Privacy Policy

Last updated: 31.10.26

This Privacy Policy describes how AllyProof ("we", "us", "our"), operated as a sole proprietorship registered in Ukraine, collects, uses, and protects your personal data when you use the AllyProof platform, including the AllyProof browser extension for Chrome, Microsoft Edge, and Firefox (collectively, the "Service").

We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

1. Data Controller

Oleksandr Maksiutenko, trading as AllyProof, is the controller for account administration, security and our own service measurement. Provider and address details are in our legal notice. When we process website evidence on an organization’s instructions, that organization is responsible for its lawful use and the applicable data-processing agreement governs our processor role.

The Paddle entity identified at checkout acts as an independent controller for its payment processing. See Paddle’s Privacy Policy. Contact us at legal@allyproof.com.

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address - for authentication, communication, and account recovery
• Full name - for display in the application and team features
• Profile picture URL - if you sign in via Google or GitHub OAuth
• Organization name - for multi-tenant workspace management

2.2 Service Usage Data

When you use the Service, we collect:

• Site URLs - websites you add for accessibility scanning
• Scan results - accessibility violations found, including page URLs, violation details, HTML code snippets and captured screenshots, which may contain personal data visible on the scanned page
• Regulatory evidence - public legal-page excerpts, including provider names, business contact details, postal addresses, and policy wording needed to support the checks you request
• Reports and VPAT-based evidence drafts - documents generated from scan results
• API key metadata - key names, scopes, and usage timestamps (keys are stored as SHA-256 hashes)
• Activity logs - actions taken within the platform for audit purposes
• Support and collaboration: ticket subjects, messages, comments and the account or organization details associated with them.

2.3 Technical Data

We automatically collect:

• IP address - for security, rate limiting, and abuse prevention
• Browser and device information - user agent string for compatibility
• Cookies - essential cookies for authentication and session management (see Section 7)

2.4 Data We Do Not Collect

• We do not access private or authenticated areas unless you explicitly configure that access. Public pages may contain business-contact personal data, which is processed only where needed to produce and support the requested scan result.
• Paddle handles full card numbers and bank payment credentials. AllyProof receives billing records such as customer and subscription identifiers, status, transaction amounts and currency.
• We do not sell your data. Optional Google analytics and advertising processing depends on your consent. Our separate first-party measurement uses no new tracking cookie or persistent browser identifier, but can include account-linked records as explained in Section 7.

3. How We Use Your Data

4. Service Providers and Other Recipients

We use providers for hosting, database and authentication, email delivery, security and AI features. Providers acting as processors are subject to data-processing terms and security obligations. Payment services and certain optional Google services may act as independent controllers for their own processing; they are not all our sub-processors. Their roles and the applicable consent choices are described in this policy.

Where configured, operational alerts are sent to a private administrator channel through Telegram. Depending on the event, they can contain your name or email, organization details, a site name or URL, a support-ticket subject, and subscription or account-status information. These alerts support service administration and support handling; they are separate from optional Google measurement. Telegram processes the alert contents as an external recipient.

When your organization enables Jira synchronization or webhooks, the selected recipient receives the configured event or issue data. Jira tickets can include affected page URLs, selectors and HTML examples. We store connection credentials and configuration needed to operate the integration. The receiving service processes transferred data under its own terms and your organization’s configuration.

Publishing a statement or creating a shared report makes the published content accessible outside your organization. Anyone with a valid report link can view its report without signing in until the link expires or is revoked. Review the content before sharing it. Revoking a link or disconnecting an integration does not retrieve copies already downloaded or transferred.

A current list of sub-processors is available upon request at legal@allyproof.com. We will notify you of material changes to our sub-processors in accordance with Section 12 (Changes to This Policy). Where sub-processors are located outside the EU/EEA, data transfers are conducted under appropriate safeguards, including Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework where applicable.

5. Data Retention

Removing a site deactivates it; existing scan results, reports and evidence remain stored. Contact us to request erasure.

Retention follows the record’s purpose and the workspace it belongs to. Deleting your user account removes your sign-in account and memberships; it does not delete the organization’s shared sites, scans or reports. Resolve subscription responsibility before deleting an owner account. To request organization-wide or personal-data erasure, contact legal@allyproof.com; we verify authority and any applicable legal retention duties.

