Privacy policy

Last updated: 9 October 2026 · Controller: Brightstep Tech Inc., Resi-Huber-Platz 1, 81371 München, Germany · Contact: [email protected]

What we process

• The URL you ask us to check. We load that page, and up to 4 pages linked from it, in a headless browser on our server and run automated accessibility rules. We do not write the URLs or the scan results to disk. The finished report is kept in server memory for up to 60 seconds so that a repeated request does not load the site twice, and is then discarded. We do not take or keep screenshots.
• Report contents. The report includes short HTML snippets and CSS selectors from the scanned page. They are sent to ChatGPT as the tool result and are not stored by us. A "compare key" in the result contains the scanned URL, the time and the number of issues per rule; it lives in your conversation, not on our server, and is only read back if ChatGPT sends it with a rescan.
• Usage statistics. For each call we store the hour, the function name, whether it worked, which assistant made the call (Claude, ChatGPT or other, from the request's technical headers, plus the app name it declares), the country and language reported by ChatGPT, and a one-way hash of the anonymous user ID that OpenAI provides. We use this only to count usage and fix errors, and delete it after 90 days.
• Abuse protection. A short-lived in-memory counter per anonymous user ID and per IP address limits how many scans can be run. It is never written to disk and is cleared within 24 hours.

Why we process it (legal bases)

• Scanning the URL and building the report you ask for, including the 60-second cache: Art. 6(1)(b) GDPR (providing the service you request).
• Anonymous usage statistics: Art. 6(1)(f) GDPR; our legitimate interest is to run the service, count usage and fix errors.
• Abuse protection and rate limiting, including Cloudflare transit: Art. 6(1)(f) GDPR; our legitimate interest is to keep the service secure and available.

What we do not collect

No names, email addresses, accounts, chat history, cookies or advertising identifiers. Scans run in a fresh browser profile with no cookies, so we never see content behind your login. Server logs record only the scan duration, page count and memory use, and for failures only the error type, not the URLs or page content.

Processors and transfers

The server runs on Amazon Web Services (Frankfurt, EU) (privacy notice). Requests to this service pass through Cloudflare, Inc. (content delivery network and TLS proxy), which processes the connecting IP address and the request data in transit to deliver them to our server; Cloudflare may process this data outside the EU (privacy policy). To scan a page, our server connects to the website you named and to the third-party resources that page loads (for example fonts, scripts and images), as any browser would. Apart from these processors and the sites you ask us to scan, no third party receives your data. The server is in the EU (AWS, Frankfurt). Cloudflare operates a global network, so request data in transit may be processed outside the EU/EEA, including in the USA; such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, or on the EU Standard Contractual Clauses. We do not sell or share data and do not use it to train models.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, objection (to processing based on legitimate interests) and data portability. Write to [email protected]. You can also complain to a supervisory authority, in particular in your country of residence; our lead authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (lda.bayern.de).