Privacy Policy

Effective date: 5 October 2026. Applies to: siteaccessible.com and its subdomains, the customer panel, and the SiteAccessible widget wherever it is embedded.

1. Introduction

SiteAccessible is a product of QROLLING LLC, a limited liability company registered in Georgia under number B26345195, with its registered office at 75A Erosi Manjgaladze Street, Tbilisi 0159, Georgia, Tax ID EN3289008 (“SiteAccessible”, “we”, “us”, “our”). We operate the website siteaccessible.com, the customer panel and the embeddable accessibility widget (together, the “Service”).

QROLLING LLC is the data controller for the personal data described in this policy, except where we say that we act as a data processor on behalf of our customers — which is the case for what the widget processes on a customer's website. This policy explains what we collect, why, how long we keep it and what your rights are.

For any privacy matter you can write to [email protected]. No Data Protection Officer has been appointed, because QROLLING LLC is not a public authority, its core activities do not consist of large-scale, systematic monitoring of individuals, and it does not process special categories of personal data on a large scale within the meaning of Article 37 GDPR. We will reassess this as our processing evolves.

This policy applies to:

• Customers — people who register an account and manage websites in the panel;
• Website visitors — people who browse our own website without an account, or who write to us;
• End users — people who visit a customer's website on which the widget is installed.

2. International Users

QROLLING LLC is registered in Georgia. Our application servers and database are hosted in the European Union (Frankfurt, Germany), and some of our providers operate in other countries. By using the Service you acknowledge that personal data may be transferred to and processed in Georgia, the European Union and the other countries listed in Section 6, which may have data-protection laws that differ from those of your country.

We design our practices to respect, among others, the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA, Türkiye's KVKK and the Law of Georgia on Personal Data Protection. Nothing in this policy limits rights you have under mandatory data-protection or consumer-protection law; where local law gives you greater protection, that protection applies.

3. Information We Collect

3.1 Information customers give us

• Account data. Your name, email address, password (stored only as a salted one-way hash — never in plain text), and, if you provide them, your organisation, country, phone number and preferred language. We record when the account was created and the time of your last sign-in.
• Website and widget settings. The names and domains of the websites you register, their public site keys, and the widget configuration you choose: position, colours, languages, enabled adjustments, custom CSS and the address of your accessibility statement.
• Subscription data. Your plan, trial and renewal dates and subscription status. When you pay, our payment provider shares with us transaction identifiers, amounts, invoice references and your billing country.
• One-time codes. When you reset your password we email you a six-digit code, and staff accounts (our own team) confirm every sign-in with one. We store only a keyed hash of each code, valid for ten minutes, and delete expired codes daily.
• Email confirmation. At sign-up we email you a signed link to confirm your address. Nothing is stored for it except the fact that you confirmed.
• Accessibility statements. If you use the statement generator, the answers you give in its form — organisation, website, conformance status, known limitations, contact details and the like — and the statement built from them. A published statement is public by design.
• Communications. Messages you send through the contact form and emails to our support addresses, together with your name, email address and, if given, your organisation and website.

Important: SiteAccessible does not receive or store full payment-card numbers, security codes or other payment-instrument details. Payments are handled by Paddle.com Market Ltd, our merchant of record, as described in Section 6.

3.2 Information collected automatically from customers and website visitors

• Session data. When you sign in we set a session cookie (see Section 14).
• Server and security logs. Like every web service, our servers and our content-delivery provider record requests — IP address, browser user agent, the address requested and the time — to keep the Service secure and to diagnose faults.
• Rate limiting. To stop abuse (repeated sign-in attempts, password-reset requests, contact-form spam) we count requests per IP address in memory for a short time. These counters are not written to the database.

Analytics, only with your consent. If you accept in the cookie banner, our website loads Google Analytics, which tells us which pages and which of our ads bring people to the site and whether they sign up or buy a plan. It sets cookies in your browser and sends Google your IP address, browser details and the pages you view. If you reject it, or until you choose, nothing of Google’s is loaded and no request goes to Google. Ads personalisation (remarketing) stays off either way. You can change your choice at any time under “Cookie settings” at the bottom of every page.

We do not build profiles of visitors, and the widget on our customers’ websites never loads Google Analytics or any other tracker (Section 3.3).

