Privacy policy

Who's responsible for your data

You can also reply to any email we've sent you, or write to wcagwatch@mail.tirelesslabs.com — that's the address WCAG Watch sends from, and anything arriving there reaches us and gets acted on.

What we collect

When you use WCAG Watch, we collect:

• the URL of the page you ask us to check — including the address it redirects to, if it does
• what the check found: which WCAG rules failed, how many elements failed each one, the CSS selectors of the first few failing elements, and the page's title
• a one-way hash of your IP address against each scan — that is how the free limit of five scans a day per visitor is counted; the address itself is never stored
• the email address you type into “email me this report”, if you use it — that box is handled by our shared email service at funnel.tirelesslabs.com
• if you tick the optional marketing box beside it, a record of that tick: the exact wording you were shown, the version of this policy in force, the page you were on, your browser's user-agent string and a one-way hash of your IP address — that record is the proof your consent was real, it is written once and can never be edited
• if you subscribe to monitoring: the billing email address Polar passes us, the site URL you give on the setup page, and your attestation that you own that site or are authorised to have it tested — stored as the exact sentence you were shown, its version, the date, your browser's user-agent string and a one-way hash of your IP address, because that attestation is our authorisation to crawl and has to stay provable
• if you subscribe to monitoring, the per-page result of every crawl: for each page reached, its URL, the address it redirected to, the page title, the HTTP status, and the same rule failures and CSS selectors described above

If you subscribe to monitoring (€29/month, one site), Polar takes the payment and sends us the subscription metadata — your email address, which product, the amount and the renewal state. No card details ever reach us. We then email you a one-time setup link; the site URL and the ownership attestation you give on that page are what authorise the weekly crawl, and we scan nothing until they exist. Cancelling stops the crawl at the end of the paid period.

That is the whole list. We only ask for what the product needs to do the thing you asked for — nothing is collected “just in case”, and there are no hidden fields beyond a honeypot that catches spam bots and stores nothing.

Why we can do that (lawful basis)

• To write and send you the report you asked for — performance of a contract (Art. 6(1)(b) GDPR). You asked for a specific thing; we need what you submitted to produce it and an email address to send it to. This covers every field above.
• To look at the thing you asked us to look at — legitimate interest (Art. 6(1)(f)). You are asking us to examine your own public page, or material you sent us about it, and tell you what we think of it.
• To count page views and form completions — legitimate interest, using cookieless, anonymised analytics (below). No cookies and no cross-site identifiers are set, so no consent banner is required and you will not see one.
• To mention a paid upgrade inside the delivery email itself — performance of a contract, because that offer rides along with the report you already requested.
• To send you marketing email, if and only if you ticked the optional box — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any moment with one click. Nothing else on this site relies on consent, and withdrawing it costs you nothing you already have.

We only send marketing email to people who ticked the box asking for it. That box starts unticked, sits apart from the thing you are actually asking for, and refusing it costs you nothing: your report is not marketing, and neither is the emailed copy of your scan — you get both whether you tick it or not. There is no pre-ticked box anywhere on this site, and there never will be.

One mechanical detail, because it is exactly the sort of thing a policy should not bury: if you do tick the box, we email you a confirmation link first and hold the report until you click it, so that one click both confirms the address and delivers what you came for. If you never click, the report is sent to you anyway within 48 hours — we promised it, and that promise does not depend on a consent you were free to withhold. Every marketing email after that carries one-click unsubscribe, and unsubscribing never takes away anything we already sent you.

Analytics — cookieless by design

We use Umami, which we host ourselves on the same server as this site. It sets no cookies, uses no cross-site or persistent identifier, does not fingerprint your browser, and sends nothing to any third party. Visits are counted against a hashed, daily-rotating value that cannot be tied back to you or followed from one day to the next.

Because no consent-requiring tracking technology is in use, there is no cookie banner on this site. If that ever changes, the banner appears before the tracking does — not the other way round.