• Organization data and evidence: Findings, reports, regulatory excerpts and audit history remain with the relevant organization or site until the records are deleted or an authorized erasure request is fulfilled. User attribution may be cleared when a user account is deleted. There is no general automatic 90-day purge of audit history.
• Screenshots: Referenced screenshots remain available with the evidence that uses them. Unreferenced screenshot objects older than 2 days become eligible for scheduled cleanup; cleanup runs in batches.
• Public scan previews: Results and replay links expire after 24 hours. Expired results, associated IP addresses and raw quota events are removed in scheduled batches every 5 minutes. Screenshots follow the reference-based cleanup described in this section. Organization scan history is separate.
• AI inputs and results: We do not keep a separate general prompt log, but evidence, work payloads and results can contain AI input or output. Obsolete AI working snippets become eligible for batched cleanup after 30 days, subject to scan completion and protection of the latest 2 completed scans per site. HTML retained in findings follows evidence retention. Regulatory AI cache entries become eligible for cleanup after 90 days without reuse. Provider retention is described in Section 9. Failed-scan working snippets become eligible after 24 hours once scan and AI work are no longer active; failure details and page results remain available.
• First-party analytics: Event records are deleted automatically after 400 days. Consent-based checkout identifiers expire after 30 days and are cleared by scheduled cleanup. Completed or discarded Google-delivery payloads are cleared after 90 days; minimal consent and deduplication records may remain.
• API keys: Revocation disables a key immediately; its hash and metadata remain in the organization’s records. The full key is not stored in our server database.
• Email and billing: Delivery providers and Paddle retain records under their own policies and applicable legal duties. We retain the subscription and transaction records needed to administer the service, resolve disputes and meet legal obligations.
• Trial eligibility: We retain the billing email, plan, first grant date and available Paddle customer/subscription identifiers to prevent repeat trials. These records survive account and organization deletion and do not currently expire automatically. They are not used to send marketing. You can request erasure or object to this legitimate-interest processing using the contact in Section 6; we assess whether continued retention is necessary and justified.
• Support and operational alerts: Deleting the account that opened a support ticket, or its organization, deletes that ticket and its messages from the application database. Copies delivered to email or Telegram are separate and are not automatically erased by account deletion. Include these copies in an erasure request where relevant.

Operational deletion is not a promise that every backup or third-party copy disappears at the same instant. Where data must be retained for a legal claim, security or a statutory duty, we limit its use to that purpose. Contact us for the retention and backup arrangements relevant to your organization.

6. Your Rights

Under GDPR (EU/EEA residents)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Data portability - receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time (for consent-based processing)
• Lodge a complaint with your local data protection authority

Under CCPA/CPRA (California residents)

You have the right to:

• Know what personal information we collect and how it is used
• Delete your personal information
• Opt out of the sale or sharing of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights
• Correct inaccurate personal information
• Limit the use and disclosure of sensitive personal information where that right applies

To exercise your rights, email legal@allyproof.com. We respond without undue delay and within one month for GDPR requests, subject to legally permitted extensions with notice. Account deletion in Settings uses email verification; shared organization records and subscription responsibilities are handled separately as described in Section 5.

7. Cookies

We use browser storage for sign-in and requested preferences. Optional Google measurement is separate and depends on your choices below.

7.1 Optional Google measurement and your choice

Google tags are loaded only after analytics consent. Analytics consent allows Google Analytics 4 measurement; the separate marketing choice controls Google advertising storage, advertising user data and personalization. Until analytics consent is given, we do not load those Google tags. The banner offers:

• Accept all - allow analytics and marketing categories.
• Reject non-essential - decline both optional categories.
• Customise - choose the optional categories individually.

Use Cookie preferences in the footer to change or withdraw consent. For signed-in users we also save the consent decision server-side, so later subscription events can be checked against the latest recorded choice. Relevant consent signals are passed to Google; withdrawing consent does not undo processing that already occurred lawfully.

With analytics consent, campaign attribution can be held in ap_acquisition session storage for 30 minutes across login and checkout. Advertising click identifiers are included only with marketing consent. Consent-based checkout context may retain Google client/session identifiers and a permitted click identifier for 30 days. Server-side Google conversion delivery requires valid context and a current consent check; it is not a fallback for visitors who declined analytics. Section 5 explains cleanup.

Additional Google advertising cookies can depend on an ad click, enabled features and browser restrictions. See Google’s cookie inventory and Analytics cookie documentation. These browser lifetimes are separate from server-side data retention. Our ap_analytics_excluded preference cookie can retain an internal/test-traffic exclusion for 1 year; it is not a visitor identifier.

7.2 First-party service measurement without additional tracking storage

We separately record first-party page views and product or subscription events, including when optional cookies are declined. This collection creates no tracking cookie or persistent browser identifier and does not use canvas, font or screen fingerprinting APIs. It uses information in ordinary requests and, where available, the existing authenticated session.

Depending on the event, records include:

• The page path without its query string or fragment, and the referrer domain.
• Campaign parameters, locale, country and broad device category.
• A pseudonymous daily visitor code derived from the request IP address and browser user-agent using a rotating daily salt. Raw IP addresses and full user-agent strings are not stored in this analytics event table; separate security processing is described in Section 2.
• Event-specific properties and, for authenticated or server-side business events, user or organization identifiers, subscription/payment context, amounts, currency and deduplication identifiers.

These records are not anonymous. The daily code rotates, but account-linked records can connect activity across days and devices. First-party records are processed in our service infrastructure and hosting providers; they are not themselves forwarded to Google to replace denied consent. Internal staff and identified test traffic are excluded from audience measurement. Event records are deleted after 400 days.

