing in, staying signed in, keeping your language, and remembering your cookie choice — does not work without them.

Locally stored data (not cookies)

If you arrive at a11yfy from a campaign link or another website, we store the campaign parameters (utm_*), the referring URL, and your landing page in your browser's localStorage under the key a11yfy_attr for up to 30 days. Its sole purpose is that, if you create an account, we can record which channel brought you (see "Signup attribution" in the Privacy Policy). This entry is first-party only, is never shared with third parties, involves no cross-site tracking, and is deleted once it has been recorded against your account, or automatically after 30 days.

The window is 30 days because creating an account is not a single moment: you may visit today, sign up next week, and confirm your email address a few days after that. A shorter window would simply lose the connection in ordinary cases and tell us nothing about which channels work. The entry holds no identifier for you — no account, no device and no cross-site identifier — and it never leaves your browser until you create an account.

4. Advertising cookies — Google Ads (consent required)

We advertise a11yfy through Google Ads. To find out which advertisements actually lead to a signup or a purchase — and so that we do not keep paying for advertisements that do not work — we use Google's conversion measurement tag (gtag.js, conversion ID AW-18386533966).

This is switched off until you accept it. If you accept, the Google tag is loaded and the following cookies may be set:

Details:

• Recipient / third party: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). Google's processing is described in the Google Privacy Policy and how Google uses data from sites that use its services.
• What is shared: your advertisement click identifier, the page on which the conversion happened, your IP address, and browser/device information. We do not send Google the content of documents you upload, your uploaded files, your email address, or any other account data.
• Legal basis: your consent — GDPR Art. 6(1)(a) and Art. 5(3) ePrivacy Directive.
• International transfers: data may be processed in the USA. Google LLC is certified under the EU–US Data Privacy Framework, and Standard Contractual Clauses apply in addition.
• Consent Mode v2: if you reject, or before you decide, all Google consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) stay set to denied and the tag is not loaded at all. We do not use "URL passthrough", which would carry advertisement identifiers between pages in the URL instead of in cookies.

5. Analytics

Our analytics come in two parts: measurement that needs no cookies at all and therefore runs for everyone, and optional services that do use cookies and therefore run only with your consent.

5.1 Cookieless measurement (no consent needed)

We measure website traffic with Cloudflare Web Analytics, which:

• does not set or read any cookies;
• does not collect personally identifiable information or track users across sites;
• uses the browser Performance API for aggregate, privacy-preserving measurements.

On our marketing pages we additionally count, in aggregate, how far visitors scroll and which main buttons they use. This measurement is our own, stays on our servers, and stores only daily totals: a date, the page, the event, and a count. It writes nothing to your device — no cookie, no localStorage, no identifier of any kind — and it records no IP address, user agent, session or individual timestamp, so no single visitor can be recognised or reconstructed from it.

Because neither of these reads or writes anything on your device, Art. 5(3) of the ePrivacy Directive does not apply to them, they run regardless of your banner choice, and they are unaffected by it. They are also the only measurement that covers every visitor: the consent-based services below see only those who accept them.

See the Cloudflare Web Analytics documentation for details.

5.2 Usage analytics — Google Analytics 4 (consent required)

Since 17 August 2026 we use Google Analytics 4 (measurement ID G-HKX5CQKEFZ) to see which pages and which advertisements actually lead to a signup or a purchase, so that we can stop paying for the ones that do not.

