Privacy policy

The controller responsible for the processing of personal data on this website and in the Accessonaut service is rocket-ship, proprietor Florian Bischof, An der Halde 7, 89081 Ulm, Germany. Contact: info@accessonaut.com. You can find further details in the imprint.

We rely on Art. 6(1)(b) GDPR where the processing is necessary for a contract with you or for steps taken prior to entering into one, on Art. 6(1)(c) GDPR for legal obligations (for example, retaining invoices), on Art. 6(1)(f) GDPR for our legitimate interest in a secure, stable and improved service, and on Art. 6(1)(a) GDPR where you have given your consent. The following sections state the legal basis of each processing operation. You can object to processing based on Art. 6(1)(f) GDPR (see Right to object).

Accessonaut runs on our own server, which we operate with Contabo GmbH, Munich. The server is located in Contabo’s data centre in Lauterbourg (France), i.e. in the EU. It runs the website, the application, our API at api.accessonaut.com, the database, audience measurement (Umami) at analytics.accessonaut.com and error diagnostics (GlitchTip) at errors.accessonaut.com. We have concluded a data processing agreement with Contabo pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(b) and (f) GDPR.

We back up our databases daily on this server. Only we have access to the backups. We keep them for 30 days and then delete them automatically; if a new backup is not created, we keep the most recent one so that a restore remains possible. On this server, deleted data may therefore remain in a backup for up to 30 days. In addition, twice a day we store an encrypted copy of these backups and of the server configuration with Google Cloud (Google Cloud EMEA Limited, Dublin) in its Frankfurt am Main data centre. The data is already encrypted with AES-256 on our server; only Accessonaut holds the key, and Google stores encrypted data only. We keep 30 daily and 12 monthly versions; Google retains deleted versions for a further 30 days. Deleted data may therefore remain in an encrypted backup for up to approximately 13 months. We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR (Cloud Data Processing Addendum). We use the backups solely to restore data after an outage or data loss (Art. 6(1)(f) GDPR).

Every request to accessonaut.com and api.accessonaut.com is first received by our web server (Nginx), which forwards it to the application. In doing so, it technically processes your IP address, the time, the requested address, the browser identifier (user agent) and usual connection data. For Accessonaut, the web server does not write the addresses of the pages accessed, query parameters or referring pages (referrers) to its access logs. If a request already fails at the web server, its error log may contain the IP address and the requested address; error logs are rotated daily and deleted after 15 days at the latest.

The application logs requests to its API with the request method, the path without parameters, the status code and the processing time, without the IP address, headers or request content. These logs are kept in the server’s size-limited system log; older entries are overwritten automatically. To prevent abuse, the application counts requests per IP address in memory for a time window of one minute. We need this processing to operate the service securely and reliably and to detect attacks and errors (Art. 6(1)(f) GDPR).

For the check you request, we process the URL you enter, publicly accessible page content and the check results. Login credentials and private network targets are not permitted. Results and access tokens are purged after 24 hours. To limit abuse, we store for each check an HMAC value of your IP address created with a secret key instead of the address itself. This allows us to limit how many checks you can start at the same time (at most 3), per hour (at most 20) and within 24 hours (at most 50). Regardless of who is checking, the same website can be checked at most 20 times per hour; for this, we count checks by the checked address. The HMAC value is deleted together with the check after 24 hours. Your browser stores an access token for the check in the tab’s session storage. The legal basis is Art. 6(1)(b) GDPR for the requested check and Art. 6(1)(f) GDPR for limiting abuse. Scanned pages may themselves contain personal data; therefore, only check websites that you own or are authorised to check.