We rely on legitimate interests in operating, securing and improving our own Service (Article 6(1)(f) GDPR), subject to your interests and rights. The absence of cookies does not by itself exempt processing from data-protection or device-access rules. You may object under Article 21 GDPR by contacting legal@allyproof.com.

8. Data Security

We use technical and organizational measures appropriate to the Service:

• HTTPS for the public AllyProof service and its default API endpoint
• Row Level Security (RLS) and server-side authorization for organization data
• SHA-256 hashes and metadata for server-side API-key storage; the original key is returned once at creation
• PKCE for OAuth sign-in and Supabase session refresh; authentication cookies are accessible to the browser client, not HttpOnly
• Content Security Policy (CSP) and other response headers to reduce browser attack risks
• Primary application and database infrastructure in the EU, with other processing locations described below
• Email verification for account deletion

If you use the CLI, it can save your full API key in a local configuration file. Protect that file. A custom HTTP endpoint configured in the extension does not provide the HTTPS protection of our default endpoint.

9. AI Data Processing

Hosted AI analysis and generation features send the information needed for the selected task: issue details, WCAG criteria, selectors, bounded HTML examples, report findings or bounded excerpts from publicly accessible legal pages. Excerpts may contain personal data such as provider names, business email addresses or postal addresses. Sanitization and size limits reduce unnecessary content but cannot guarantee that every personal detail is removed. Do not submit credentials or unnecessary sensitive information.

Depending on the configured feature, processing can use OpenAI, Anthropic or Google Gemini APIs. API retention, safety monitoring and model-training conditions depend on the provider, service tier and applicable agreement. We do not promise universal zero retention. Turning off response storage does not by itself disable a provider’s abuse-monitoring retention. Contact us for the provider and data-processing terms applicable to your use.

Regulatory AI output is supporting evidence, not a legal verdict. Quoted excerpts are matched to the fetched source before use; AI-only evidence cannot establish an automatic passing result. Generated fixes and draft reports require human review. Our own retention of evidence, work data and results is described in Section 5.

Downloading AI Fix Instructions does not itself send the file to an AI provider. The file contains stored HTML examples and selectors. Review and redact it before sharing it with a coding assistant; that provider’s terms govern your subsequent submission.

10. Children's Privacy

The Service is designed for business use and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly.

11. International Data Transfers

Primary application and database storage is in the EU. Processing may also take place in the United States, including selected browser checks and external providers, and in Ukraine where our operator is based. Global edge services may process requests elsewhere. Storage location alone does not define every processing location. International transfers must use the applicable safeguards described in Section 4; contact us for relevant recipient and transfer details.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before they take effect. The "last updated" date at the top indicates the most recent revision.

13. Browser Extension

Local extension quick scans run on your device without an account. The extension automatically loads a bundled listener on permitted HTTP(S) pages; an accessibility scan runs when you request it. Local scanning does not itself upload the result.

13.1 Local storage and tokens

• chrome.storage.local holds settings, the latest 50 scan results and, when linked, refresh credentials. Scan history persists until removed or displaced by newer results.
• chrome.storage.session holds linked authentication credentials, including access and refresh tokens, during the browser session. Refresh credentials are also retained locally. Server token validity is 90 days for access tokens and 180 days for refresh tokens; clearing session storage is not server-side revocation.
• chrome.storage.sync is not used to synchronize credentials or scan history between devices.

13.2 Requests to AllyProof

• Save to dashboard: sends the page URL, title, duration, score, severity counts and violations, including failing-element HTML.
• Crawl this site: sends the target site address to request a server-side scan.
• AI fix: separately sends selected issue details, selector, failure summary and bounded HTML. This can include personal data present in the page and does not require saving the full scan first.
• Link extension: opens the AllyProof website for sign-in and explicit linking confirmation, then transfers newly issued extension tokens to the extension. Credentials are entered on the website. Authenticated requests may automatically refresh tokens and retry.

13.3 Browser permissions

• Chrome and Edge use activeTab, tabs, storage, scripting and sidePanel. Firefox uses the first 4 permissions; results appear in the popup or a separate window.
• The manifest declares content scripts for HTTP(S) pages. The literal <all_urls> permission is not requested, but this does not make page access gesture-only. The bundled listener loads automatically; scan execution is requested by you.
• Tab metadata supports switching the displayed result. Storage holds preferences, results and credentials; scripting loads the bundled scanner when needed. The browser-history permission is not requested.

13.4 Remote code and telemetry

• Extension code is bundled in the store package, not loaded as remote executable scripts.
• The current extension has no third-party analytics SDK, advertising scripts or implemented telemetry sender. Its optional telemetry setting is off by default.
• Saving, AI requests, crawling, linking and token refresh use the network as described above. The default API endpoint uses HTTPS; a custom HTTP endpoint does not encrypt that transport.

14. Contact

For privacy-related questions or to exercise your data rights, contact us at: legal@allyproof.com