Privacy policy
Last updated: 2026-09-29
Who is responsible
For account administration, billing, security and the operation of this website, the controller within the meaning of the GDPR is:
SIA Amber CloudIeroču iela 14-4
LV-1013 Rīga
info@geta11y.com
Our role depends on the processing
For our own activities — managing accounts, billing, securing the service and operating this website — we act as controller. For personal data contained in the websites you ask us to audit, you (or, where you act for a client, your client) determine the purposes: we process that content only on your documented instructions, as your processor — or as a subprocessor where you are yourself a processor for your client. That processing is governed by our Data Processing Agreement, which forms part of every customer relationship, including trials.
What data we process
We deliberately collect as little as possible. In practice that is the following categories:
- Account data — your email address, an optional name, your country and language preference, and a hashed password. We never store your password itself.
- The websites you ask us to audit — the addresses you submit, plus the page content, screenshots and technical structure we retrieve from them in order to perform the audit.
- Audit results — the findings, scores and reports we generate, so that you can return to them and compare them against later audits.
- Payment data — handled by our payment provider. We receive confirmation that a payment succeeded and the invoice details — never your full card number.
- Technical and security data — IP addresses, request logs and error diagnostics that we keep to run the service securely and to investigate abuse.
- Correspondence and records — Support messages you send us, and records of the terms, declarations and consents you accept, with their date and text version.
Why we process it, and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Providing your account | Art. 6(1)(b) where you contract with us yourself; Art. 6(1)(f) — administering our customer relationship — where you use an account for your employer or client | Until you delete your account; backup copies expire within 30 days |
| Running audits and producing reports | Art. 6(1)(b) for our customer; audited website content on your documented instructions (Art. 28) | Reports and evidence screenshots: 2 years from delivery, or earlier on your deletion request; raw page content and DOM snapshots: 90 days after the audit; backup copies expire within 30 days |
| Payment processing and invoicing | Art. 6(1)(b) and (c) — contract and legal obligation | For the periods required by the Latvian Accounting Law (five to ten years depending on the record type) |
| Security, error diagnosis and abuse prevention | Art. 6(1)(f) — legitimate interest in a working, secure service | Up to 90 days |
| Support and correspondence | Art. 6(1)(b) and (f) — answering you and keeping a record of what was agreed | 2 years after the correspondence closes |
| Records of accepted terms, declarations and consents | Art. 6(1)(f) and (c) — evidencing the contract and complying with legal obligations | For the limitation period applicable to contractual claims |
To delete your account, individual sites or audit data, use the dashboard or write to the address above; we act within one month. Deleted data persists in encrypted backups for up to 30 days before those backups expire.
Who else processes your data
We use the following providers under data processing agreements. Where a provider also acts as an independent controller for parts of its own service — for example Stripe for payment fraud prevention and its own legal obligations — it is responsible for that processing itself.
| Processor | Role | Processing location |
|---|---|---|
| netcup GmbH | Hosting of the application and database | Germany |
| Anthropic PBC | AI analysis of page content and screenshots during an audit | USA Third country |
| Google Ireland Ltd. (Gemini API) | Classifying discovered pages by type | Ireland / USA Third country |
| Stripe Payments Europe Ltd. | Payment processing and invoicing (also an independent controller for fraud prevention and its own compliance) | Ireland / USA Third country |
| Resend Inc. | Sending transactional email (sent from the provider's EU region, Ireland) | USA / EU region (Ireland) Third country |
| Functional Software Inc. (Sentry) | Technical error reporting (data stored in the EU region; vendor access from the USA possible) | Germany (EU data region) / USA Third country |
| Scaleway SAS | Encrypted off-site backups | France |
Providers marked as third country are established in, or may access data from, outside the European Economic Area — in particular the USA. Each such transfer is covered by a data processing agreement with the provider that incorporates the European Commission's Standard Contractual Clauses; some providers additionally participate in the EU–US Data Privacy Framework. We provide details of the safeguard applying to a specific provider on request.
A note on the websites you audit
To perform an audit we retrieve pages from the address you give us and send their content and screenshots to our AI processors for analysis. If those pages contain personal data — customer names in a review, for example, or an employee photo — that data is processed as part of the audit. We do not use your content to train models, and provider-side use and retention are restricted by our agreements with them.
Please only submit websites you own or are authorised to have tested. For personal data in that content, the roles described above apply: you (or your client) are the controller and we process on instructions under the Data Processing Agreement.
Data processing agreement
Our Data Processing Agreement under Art. 28 GDPR forms part of every customer contract, including free trials. It covers processing on documented instructions, confidentiality, security measures, the engagement of the subprocessors listed above, breach notification, assistance with data subject rights, and deletion or return of data at the end of the contract. geta11y.com/legal/dpa
Cookies
We set exactly three cookies, none used for tracking, and each exempt from consent on its own ground: the login cookie (access_token; session) is strictly necessary to provide the signed-in service you request; the language cookie (lang; 12 months) and the market cookie (market; 12 months, set only if you use the selector) store a preference you explicitly chose and exist solely to honour that choice. There are no analytics, no advertising and no third-party cookies. We will re-verify this inventory when payments are enabled and update this section if checkout introduces provider cookies.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15)
- have inaccurate data corrected (Art. 16)
- have your data deleted (Art. 17)
- restrict how we process it (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
To exercise any of these, write to the address above. We will respond within one month.
You also have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv). You may also complain to the authority in the member state where you live or work.