3.3 Information about end users of customers' websites (the widget)

When the widget loads on a customer's website, the following — and nothing else — happens:

• Request data. The visitor's browser requests the widget script, its configuration and, if the visitor switches on the dyslexia-friendly typeface, a font file from our servers. As with any web request, this transmits the visitor's IP address, user agent and the address of the embedding page's domain. We use the domain to check that the widget is licensed for that website.
• Usage counters. The widget always reports that it was loaded — one count per page view, which we need to meter the customer's plan and to confirm the installation. Only if the customer keeps analytics switched on does it also report that its panel was opened and which adjustment was switched on. Each report travels with the visitor's IP address like any web request; we store it only as a total per website per day. A stored counter contains no IP address, no cookie, no page address and no identifier of the visitor.
• Counting once. To avoid counting the same page view twice and to limit abuse, we hold a value derived from the visitor's IP address in the memory of our servers: a keyed hash (HMAC) under a random secret that exists only in that server process and is discarded when it restarts. Each value is kept for at most 24 hours, is never written to disk or to the database, and is not used for anything else.
• The visitor's own settings. The adjustments a visitor chooses, the position of the button and the language they picked are saved only in that visitor's browser (local storage, under the keys siteaccessible:state and siteaccessible:position), so the settings survive a reload. The stored settings themselves are never sent to us.
• Read aloud. On plans that include it, the widget can read the page aloud with the speech engine built into the visitor's browser. The text never passes through our servers. The widget prefers voices that run on the device; some browsers also offer online voices, and if the browser uses one, that browser's maker receives the text under its own privacy terms.
• Dictionary. On plans that include it, when the visitor selects a single word with the dictionary switched on, the widget sends that word and its language to our servers, which look the definition up on Wiktionary (run by the Wikimedia Foundation) and send it back. Wiktionary receives only the word, from our servers — never the visitor's IP address or the page address. Answers (the word and its definition, nothing about who asked) are kept in our servers' memory and by our content-delivery provider for up to a day, so that a repeated word is answered faster; the visitor's address is used only for the in-memory rate limit described above.

4. How We Use Information

• Service delivery. To provide and maintain the Service: running your account, serving the widget with your configuration, and showing you your usage.
• Authentication and security. To verify your identity, keep your session, protect accounts, detect and prevent abuse and fraud, and enforce our Terms.
• Billing. To manage subscriptions, plan limits and renewals together with our payment provider, and to answer billing questions.
• Communication. To send transactional email (one-time codes, a welcome message, receipts, service and billing notices), to answer support requests, and — only if you have opted in — to tell you about new features.
• Service improvement. To analyse aggregate usage, diagnose technical problems and develop the Service.
• Legal compliance. To comply with laws, regulations and lawful requests, and to establish, exercise or defend legal claims.

5. Legal Basis for Processing (GDPR)

6. How We Share Information

We do not sell personal data. We have never sold personal data and have no plans to do so. We share information only in these limited circumstances:

• Sub-processors. The providers listed below operate parts of the Service on our behalf, under written agreements that require them to process data only on our instructions and in accordance with data-protection law.
• Legal requirements. We may disclose information if required by law, in response to a valid court order or other binding request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud.
• Business transfers. In a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of the transaction. We will notify you by email or by a prominent notice before your data becomes subject to a different policy.
• With your consent. For any other purpose, only with your explicit consent.

6.1 Current sub-processors and service providers

Transfers outside the European Economic Area are safeguarded by the European Commission's Standard Contractual Clauses or an equivalent mechanism recognised by applicable law. We update this list when it changes and announce new sub-processors that handle customer data in advance, as described in our Data Processing Agreement.

6.2 No sale or sharing for advertising

We do not sell personal data and do not share it for cross-context behavioural advertising within the meaning of the CCPA/CPRA or equivalent laws.

7. Automated Decision-Making

The Service makes no decision that produces legal or similarly significant effects on you based solely on automated processing (Article 22 GDPR). Automated processing is limited to aggregating usage counters and to abuse controls such as rate limits. A person takes the final decision on any account suspension.

8. Data Retention

When data is no longer needed we delete it or irreversibly anonymise it.

9. Data Security

• Encryption in transit. All traffic between browsers and our servers is encrypted with TLS.
• Passwords and codes. Passwords are stored as salted bcrypt hashes; password-reset codes as keyed hashes. We never store either in plain text.
• Sessions. Session cookies are HttpOnly and cannot be read by scripts; changing or resetting a password ends every existing session.
• Access control. Access to personal data is limited to authorised personnel who need it, and the database is not reachable from the public internet.
• Isolation. Each customer can see and change only their own websites; the widget runs only on the domains a customer has registered.
• Incident response. If a breach affects your personal data we will notify you and the competent authorities as the law requires.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

QROLLING LLC is based in Georgia, an EU candidate country whose Law on Personal Data Protection is aligned with the GDPR. Our primary hosting is in the European Union. Where personal data is transferred to a country that has not been recognised as providing adequate protection, we rely on Standard Contractual Clauses approved by the European Commission, on our providers' certifications, and on technical measures such as encryption in transit.