This is switched off until you accept it. The Google tag is not loaded and no request reaches Google before you consent. If you accept, the following cookies may be set:

What we do to limit what is collected:

• The URL is cleaned before it is sent. Addresses that identify a person or grant access — invitation links, upload and share tokens, certificate IDs, individual document pages, your organisation's name — are replaced with a placeholder (for example /pilot/:token) before anything reaches Google, and only advertising-campaign parameters survive from the query string. Google additionally redacts e-mail addresses and known sensitive parameters on its side.
• No user ID, no cross-device profile. We do not send Google your account identifier, your e-mail address or anything from your documents, and Google Signals is switched off, so your visit is not linked to a Google account or combined across your devices for advertising.
• Advertising use is a separate choice. Whether usage analytics runs and whether advertising measurement runs are two independent decisions. Accepting analytics alone never enables advertising use of the data — see the paragraph on our Google Ads link below.
• Retention: 14 months. After that, the event-level data is deleted by Google automatically; only aggregate reports remain.

This property is linked to our Google Ads account so that we can see which campaigns lead to a purchase, and so that we can build audiences for advertising — for example, to show our advertisements again to someone who looked at our pricing page.

Whether that advertising use applies to you depends on your own choice, not on the link. Advertising use requires the advertising consent signals, which follow your advertising decision, not your usage-analytics one:

• If you accepted both purposes, data collected by Google Analytics may also be used to build advertising audiences and to personalise the advertisements you see.
• If you accepted usage analytics only, the ad_user_data and ad_personalization signals stay denied for you, we send npa=1 (non-personalised advertising) with every measurement, and your data is used for analytics alone.

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA) process this data; it may be processed in the USA under the EU–US Data Privacy Framework and Standard Contractual Clauses. See the Google Privacy Policy and how Google uses data from sites that use its services. You can also install the Google Analytics opt-out browser add-on independently of this site.

5.3 Usage analytics — Microsoft Clarity (consent required)

To understand where our pages confuse people or break, we use Microsoft Clarity, which produces heatmaps and replays of how a page was used (mouse movement, scrolling, clicks, and the pages visited).

This is switched off until you accept it. The script is not loaded and no request reaches Microsoft before you consent. If you accept, the following cookies may be set:

What we do to limit what is recorded:

• Consent first, always. Unlike Clarity's own consent mode — which keeps the script running without cookies when consent is missing — we do not load it at all until you accept.
• Sensitive input is masked by Clarity before it leaves your browser: password and payment fields are never recorded, and the documents you upload are never part of a recording.
• Withdrawal is immediate. If you withdraw consent, we signal it to Clarity and delete the Clarity cookies stored on our domain; the script is not loaded on your next page view.

Microsoft acts as our processor for this purpose and may also process the data as an independent controller under its own terms. See the Microsoft Privacy Statement and the Clarity terms for details.

6. Bot protection — Cloudflare Turnstile

The free document scanner on our website is protected against automated abuse by Cloudflare Turnstile, a privacy-preserving bot-detection service. When you use the scanner, a script loads from challenges.cloudflare.com and may store a short-lived, strictly functional token in your browser to remember that you passed the check.

Turnstile is functional, not tracking: it does not track you across websites, does not build advertising or behavioural profiles, and is not used for analytics. Cloudflare's processing is described in the Cloudflare Privacy Policy.

7. Third-party cookies at checkout — Paddle

Payments are handled by our Merchant of Record, Paddle. When you open the checkout, Paddle's checkout component loads and may set cookies that are necessary to operate the checkout securely — for session handling and fraud prevention. These cookies are governed by Paddle's Privacy Policy.

Apart from the advertising cookies described in Section 4 and the usage-analytics cookies described in Sections 5.2 and 5.3 (all of which require your consent) and the checkout cookies above, no other third party sets cookies on a11yfy. If this ever changes, we will update this policy and, where required, ask for your consent first.

8. Managing cookies

Your first stop is the Cookie settings link in the footer of any page — it reopens the consent banner and lets you change your choice for each optional purpose at any time.

You can also delete or block cookies in your browser settings. Note that blocking the essential cookies listed in Section 3 will prevent you from signing in or using the platform:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Settings → Safari → Privacy

You can also opt out of personalised Google advertising independently of this site in Google's Ad Settings.

9. Contact

Questions about this policy: support@a11yfy.com. See also our Privacy Policy.