The free website check on the home page, at /en/check and at /en/bfsg-check starts without a checkbox. To protect it against automated abuse, we use the invisible service Cloudflare Turnstile. The script is only loaded from challenges.cloudflare.com once you use the form, for example by clicking into the address field, typing something or starting the check; merely visiting the page does not load Turnstile. Only in exceptional cases does Cloudflare display a box for you to confirm. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. In the process, Cloudflare receives technical signals such as the IP address, browser identifier, TLS characteristics and the identifier and origin of our website. Cloudflare processes them for the security check on our behalf and, to improve its bot detection, also as an independent controller.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in preventing abuse and keeping the capacity of the website check available to visitors. Where this involves strictly necessary access to your device, we base it on § 25(2) no. 2 TDDDG. Turnstile does not set a cookie. The one-time token is held only in the page’s memory; it is used up when the check starts and otherwise expires after 5 minutes. Our server verifies the token with Cloudflare before it creates a check, without transmitting your IP address, the address to be checked or an e-mail address. We do not store the token in the check. If the verification is blocked or fails, no check can be started.

Processing by Cloudflare may take place in the USA; Cloudflare cites the EU-US Data Privacy Framework and, where applicable, standard contractual clauses as the bases for transfers. Retention at Cloudflare is governed by the purpose-related criteria described there; we do not set a fixed erasure period for Cloudflare’s systems. Further information and contact details: Cloudflare: Turnstile Privacy Addendum and Cloudflare: Privacy Policy.

The same check protects signing up with an e-mail address at /auth/register: there, too, Turnstile only loads once you use the form, and our server verifies the single-use token before the account is created, without passing your IP address, your e-mail address or your password to Cloudflare. If the check is blocked or fails, the account cannot be created. Signing up through a team invitation or with Google does not use Turnstile.

If you request a report by e-mail, we pass the recipient address and the PDF with the checked URL and findings to Resend (see E-mail delivery). This serves solely to send the report once, as requested (Art. 6(1)(b) GDPR). The delivery reference and recipient address remain stored for up to 90 days so that we can prevent duplicate sends and handle errors. For a further delivery attempt, the PDF file remains stored until it has been handed over successfully, at most until the check is purged. Requesting the PDF does not sign you up for advertising.

Only with your express consent do we store your e-mail address, the checked website and the time and version of your consent in order to contact you about this check (Art. 6(1)(a) GDPR). The contact request is deleted after 90 days. You can withdraw your consent at any time with effect for the future by e-mail to info@accessonaut.com. The request does not sign you up for a newsletter.

With your consent, we store your name, e-mail address, organisation, field of activity, country, optional website and message in order to handle your proposal and contact you about it (Art. 6(1)(a) GDPR). We record the time and version of your consent. We notify ourselves of a new enquiry by e-mail, with your address set as the reply-to address. The details are accessible only to platform administration and do not sign you up for a newsletter. Partner enquiries are deleted after 90 days. You can withdraw your consent and request earlier erasure.

To limit abuse, we store a value of your IP address pseudonymised by means of HMAC for the duration of the enquiry process. A random enquiry reference and a checksum value prevent duplicate enquiries if a submission is retried. These values are removed together with the enquiry (Art. 6(1)(f) GDPR).

For your account, we store your name, e-mail address, a hash of your password or, if you sign in with Google, your Google account ID, and the verification status. In addition, there are your organisation, projects, scan results, the results and notes of your manual checks, widget settings, usage counters and your plan. We never store your password in plain text. To confirm your address and reset your password, we use time-limited one-time tokens (confirmation 24 hours, password link 60 minutes). The legal basis is Art. 6(1)(b) GDPR.

Project reports remain stored until you delete the project or your account. You can delete projects yourself in the dashboard. You can request the deletion of your account at any time by e-mail to info@accessonaut.com; we will carry it out within 30 days unless a statutory retention obligation prevents this.

When you sign up, we also store which link on our website brought you to the sign-up (a short identifier such as “pricing_free”), where applicable the campaign details utm_source, utm_medium and utm_campaign from the address of the sign-up page, and the host name of the website you came from (for example www.google.com, without a path). The sign-up page reads this information from its own address and the referring page when you submit it; no cookies are set and nothing is stored on your device for this. Information that does not fit this format (such as e-mail addresses) is discarded. We only evaluate it in aggregate to understand which pages and channels lead to sign-ups (Art. 6(1)(f) GDPR) and delete it together with your account.

