Short version: We use account and scan data to run the service, prevent abuse, process one-time payments, and answer support requests. A scan can save screenshots, page titles, URLs, check details, element locations, and short pieces of page code from public pages. We do not sell personal information, use advertising trackers, or use scan content to train AI models.
1. Scope and operator
This policy applies to Accessibility by OpenSiteCheck, the website accessibility scanning service operated by LATTY INTERACTIVE LLC ("OpenSiteCheck," "we," "us," or "our"). It covers our public website, accounts, scans, online reports, downloadable reports, support, and report email delivery.
LATTY INTERACTIVE LLC5830 East 2nd Street, STE 7000 #33665
Casper, WY 82609-4308
United States
support@opensitecheck.com
The public beta is directed to United States businesses and professionals. The free scanner may be reachable from elsewhere, but availability alone is not an offer of paid services in every country.
2. Data we collect and why
| Category | Examples | Why we use it |
|---|---|---|
| Account data | Email address, password hash, account ID, account creation time, password-reset token hash and expiry, and the user ID and email held in the login session. | Create and secure your account, sign you in, reset a forgotten password, show your history, and communicate material service information. |
| Scan requests | Submitted URLs, discovered URLs, root domain, selected tier, requested page list, and site-authorization, business-use, and legal confirmations. | Validate, schedule, rate-limit, and perform the scan you request. |
| Page and report data | Final URL, page title, loading result, screenshot of the first page where available, details from the automated checks, element locations, short HTML examples, problem counts, report grade, errors, and suggested fixes. | Create, display, download, email, troubleshoot, and save the report. |
| Security and usage data | IP address, root domain, timestamps, request ID, status, duration, queue and error events, Turnstile challenge results, and hashed rate-limit identifiers derived from IP addresses, emails, user IDs, scan IDs, or recipient emails. | Enforce quotas, distinguish legitimate visitors from automated abuse, investigate faults, protect target websites, and keep the service available. |
| Purchase data | Purchase and report IDs, account ID where applicable, purchaser email, tier, payment-provider order or session ID, payment status, amount entitlement, and timestamps. | Process and reconcile one-time purchases, deliver the report, handle refunds, prevent duplicate fulfillment, and keep required business records. |
| Email and support data | PDF recipient email processed when you request delivery; a stored recipient hash, delivery state, provider message ID, and bounded error details; support messages, accessibility feedback, privacy requests, takedown notices, and information you include in them. | Deliver a report, diagnose delivery, answer your request, verify authority, resolve disputes, and document the response. |
You can use the public site without creating an account. Some data is required to provide a feature: for example, an email and password are required for an account, and a valid public URL is required for a scan. If you do not provide required data, that feature will not work.
We do not use the automated grade or scan results to make decisions about a person that have legal or similarly significant effects.
3. What a public-page scan does
The scanner opens the submitted public URL in an isolated browser. The target website and its hosting or analytics providers will receive network requests from our scanner and may record the scanner IP address, user agent, requested URL, and related request data under their own policies.
axe-core checks the page as it appears in the browser. A public page can still contain personal information in its text, URL, images, or code. That information may appear in a screenshot, title, element location, check result, or short HTML example saved with the report.
Do not submit logged-in, private, personal, confidential, or sensitive pages. Paid multi-page reports require confirmation that you own or are authorized to test every listed website. Additional URLs discovered through a sitemap or crawl follow applicable robots.txt rules; a URL you explicitly submit remains a user-directed request.
For people whose information appears on a scanned public page, the source of that information is the public URL submitted by a user. It is impractical for us to identify and contact every person who may appear in arbitrary public markup. We publish this notice, limit the data and retention period, and provide an expedited report takedown process.
4. AI-assisted suggestions
If we do not already have a matching suggestion saved in our 90-day cache, we send only what is needed to draft one: the page URL and title, details from the automated check, related WCAG references, element locations, number of matches, one short HTML example, and up to four more examples. We do not send the screenshot, complete page source, browser cookies, account password, or full page structure.
Production requests are routed through Requesty's EU endpoint to DeepInfra-hosted models in the United States. The production configuration requires confirmation that Requesty's zero-data-retention setting is enabled. Requesty lists the selected DeepInfra models as having no provider retention and no training use. We still tell users not to scan sensitive pages because a public snippet may contain information that neither we nor a provider can reliably recognize in advance.
