Privacy notice

Last updated: 2026-09-27. Applies to adaclear.com, the AdaClear scanner and the paid monitoring plans.

1. Who is responsible for your data

AdaClear is run by InnoDigital, the trading name of a sole proprietorship registered in Poland. The controller of your personal data under the GDPR is:

Write to that address about anything in this notice. We have not appointed a data protection officer; at our size the law does not require one, so the address above reaches the person who decides.

2. What we do with your data, and why

2.1 A free scan

When you enter a website address, our server opens that page in a real browser, runs an automated accessibility check and builds a report: a score, a list of issues and up to three CSS selectors per issue. We hold the report only until your browser collects it and delete it in the same database operation that hands it over. A report nobody collects is deleted automatically within about ten minutes. While it waits, the address you entered (including any query string) sits next to it and is deleted with it. We keep no history of your scans and no copy of the page content.

Our application log records the scanned page as scheme, host and path only, never the query string. The site you scan receives one visit from a headless Chromium browser and a TLS check from our server.

Legal basis: carrying out the service you asked for (GDPR Art. 6(1)(b)).

2.2 The free PDF, alt-text and contrast tools

Uploaded PDFs and fetched page HTML are processed in memory and discarded when the request ends. We log the size of a PDF, never its content. The contrast checker runs entirely in your browser.

Legal basis: carrying out the service you asked for (Art. 6(1)(b)).

2.3 "Email me this report"

If you ask for the report by email, we use your address, the scanned page and its score to send that one email. We also record the same values as a lead in our internal customer records (a CRM we host on our own servers) and in a lead file, so we know who has shown interest in AdaClear and can honour an opt-out across everything we run. Our application logs never contain your email address in readable form: they keep a pseudonymised identifier (a keyed hash of the part before the @) next to the email domain. The logs stay only on the server that runs the service, are not copied anywhere else, can be read only by the people who operate the service, and are deleted when the running service is replaced.

Legal basis: carrying out the service you asked for (sending the email, Art. 6(1)(b)) and our legitimate interest in keeping a record of who contacted us (Art. 6(1)(f)). You can object at any time.

2.4 Product updates, only if you tick the box

The report form has a checkbox for occasional AdaClear product updates. It is unticked by default. We add your address to our product-updates mailing list only when you tick it. When you tick the box we store a consent record in our own database: your email address, the time, the form you used and the wording of the checkbox you saw, so we can show later that you agreed. We keep it while you stay subscribed and for 3 years after you withdraw consent. If you leave it unticked you get the one report email and nothing else. Every product-update email has an unsubscribe link.

Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting what happened before.

2.5 Paid plans

Paid plans are sold through Stripe Managed Payments. Link, LLC, a Stripe company, is the merchant of record for your purchase: Link is the seller you pay, charges your card until you cancel, collects any sales tax or VAT, sends your receipts and handles refund requests. Payment runs on Stripe's hosted checkout page, and Stripe processes the payment data for Link. Link and Stripe collect your card details, billing address and, where relevant, your tax id as independent controllers under their own privacy policies; we never see or store the card. After payment Stripe tells us your email address, the plan, the subscription id, the amount and the currency.

To deliver the plan we store your email address, the plan, its status and renewal date, the address of the site you monitor, the pages we found on it and the report of every monitoring run. We send you the welcome email, a setup reminder if you have not named a site yet, the scan reports and any payment-problem notice. The links in those emails are signed and expire (7 days for setup links, 30 days for report links); opening one sets a short-lived login cookie on adaclear.com, described in section 7. Customers are recorded in the same internal customer records as leads. We do not add customers to the product-updates list without the same explicit tick.

Legal basis: the contract with you (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)).

2.6 Our internal copy of outgoing email

We send email through Brevo. A hidden copy (BCC) of every email we send goes to an internal company mailbox on Google Workspace, so we can check that our emails went out and handle replies and bounces. The copy contains what you received, including report links. It is not used for marketing.

Legal basis: our legitimate interest in running and checking our own email delivery (Art. 6(1)(f)).

2.7 Protecting the service

To stop abuse we count requests per IP address in memory for a rolling hour or day (for example 20 free scans an hour) and forget the address when the window ends. Our edge server keeps a standard access log (IP address, the requested address including any query string, and the time) on our host in Finland. It is size-capped, so old entries are overwritten; in practice that is about a week. The application itself keeps no access log. Visitors from countries under EU or US sanctions (Iran, North Korea, Syria, Cuba, Russia, Belarus) are blocked at the edge based on their IP address.

Legal basis: our legitimate interest in keeping the service secure and in complying with sanctions law (Art. 6(1)(f)).

2.8 Analytics and session replay

Every page on adaclear.com loads our self-hosted analytics (Rybbit, at analytics.complyfort.com, run by us on our own servers; nothing goes to a third-party analytics company). It receives the page you viewed including its query string, the referring page, your screen size, language and the page title. It uses your IP address at the moment of the visit to work out a rough location and does not store the address itself. On the scan page it also records the host name of the site you scanned and coarse score bands, never the full address or your email.

Session replay is switched on. It records the page as it is displayed to you, with mouse movement, scrolling, clicks and page changes, so we can see where a form confuses people. Text you type into a field is masked. The parts of the page that show your scan results or tool output are blocked from the recording entirely, so the recording shows an empty box there. Replay recordings are deleted after 30 days. Page-view statistics are kept for 10 years.

The analytics script sets no cookies. It writes one random identifier into your browser's local storage and, while replay runs, one flag into session storage. There is no opt-out switch on the site yet; a browser content blocker that blocks analytics.complyfort.com stops it entirely, and the site works without it.

Legal basis: our legitimate interest in understanding how the product is used and improving it (Art. 6(1)(f)). You can object at any time by writing to us.

3. Who receives your data

We do not sell your data and we do not share it with advertisers. These service providers process it for us, or receive it as independent controllers where noted:

Where a provider transfers data outside the European Economic Area (Link, Stripe and Google group companies in the US), the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

4. How long we keep it

We delete the free scan report, rate-limit counters, processed payment event ids and replay recordings automatically. The other periods in this table are applied by a manual review we run at least once a quarter.

5. Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. You can withdraw the product-updates consent at any time. Write to hello@innodigital.io; we may ask you to confirm the email address the request concerns.

We handle requests manually and answer within one month, as the GDPR requires. Deleting your data means removing your lead or customer record, taking you off the mailing list and deleting any open scan report, except records the law requires us to keep. Backups expire on their own within 35 days. To delete what Link and Stripe hold about your payment, contact them as well.

You can also complain to a data protection authority. Ours is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl; you can also contact the authority where you live or work.

Giving us your data is voluntary. Without an email address we cannot email you a report, and without payment details we cannot sell you a plan; the free scan needs neither.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Security

Traffic to adaclear.com is encrypted with TLS. Our databases run on our own servers, backups are encrypted, and access is limited to the people who operate the service.

7. Cookies and browser storage

The public pages of adaclear.com set no cookies. When a paying customer opens a signed link from one of our emails, we set one login cookie (adaclear_site, adaclear_report or adaclear_account), HttpOnly and valid for one hour, so the page can show your reports without putting the link in the address bar. It is strictly necessary for the service you asked for. The analytics script writes one random identifier into local storage and, while replay runs, one flag into session storage, as described in section 2.8. Stripe sets its own cookies on its checkout pages under Stripe's cookie policy.

8. Changes

We will post any change on this page with a new "last updated" date. Our Terms of Service cover the rest of how the service works.