11. Your Rights Under the GDPR

If you are in the European Economic Area, the United Kingdom or Georgia, you have the right to:

• Access — obtain a copy of the personal data we hold about you and information about how we process it.
• Rectification — have inaccurate or incomplete data corrected. You can change most account data yourself in the panel.
• Erasure — have your personal data deleted, subject to legal exceptions. You can delete your account yourself in the panel's account settings.
• Restriction — have processing restricted in certain circumstances.
• Portability — receive your data in a structured, commonly used, machine-readable format. You can download it yourself in the panel's account settings.
• Object — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complain — to the supervisory authority of your country of residence, work or the alleged infringement, or to the Personal Data Protection Service of Georgia.

To exercise a right, write to [email protected] with the subject “Data Rights Request”. We respond within 30 days and may need to verify your identity. If a request is complex we may extend this by up to 60 days and will tell you why. There is no fee unless a request is manifestly unfounded or excessive.

If you are an end user of one of our customers' websites: we hold no data that identifies you, so there is normally nothing we can look up. You can erase the widget's settings yourself by pressing “Reset” in the widget or clearing the website's data in your browser. For anything else, contact the owner of the website, who is the controller.

12. California Residents (CCPA/CPRA)

This section applies to residents of California. SiteAccessible does not sell personal information and does not share it for cross-context behavioural advertising. In the past twelve months we have collected these categories from customers: identifiers (name, email address, IP address, account identifiers); internet or network activity (requests to the Service); commercial information (plan and billing history); and professional information you chose to provide (organisation name).

• Right to know what personal information we have collected, from which sources, for what purposes and with whom we share it.
• Right to delete your personal information, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — we do neither.
• Right to limit the use of sensitive personal information — we do not use it beyond what the CPRA permits.
• Right to non-discrimination for exercising your rights.

To make a request, write to [email protected] with the subject “CCPA Request”. We verify your identity and respond within 45 days. You may designate an authorised agent.

13. Brazilian Users (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (Law No. 13,709/2018) gives you the rights to confirmation of processing and access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent. We process data on the bases described in Section 5. Write to [email protected] to exercise these rights; you may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

14. Cookies and Local Storage

Without your consent we set only cookies that are strictly necessary or that remember a choice you made. Analytics and ad-measurement cookies (Google Analytics) are set only if you accept them in the cookie banner, as Article 5(3) of the ePrivacy Directive requires; until you choose, and if you reject, none are set and nothing of Google’s is loaded. Your choice is kept in your browser’s local storage, and you can change it at any time under “Cookie settings” at the bottom of every page. Withdrawing consent turns Google Analytics off and deletes its cookies.

You can block or delete cookies in your browser settings. Blocking the session cookie prevents you from staying signed in.

15. Children's Privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to [email protected] and we will delete it.

16. Customers' Websites and Third-Party Links

The widget runs on websites that belong to our customers. We do not control those websites, their content or their privacy practices; each website's own privacy notice governs what that website does with your data. Our website may also link to third-party websites, which are governed by their own policies.

17. Controller and Processor Roles for Widget Data

The customer who installs the widget decides to offer it on their website and is the data controller for the processing described in Section 3.3. SiteAccessible acts as data processor, on the customer's instructions and under our Data Processing Agreement. As controller, the customer is responsible for having a lawful basis, for telling their visitors about the widget where the law requires it, and for answering their visitors' requests. As processor, we process that data only to provide the Service, keep it secure, do not use it for our own purposes except in aggregated form that identifies no one, and notify the customer of any personal-data breach affecting it.

18. Data Processing Agreement

Our Data Processing Agreement (siteaccessible.com/legal/dpa) forms part of our Terms and applies automatically to every customer. It sets out the subject matter and duration of processing, the categories of data and data subjects, each party's obligations, our sub-processors, breach notification and deletion. If your organisation needs a countersigned copy, write to [email protected].

19. Changes to This Policy

We may update this policy to reflect changes in our practices, technology or the law, and will update the “Last updated” date when we do. For material changes — to the categories of data we collect, how we use it or who we share it with — we will give at least 30 days' notice by email to the address on your account or by a prominent notice on our website.

20. Contact Us

• SiteAccessible is a product of QROLLING LLC.
• Registered address: 75A Erosi Manjgaladze Street, Tbilisi 0159, Georgia
• Company registration: B26345195 (National Agency of Public Registry, Georgia)
• Tax ID: EN3289008
• Privacy and data protection: [email protected]
• General and billing: [email protected]
• Website: siteaccessible.com

We aim to respond within 30 days. People in the EU and EEA may also complain to their national supervisory authority; people in Georgia to the Personal Data Protection Service of Georgia.