Legal

Privacy Policy

Last updated April 28, 2026

Summary

ScanAble is a self-serve accessibility auditing service. We collect the minimum data needed to run scans, deliver the paid PDF report, and bill subscribers. We do not sell your data.

Data we collect

• URLs you submit. The web addresses you ask us to scan. Stored with the resulting scan record. See “How we handle scanned URLs” below for the full disclosure.
• Email addresses. Provided at checkout (single PDF) or sign-up (API subscription) so we can deliver the report and receipts.
• Payment metadata. Stripe processes all card data directly. We store only the Stripe customer/session IDs, the last four digits of the card brand description, and amount/currency.
• API usage records. API key ID, timestamp, and URL scanned. Used for rate limiting, metering, and abuse prevention.
• Standard request logs. IP address, user agent, and request path, retained for up to 30 days for security and debugging.

How we handle scanned URLs

URLs are often the most sensitive thing buyers send us — an admin dashboard, an unannounced staging environment, or a customer-specific path can leak strategy or break a NDA. So our handling of them is worth spelling out in detail.

• We do not publish URLs you submit. URLs from the paid scan flow, the free preview, the API, and the Site Audit are stored privately on your scan record and are visible only to ScanAble operators with database access and to anyone holding the scan’s ID or the verify URL printed on the PDF cover. The public domain leaderboard at /check/<domain> is populated only from a public list of top-traffic domains (Tranco) that we scan ourselves on a schedule — never from customer-submitted URLs.
• The signed PDF embeds the URL. The cover page prints the URL you scanned, and the cryptographic signature covers it. That’s the whole point of the audit artifact — the buyer needs to be able to prove which URL was audited. Treat the PDF and its signed payload accordingly.
• We do not store page contents. The HTML, DOM, screenshots, and rendered output of pages we scan are processed in memory and discarded once the scan finishes. We persist only the axe-core findings (rule IDs, severities, affected element selectors, and short HTML snippets — capped at 500 characters per node — needed to render the report).
• Authenticated-scan cookies are never persisted. When you provide session cookies (via the API, or via the homepage “Scan a page behind a login” form), those cookies stay in browser memory until payment confirms via Stripe Elements, then are sent directly to the scanner and held only in memory for the duration of the request. They are never written to the database, never logged, never included in the signed report payload, never echoed in API responses, and not replayable on a later re-scan. Card data goes directly from your browser to Stripe through their Elements iframe and never touches our servers.
• Sub-resources may be requested by the browser. To render the page accurately, our headless browser fetches the same third-party resources your visitors’ browsers do (fonts, analytics, CDN assets). We don’t store those URLs or their responses, but they will appear in the destination’s server logs.

What we do not collect

• We do not store the HTML, screenshots, or DOM of pages we scan.
• We do not store cookies or any auth credentials submitted with a scan.
• We do not track your visitors or install tracking pixels on your site.
• We do not sell or share personal data with advertisers.

Why we process data

• To perform the scan you requested and deliver the report you paid for.
• To process payments and bill subscriptions (via Stripe).
• To send transactional emails (via Resend) — receipts and download links.
• To detect abuse, rate-limit API usage, and keep the service reliable.
• To meet legal tax and accounting obligations.

Sub-processors

• Vercel — hosting and serverless execution (US data center by default, EU on request).
• Neon — managed PostgreSQL for scan records and user data.
• Stripe — payment processing, invoicing, Customer Portal.
• Resend — transactional email delivery.

Retention

• Free preview scan results: retained up to 30 days.
• Paid scan records: retained indefinitely so the signed report remains verifiable at /verify/<report-id> and so the free 90-day re-scan and any tax/refund obligations can be honoured. You can request deletion at any time after the 7-day refund window has closed (see Your rights below).
• API usage records: retained for 13 months for billing reconciliation.
• Request logs: retained for up to 30 days.

Your rights (GDPR / CCPA)

You can request access to, correction of, or deletion of your personal data by emailing support@scanable.dev. We will respond within 30 days. If you are in the EU/UK, you have the right to lodge a complaint with your local data protection authority.

Cookies

ScanAble uses strictly necessary cookies for session handling on the developer dashboard, and optional analytics cookies via Google Analytics. No advertising cookies are set.

Contact

Privacy questions: support@scanable.dev.