Privacy Policy

1. Who we are

A11y Shield is a European Accessibility Act (EAA) compliance service that scans the public pages of websites for accessibility issues and helps you produce and maintain accessibility statements.

The data controller for the personal data described in this policy is Luke Duff, trading as lukeduff.co.uk, based in England & Wales. For any privacy question, or to exercise your rights, email hello@lukeduff.co.uk.

2. What we collect

We keep the data we hold deliberately narrow. In practice that means:

• Account data. When you sign up, our authentication provider (Clerk) processes your name, email address and organisation name so you can sign in and we can associate your account with your organisation.
• Billing data. If you subscribe, we store the Stripe customer and subscription identifiers that link your account to your plan. We do not store or ever see your card number — card details are entered directly with Stripe, who handle payment data as a PCI-DSS compliant processor.
• Scan data. The URLs you submit, the public page content our scanner fetches from those URLs, and the accessibility results we generate (issues found, severity, and the statements produced from them). Our scanner only requests pages that are publicly reachable; it does not sign in or access anything behind a login.
• Free-scan lead email. If you run a free scan, we collect the email address you give us so we can send you the report.
• Usage and technical logs. Standard operational data such as IP addresses, request timestamps and rate-limiting counters, used to run, secure and debug the service.

3. How we use it

We use the data above to:

• provide and operate your account and the A11y Shield service;
• run the accessibility scans you request and store their results;
• send you scan alerts and the free-scan report by email, and respond to support requests;
• take payment and manage your subscription;
• keep the service secure — detecting abuse, enforcing rate limits and preventing fraud.

4. Legal bases (UK GDPR)

We rely on the following legal bases to process your personal data:

• Performance of a contract — to provide the service to you and your organisation, run scans and take payment.
• Legitimate interests — to run, secure and improve the service and prevent abuse, balanced against your rights.
• Consent — for marketing emails and any non-essential cookies. You can withdraw consent at any time.
• Legal obligation — where we must keep certain records, for example for tax and accounting.

5. Sub-processors

We use a small set of trusted providers to run A11y Shield. Each processes data only on our instructions, and we require appropriate data-protection terms with every one of them.

6. International transfers

We keep our core database and scan worker in the EU. Where a processor is located outside the UK or EEA, we rely on the UK Government’s adequacy regulations or on Standard Contractual Clauses (with the UK Addendum) to make sure your data receives an equivalent level of protection.

7. Data retention

We keep your account details and scan history for as long as your account is active, so your compliance record stays intact. Free-scan lead emails are kept only as long as needed to deliver and follow up on the report, and are pruned periodically. When you close your account, or ask us to delete your data, we remove it from our live systems and instruct our processors to do the same, subject to any records we are legally required to retain.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict how we process your data;
• receive your data in a portable format;
• object to processing based on legitimate interests.

To exercise any of these, email hello@lukeduff.co.ukand we will respond within the statutory timeframe. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we’d appreciate the chance to put things right first.

9. Security

We protect your data with encryption in transit, access controls and EU-based storage for our core systems. For a fuller description of our safeguards, see our security overview.

10. Children

A11y Shield is a business tool and is not intended for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service evolves or the law changes. When we do, we’ll revise the “last updated” date above, and for significant changes we’ll let account holders know by email.

12. Contact

Questions about your privacy or this policy? Email hello@lukeduff.co.uk and a real person will get back to you.