EveryVisitor Legal

Privacy Policy

Last updated: October 18, 2026 · Effective date: October 18, 2026

Our Core Privacy Commitment: No Tracking Cookies

EveryVisitor is built with a strict privacy-first philosophy. We do not use third-party tracking cookies, cross-site advertising beacons, or behavioral remarketing pixels anywhere on our marketing site or application. Our website analytics are powered by our self-hosted Umami instance, which does not track individuals, does not collect personal identifiers, and complies with EU ePrivacy regulations without annoying cookie consent banners.

1. Information We Collect

Account & Profile Data: When you register for EveryVisitor, we collect your email address, name, hashed password, and organization name. For team invitations, we collect the email address and assigned role.

Site & Scan Configuration: We store the domains you register, verification records (DNS/file tokens), scan schedules, page path exclusions, and scan results (rule violations, CSS selectors, affected HTML snippets, and scores).

Payment & Billing Data: Payment card details, billing addresses, and invoices are processed and stored directly by Paddle.com Market Ltd. (our Merchant of Record). EveryVisitor stores only customer references, subscription IDs, and billing status.

Technical & Log Data: We collect essential server access logs, IP addresses for security and session revocation, and audit log entries of sensitive account actions (e.g., role changes, member removals, session revocations).

2. How We Use Your Information

To provision and maintain your accessibility monitoring and scan engine.
To generate on-demand and scheduled compliance reports (PDF and CSV exports).
To detect regressions and transmit urgent alerts when critical accessibility barriers emerge.
To enforce multi-tenant isolation, account security, and active session control.
To communicate product updates, billing receipts, and service notices.

3. Subprocessors & Service Providers

We partner with a minimal, vetted list of infrastructure and technology providers to deliver EveryVisitor:

PostgreSQL Hosting: Dedicated managed database infrastructure for persistent application data.
Cloudflare: Turnstile privacy-preserving bot defense (no interactive captchas, no tracking) and R2 object storage for scan artifacts and signed reports.
Resend: Transactional email delivery for regression alerts, verification emails, and report distribution.
Paddle: Payment gateway and Merchant of Record.
Google Gemini (Optional): Optional AI fix suggestions if explicitly triggered; all code snippets are scrubbed of emails and phone numbers before transmission.

Review our complete list of subprocessors and data transfer mechanisms in our Subprocessors Registry.

4. Data Retention & Erasure

We retain scan results, issue histories, and audit records for as long as your account remains active.

You may request an export of your personal data archive or request complete account deletion at any time in Account Settings. Upon organization deletion, all associated scan data, HTML snippets, and database records are scheduled for permanent purge across our database and object storage.

5. Your Rights Under GDPR, UK GDPR, and CCPA

Depending on your location, you hold statutory rights regarding your personal data, including the right to access, rectify, export, restrict processing, or request erasure of your data.

To exercise any statutory privacy right, you can use the self-service export and deletion controls in your settings dashboard or contact our Data Protection Officer at privacy@plainsight.io.