Separately, the free scan limit needs to count scans per visitor per day, so we store a one-way hash of your IP address on the scan record — a salted HMAC, which cannot be turned back into your address by us or by anyone who obtained the database. We never store the address itself, never log it, and never use the hash for anything except counting against that daily limit. It is deleted with the scan record when you ask us to delete it.

Who else can see it

• Nobody, for the report itself — the checks run on our own server, in a browser we control. What you type in the box is not sent to any AI model, any third-party scanning service, or anyone else. The only outbound request is the one that fetches your page, made to your own site, from a user-agent that names us.
• Resend — sends our email, and only if you ask us to email you a copy. Resend operates under a Data Processing Agreement incorporating the EU Standard Contractual Clauses for its US operations (DPA · sub-processors).
• Our hosting provider — runs the single server everything on this site lives on. Our database, our analytics and these pages are all on it; nothing is farmed out to a third-party analytics or CRM product.
• Cloudflare — runs DNS for tirelesslabs.com and forwards mail sent to our support address.

We do not sell your data, and we never pass it to anyone for their own marketing. There is no ad network, no data broker and no tracking pixel anywhere on this site.

How long we keep it

We keep your submission, the report we generated from it and any order metadata for 12 months from the day we delivered — then we delete it.

Twelve months is long enough to answer a follow-up question about something we sent you or to sort out a payment dispute, and short enough that we are not sitting on your data for no reason. If you want it gone sooner, say so and it goes — see your rights, below.

The email-my-report signup is held separately by our shared email service, on its own clocks: if you never confirm, your address is deleted after 30 days; if you do confirm, we keep it until you unsubscribe or ask us to delete it, and a subscription dormant for two years gets flagged for re-permission or removal. The consent record itself — the wording you were shown, and when — outlives the address, because it exists to answer the question “did this person really agree?” and is worthless if we can delete it at will. It is append-only: we cannot edit it, and neither can anyone else.

We never publish your report

Your page and the report we produced about it are never published, shown as an example, or shared with anyone else. There is no opt-in for this on WCAG Watch — it simply does not happen.

Your rights

Under the GDPR you can ask us, at any time and without giving a reason, to:

• Show you everything we hold about you (access)
• Correct anything that is wrong
• Delete all of it (erasure)
• Object to how we are using it, or ask us to restrict it
• Get a copy of what you gave us in a portable form
• Withdraw your consent to marketing email — one click in any of those emails, no reason needed, and it takes effect immediately. Withdrawing does not undo the sending that was lawful before it.

Email support@tirelesslabs.com or wcagwatch@mail.tirelesslabs.com, or just reply to any email we have sent you. We aim to act within a few days and are bound to act within 30 days at the outside. We will tell you what we deleted when it is done.

One honest limit: if you paid, the payment record itself sits with Polar as merchant of record, under retention rules that tax and accounting law impose on them rather than on us. We will delete our own copy of your order metadata immediately, and point you at Polar for theirs.

If you think we have handled your data badly, you are entitled to complain to your national data protection authority. We would rather you told us first — write to support@tirelesslabs.com and we will fix it.

The AI part, stated plainly

Tireless Labs is operated by an AI system: it picks the experiments, writes the sites, ships them and measures them. A human operator sets the budget, approves anything that spends money or gets published under a personal identity, and can stop any of it.

Your report is not written by AI. It is produced by axe-core, an open-source rule engine, running in a headless browser on our server. The same page scanned twice gives the same answer, and no part of what you submit is sent to a language model. The explanations beside each finding are fixed text written in advance, not generated per report.

We say this because the EU AI Act's transparency rules require us to be clear about where AI is and is not involved, and because "an AI wrote your accessibility report" would be a better story than the truth and is not the truth.

Changes to this policy

If this policy changes, the date at the top changes with it. This is version 2026-08-03.

If you tick the optional marketing box, the version of this policy in force at that moment is stored with your consent — so what you agreed to is fixed at the text you were shown, not at whatever this page says later.