Generated suggestions are stored in our PostgreSQL database and may be reused for the same rule and normalized markup pattern. The cache key is a cryptographic hash rather than the raw snippet. Suggestions may be incomplete or incorrect and must be reviewed, adapted, and retested by a person.
Provider practices can change. We review the configured model, retention setting, and provider disclosures before production changes. If we cannot maintain the no-training configuration described here, we will update this notice before using the changed setup for new scans.
6. Report access and sharing
Reports linked to an account require the matching signed-in user. A guest paid report can be viewed by anyone who has its hard-to-guess link. Treat that link like a private document: do not post it publicly or send it to someone who should not see the page URLs, screenshots, code examples, or results.
Report routes are sent with noindex, nofollow, noarchive, and private, no-store instructions. Those controls reduce indexing and caching but cannot stop a recipient from copying, downloading, emailing, or resharing a report.
Guest report links expire when the stored scan is deleted under the 90-day retention schedule. Before then, the purchaser or an authorized website representative can request removal through our takedown process.
7. How long we keep data
| Data | Retention |
|---|---|
| Completed or failed scans | Normally deleted 90 days after creation, including page evidence, screenshots, report data, and downloadable-report source data. Queued or running scans are kept until they leave an active state and become eligible for cleanup. |
| Scan usage and AI fix cache | 90 days. |
| Report-email delivery attempts | Stored under the report and deleted when that report is deleted, normally after 90 days. The raw recipient address is not stored in the attempt record. |
| Password-reset tokens | Usable for 30 minutes. Unused records are deleted after expiry; consumed records are deleted within one day. |
| Fixed-window rate limits | Deleted after two days. Subjects are stored as SHA-256 hashes, except the raw IP and root domain used for the anonymous 20-minute scan cooldown. |
| Accounts | Until you request deletion or we close an inactive or abusive account. Deleting an account also deletes its stored scans; transaction records may remain as described below. |
| Purchase records | Normally deleted after seven years by automated retention. A record may be held longer when reasonably required for tax, accounting, fraud prevention, dispute resolution, or another legal obligation. |
| Support and legal requests | Normally up to two years after closure, longer when needed to establish authority, resolve a dispute, enforce terms, or meet a legal obligation. |
| Application and proxy logs | Kept in size-limited rotating local logs and overwritten as those limits are reached or containers are replaced. Error records may be retained longer when needed to investigate an incident. |
Third-party providers keep their own account, security, transaction, and delivery records under their policies. We do not currently maintain an off-site database backup. If encrypted backups are introduced, this policy will describe their retention and how deletion requests propagate through the backup rotation.
9. Access, correction, deletion, and other choices
You may ask us to provide a copy of account data, correct an email address, remove a report, or delete an account and associated scans. A report or account deletion also removes matching snippet-cache entries that can be derived from the stored findings; unrelated shared entries expire under the 90-day cache schedule. Depending on where you live, applicable law may provide additional rights to access, correct, delete, restrict, object, appeal, or receive a portable copy of personal information.
- Email support@opensitecheck.com with the subject Privacy request.
- Write from the email attached to the account where possible and state whether you want access, correction, report removal, or account deletion.
- Include the report URL or ID if the request concerns a scan. Do not email a password, payment credential, government ID, or sensitive page content.
- We will verify that you control the account or are authorized to act for the affected website or person before disclosing or deleting data.
We may retain purchase records, completed request records, or limited security data when reasonably necessary and legally permitted. We will explain any material part of a verified request that we cannot fulfill. You may also opt out of non-essential email by contacting us; we do not currently send marketing email.
The service is for adults acting in a business or professional capacity and is not directed to children under 18. Contact us if you believe a child has submitted personal information so we can investigate and remove it where appropriate.
10. Security and policy changes
We use measures designed to protect stored data, including HTTPS, access controls, a dedicated scanner without application secrets or database access, restricted production containers, a private database network, hashed passwords and reset tokens, sealed session cookies, request limits, and automated retention. No internet service can guarantee absolute security.
If we materially change what we collect, why we use it, who receives it, or how long it is kept, we will update the date above and provide additional notice where appropriate. A material change applies prospectively unless law requires otherwise.
11. Contact
Questions, privacy requests, or complaints can be sent to support@opensitecheck.com. See the Contact page for the mailing address and the information to include in accessibility, security, copyright, or takedown requests.