Privacy Policy

Who we are

A11y Labs, Inc. ("Inclusivio", "we", "us") is a Delaware corporation based in the United States. This policy covers the Inclusivio website, web app, API, MCP server, Chrome extension, and Shopify app (the "Service").

For account, billing, and website data, we are the controller (or "business"). For the content of websites our customers scan, we process data on our customer's behalf as a processor (or "service provider") under our Data Processing Addendum, and the customer's own privacy notice applies.

Information we collect

Information you give us:

• Account details: name, email address, and profile picture from our sign-in provider, plus organization name, membership, and role.
• Onboarding answers, such as your role and the kind of sites you work on.
• Scan input: the URLs you submit and any instructions you add.
• Billing details: plan, billing email, and subscription status. Card details are collected and stored by Stripe, not by us.
• Support and sales messages you send us.

Information created when you scan

When you scan a page, our servers load it in a headless browser and capture its HTML, a rendered preview, screenshots, and the accessibility results. If a page contains personal information, that information may be included in what we capture. Please scan only pages you are authorized to test and avoid scanning pages that show sensitive personal data.

Guest scans (without an account) keep results in your browser's local storage (IndexedDB). A temporary preview of the scanned page is held on our servers for about one hour so the preview can be displayed, then expires.

Information collected automatically

We collect device and usage data such as IP address, browser type, pages viewed, actions taken in the app, referring URLs, and error reports. We use PostHog for product analytics and error tracking, and our hosting provider keeps server logs. See our Cookie Notice for details.

How we use information

• To provide the Service: run scans, store results, generate AI fix suggestions, manage organizations, and enforce plan limits.
• To process payments and manage subscriptions.
• To secure the Service, prevent abuse, and debug problems.
• To understand how the Service is used and improve it.
• To communicate with you about your account, changes, and, where permitted, product news. You can opt out of marketing email at any time.
• To comply with legal obligations and enforce our terms.

AI processing

When you request an AI fix, explanation, or caption, relevant parts of the scanned page (such as the HTML around an issue, the rule that failed, and sometimes a screenshot or media) are sent to an AI model provider to generate the response. We use providers' API terms under which customer data is not used to train their models. We do not use your Customer Content to train AI models.

How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We share it only:

• With service providers (subprocessors) that host, store, authenticate, bill, analyze, or process data for us, listed on our Subprocessors page.
• With members of your organization, who can see the organization's scans and results.
• With platforms you connect, such as Shopify, as needed to run that integration.
• When required by law, or to protect the rights, safety, and security of our users, the public, or Inclusivio.
• In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

Retention

We keep account and scan data while your account is active. When you delete scans or close your account, we delete the related data within 30 days, except for backups (which roll off on their normal cycle) and records we must keep for legal, tax, or accounting reasons. Guest previews expire after about one hour; guest results stay in your browser until you clear them.

Security

We use encryption in transit, access controls, and reputable infrastructure providers to protect personal information. No system is perfectly secure. See our Security page.

Your choices and rights

You can update account details in the app and delete scans at any time. To access, correct, delete, or export your personal information, or to object to or restrict processing, email contact@thea11ylabs.com. We will verify your request and respond within the time the law requires. We will not discriminate against you for exercising your rights.

We do not currently respond to browser "Do Not Track" signals, but we honor Global Privacy Control signals as an opt-out of any sale or sharing where the law requires it.

US state privacy rights

Residents of California and other states with comprehensive privacy laws may have the right to know what personal information we collect, use, and disclose; to access, correct, and delete it; to opt out of sale, sharing, and targeted advertising (we do none of these); and to appeal a decision about a request. An authorized agent may submit a request for you with proof of authorization.

In the past 12 months we collected the categories described above: identifiers, commercial information (subscription records), internet or network activity, and professional information (organization and role). We disclosed them to service providers for the business purposes described above. We do not collect sensitive personal information for the purpose of inferring characteristics about you.

European Economic Area, UK, and Switzerland

If the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you (providing the Service and billing), our legitimate interests (security, analytics, improving the Service, and business communications), your consent (where we ask for it, such as optional cookies), and compliance with legal obligations.

You have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. You may also complain to your local supervisory authority.

We are based in the United States and our providers process data there and elsewhere. When we transfer personal data out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Changes and contact

We will post changes here and update the date above. For material changes we will notify account holders by email or in the app.

Questions or requests: contact@thea11ylabs.com.