This policy explains what personal data AccessBadger collects, why, who we share it with and what your rights are. We try to collect as little as we need.
Who we are
AccessBadger is a business based in the United Kingdom. We run accessbadger.com, a service that scans websites for accessibility problems, measures how fast they load for real visitors and tracks search rankings. For the personal data described in this policy we are the controller, except where we handle feedback reports on behalf of a website owner (see “The feedback widget”). You can reach us through our .
What we collect, and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Name, email address and profile picture from your Google account, when you sign in | To create your account and sign you in | Contract: we need it to provide the service to you |
| A session cookie that keeps you signed in | To keep you signed in as you move between pages | Contract. It is strictly necessary for the service |
| The websites you add, and the results of scans of them | To run scans and show you reports, scores and issues | Contract |
| The web address you enter in the free scanner on our homepage, a keyed (scrambled) hash of your IP address and the website’s host name. We do not store your IP address for these scans | To run the scan and to limit abuse of the free scanner, such as automated flooding | Legitimate interests: keeping the service secure and affordable |
| Your name, email address, message and IP address when you use the contact form | To reply to you and to limit abuse of the form | Legitimate interests: answering enquiries and preventing abuse |
| The Google account email that connected Search Console, an access token (encrypted before it is stored) and Search Console data for the phrases you choose to track | To show you your search rankings | Contract, and your consent when you connect Google |
| Statements and contact details you enter into the statement generator | To generate and store your accessibility statements | Contract |
| Your email address, for alerts and optional summary emails | To tell you about new accessibility blockers, search connection problems and your weekly summary | Contract, or legitimate interests for service alerts. Summary emails are opt-in |
The feedback widget
If a website you visit uses the AccessBadger accessibility feedback widget and you send a report, we store what you write, the address and title of the page, your browser’s user-agent text and your IP address, and your email address only if you choose to give it and agree to be contacted. For these reports the website owner decides why and how the data is used and is the controller. AccessBadger processes it on their behalf. If you want to see, correct or delete a report you sent, contact the website owner. You can also use our and we will pass your request on.
If you run a website with the widget, you are responsible for telling your visitors how their reports are handled, for example in your own privacy policy.
Website speed measurements
Website owners can add a small AccessBadger script to their pages to measure Core Web Vitals from real visits. For each measured page load we store the page path, the device type, the country, the connection type and the speed measurements. We do not store the visitor’s IP address, and we do not set a cookie or store any identifier in the visitor’s browser. Each measurement has a random ID that exists only for that page load. The country comes from a header added by our hosting provider.
Cookies
We use one cookie that is strictly necessary: the session cookie that keeps you signed in. We do not use advertising or analytics cookies. The bot check on our free scanner is provided by Cloudflare (Turnstile). To tell people from automated programs it may read or store information on your device, and Cloudflare handles that data under its own privacy policy.
Who we share data with
We do not sell personal data. We use these kinds of provider to run the service, and they process data on our behalf or, for Google and Cloudflare, under their own terms:
- A hosting provider, which delivers the website and runs our servers.
- A database provider, where account, scan and report data is stored.
- An email delivery provider, which sends our emails.
- A remote browser provider, whose browsers load web pages so that we can scan them.
- Cloudflare, which provides the Turnstile bot check on the free scanner.
- Google, for signing you in and for the Search Console data you choose to connect.
We keep a current list of the providers we use. If you would like to see it, use our and we will send it to you.
We may also disclose data where the law requires it, or to protect our rights or the safety of others.
Transfers outside the UK
Some of these providers handle data outside the United Kingdom, including in the United States. Where they do, we rely on a safeguard the UK GDPR recognises for that transfer, such as an adequacy arrangement or standard contractual clauses with the UK addendum. You can ask us for details.
How long we keep data
We keep personal data only for as long as we need it for the purposes above. We keep your account and your sites’ data while your account is active, and we delete it when you ask us to. Sign-in sessions expire automatically. To ask us to delete your data, use our .
Your rights
Under the UK GDPR you have the right to:
- be told what personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted in some circumstances;
- restrict or object to how we use your data in some circumstances;
- receive your data in a portable format;
- withdraw consent at any time where we rely on it, for example by disconnecting Google in the Search tracking section.
To use any of these rights, use our and tell us which right you want to use. We will reply within one month. If you are not happy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk, or to the data protection authority in your own country.
Keeping data safe
Traffic to our website uses HTTPS. Google Search Console access tokens are encrypted before they are stored, and the free scanner stores a keyed hash of your IP address rather than the address itself. No system is perfectly secure. If a breach affects your personal data in a way the law says we must report, we will tell you and the regulator.
Children
AccessBadger is a business service and is not aimed at children.
Changes to this policy
If we change this policy in a way that matters to you, we will update the date at the top of this page and, where appropriate, tell you by email.
Contact us
Questions about this policy or your data: use our .