Privacy policy
Effective October 16, 2026. What we collect, why, how long we keep it and the choices you have. For a shorter overview see Security and privacy.
1. Who is responsible
JM, doing business as A11ie, a sole proprietorship in Massachusetts, United States, is responsible for the personal data described here. Contact us at hello@a11ie.io.
2. What we collect
- Account data: your email address and a salted hash of your password (never the password itself).
- Scan data: the URLs you submit, the time of the scan and the results, which include HTML snippets of the elements that failed. A page you scan could contain personal data, so please do not scan pages you are not allowed to test.
- Usage-limit data: to apply daily limits to scans run without an account, we store a salted hash of your IP address next to the scan. We do not store the raw IP address in our database.
- Billing data: your plan, subscription status, purchase records and Stripe's customer reference. Card details are entered on Stripe and are never stored by us.
- Messages: emails you send us and our replies.
- Technical logs: our hosting provider records standard request information (such as IP address, time, page requested and browser type) for security and operations.
- Cookies: one HTTP-only session cookie when you are logged in. We do not use advertising or analytics cookies or trackers.
3. Why we use it, and our legal bases
- To run scans, show your history and reports, and provide the service you asked for (performance of a contract).
- To take payments and keep tax and accounting records (contract and legal obligation).
- To send account emails such as verification, password reset and receipts (contract). We do not send marketing email unless you have asked for it.
- To keep the service secure, prevent abuse and enforce rate limits (legitimate interests).
- To answer your messages and improve the service (legitimate interests).
We do not sell personal data, and we do not use your scan results or content to train AI models.
4. Who we share it with
We use these service providers, who process data for us:
- Render, our hosting provider, which stores our database and runs the service and keeps server logs;
- Stripe, for payments and billing;
- Resend, for sending account emails.
Anyone who has a report's web address can view that report. We may also disclose information if the law requires it, to protect our rights and users, or as part of a sale or transfer of the service. Our providers may process data in the United States and other countries.
5. How long we keep it
| Data | Kept for |
|---|---|
| Hashed IP address on a scan | 24 hours, then removed |
| Hosting and server logs | Up to 30 days |
| Account data | While your account exists, then deleted within 30 days of a deletion request |
| Scan results and reports | Until you delete them or your account is deleted |
| Billing and tax records | 7 years, as required for accounting and tax |
| Messages you send us | 2 years |
| Backups | Up to 35 days, after which deleted data drops out of backups |
| Login sessions | Up to 30 days |
6. Security
We use measures such as encrypted connections, hashed passwords and tokens, and restricted access. No system is perfectly secure, so we cannot guarantee absolute security. Read more on the security page.
7. Your choices and rights
You can delete any scan from your account at any time, which removes that report. You can ask us to access, correct, export or delete your personal data, or to close your account, by emailing hello@a11ie.io; we will answer within 30 days. Depending on where you live (for example the EU, UK or California), you may have additional rights, including to object to or restrict some processing and to complain to your data protection authority. We do not discriminate against people who exercise their rights. We keep some records, such as billing records, where we are required to by law.
8. Children
Allie is not for children under 16 and we do not knowingly collect their data. If you think a child has given us data, email hello@a11ie.io and we will delete it.
9. International transfers
We are based in the United States, and our providers may process data there and elsewhere. Where the law requires it, we rely on appropriate safeguards for such transfers.
10. Changes
We may update this policy. The effective date at the top shows the latest version.