Privacy Policy

SiteRecord ("we," "our," or "us") is a service for tracking website accessibility findings — from first detection through remediation and verification — and keeping a history of that work. Our public launch is planned for Fall 2026. This Privacy Policy covers two contexts: this public website, and the SiteRecord application whenever it is used by account holders.

1. Information We Collect

On this website

This public site is informational. When you visit it:

• Server logs. As with most websites, our hosting environment records standard request data such as IP address, browser type, pages viewed, and access times, for security and operational purposes.
• Session cookie. A session cookie may be set when you visit. It supports site operation and security; it is not used for advertising or cross-site tracking.
• Fonts. Pages load the Inter typeface from Google Fonts. When your browser downloads the font, Google receives standard request data such as your IP address.

We do not run analytics or advertising trackers on these public pages.

In the SiteRecord application

When an account holder signs in and uses the application, we process:

• Account information. Your email address and password (stored in hashed form), plus your name and organization name if provided.
• Website data. Websites you register for monitoring, including URLs, site names, and descriptions you provide.
• Scan and finding data. When you run an accessibility scan or import scanner results, we store the findings, including the affected page URLs, issue details, and technical details needed to describe and track each finding.
• Proof of fix. Files, screenshots, notes, links, or diffs you upload to document a fix. These are stored against the finding and become part of its history.
• Activity and history. Actions taken in the application — such as assignments, status changes, proof uploads, and verifications — are recorded with the acting user and the time, because that record is the core of the product.
• Usage data. Within the signed-in application we use Google Analytics to understand how the product is used. It is not loaded on the public pages of this site.
• Cookies. The application uses a session cookie to keep you signed in, and an optional remember-me cookie if you choose to stay signed in. These are essential to the service.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the service
• Run the scans you request and maintain the history of findings, remediation, and verification
• Send service-related communications, such as password resets and security alerts, through our email delivery provider
• Respond to inquiries and provide support
• Monitor usage patterns to improve the product
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

3. Service Providers

We do not sell, trade, or rent your personal information. We share information only with service providers who perform services on our behalf, including:

• Hosting — the provider that stores and serves website and application data
• Email delivery — service-related email, such as password resets and security alerts, is sent through Resend
• Payment processing — if you subscribe to a paid plan, payments are processed by Stripe; we do not store your card number
• Analytics — pages within the signed-in application load Google Analytics; it is not loaded on the public pages of this site

We may also disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Data Retention and Deletion

We retain your account information for as long as your account is active. Finding, scan, proof, and history records are retained to support the ongoing record the product is built to keep.

When you delete a website from your account, associated scan data may be archived rather than immediately deleted to preserve record integrity. Archived data is not accessible through the normal interface.

You can request deletion of your account from within the application. Requests are reviewed before completion so that records attributed to your account remain intact where required. You may also contact us to request deletion of your personal information, subject to legal retention requirements.

5. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure password hashing using industry-standard algorithms
• Access controls limiting who can view your data

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights and Choices

You may contact us to:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your personal information, subject to legal retention requirements
• Export — request an export of your data in a machine-readable format

To exercise these rights, contact us using the information below.

7. Third-Party Services and Links

Our service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties; we encourage you to review their privacy policies.

Pages within the signed-in application load Google Analytics. Google Analytics collects information such as how often users visit, what pages they visit, and what site they used prior to arriving. Google's ability to use and share information collected by Google Analytics is restricted by the Google Analytics Terms of Service and the Google Privacy Policy.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, which may have different data protection laws. We take appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy.

9. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of the service after any changes indicates your acceptance of the updated Privacy Policy.