Instead of using an e-mail address and password, you can also sign up and log in with your Google account. Google is only involved once you choose Google sign-in; we never learn your Google password. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For the scopes ‘openid’, ‘email’ and ‘profile’, Google transmits to us your name, your e-mail address including its verification status and your unique Google account ID. We only link an existing password account at your express request after you have logged in. A short-lived cookie protects the sign-in process (see Cookies). The legal basis is Art. 6(1)(b) GDPR.

Google itself is responsible for the sign-in process at Google. In the process, data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). Further information: Google Privacy Policy.

Saved accessibility statements and plain-language texts are kept with their versions in your project. We store inputs, source text, scan evidence, drafts, the editor’s ID, timestamps and the express approval. Drafts are accessible only to logged-in project members. Only on publication does the approved version become accessible via a public, unguessable link and an optional embed; anyone with this link can read it. Later changes to a draft only become public after renewed approval.

You can withdraw a publication; copies already made by third parties cannot be recalled by doing so. The service includes an annual e-mail reminder to review a statement, sent to an active, verified owner or administrator account. We keep document versions until the document, project or account is deleted. The legal basis is Art. 6(1)(b) GDPR.

For image descriptions and plain-language texts, we use Anthropic’s Claude API, currently with the Claude Sonnet 5.5 model; the alt-text generator uses the Claude Haiku 5.5 model from the same provider. The contracting party for customers in the European Economic Area is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. We only transmit data to Anthropic when you expressly start an AI job or, on the Pro and Business plans, switch on image automation for a project. We transmit the content needed for the job: for plain language, the source text with target group, purpose and technical terms; for image descriptions, the image data; in each case with the page title and page context. For image descriptions, our server downloads the selected public image and transmits the image data. For plain-language texts, we first have Anthropic count the length of the job free of charge (token counting); the same content is transmitted for this. With image automation switched on, this happens for newly found images in your project without any further individual request until you switch it off. Each job is sent once, without automatic retries and without being passed on to other AI providers. A mere website scan does not trigger any AI processing.

We store the generated drafts and usage counters in your project; we document the time and version of your approval of AI processing. Anthropic processes the data as our processor (Art. 28 GDPR) under the Data Processing Addendum, which forms part of Anthropic’s Commercial Terms. Under these terms, Anthropic may not use inputs and outputs to train its models. According to Anthropic, it automatically deletes API inputs and outputs within 30 days. They are kept for longer only where required by law or to enforce Anthropic’s usage policies: inputs and outputs flagged by automated safety systems for up to 2 years, and the related safety assessments for up to 7 years (Anthropic: data retention for the API). Processing in the USA is possible; the basis is the EU standard contractual clauses agreed in the Data Processing Addendum (Art. 46(2)(c) GDPR). Further information: Commercial Terms, Data Processing Addendum and Anthropic Privacy Policy. The legal basis is Art. 6(1)(b) GDPR. Please only submit content you are authorised to have processed; particularly sensitive or confidential content does not belong in these tools.

The AI tools “Convert text to plain language” and “Alt-text generator” are only available to signed-in users, on the tool pages and in the workspace. When you start a request and agree to the transfer, we send the content needed for it to Anthropic (Claude): for the conversion, your text, its language and the chosen audience; for the alt-text generator, the uploaded image file, your optional page context and the chosen language. Before processing, we have Anthropic count the length of the request free of charge (token counting); the same content is transmitted for this. Each request is sent once, without automatic retries.

Accessonaut does not store the inputs or results of the tools: text, image, context and result are only processed in memory for the duration of the request and shown to you. They do not end up in our database, our server logs or error diagnostics. A result is only stored if you take it over yourself, for example as a draft in the plain-language area (see the section on statements and plain-language texts). For the monthly allowances, we only store how often each tool was used per account and calendar month; for the shared AI capacity of Free accounts, we also store a monthly total that is not linked to any account.

The purpose is to provide the function you request; the legal basis is Art. 6(1)(b) GDPR. Anthropic processes the content as our processor; for the contractual basis, retention at Anthropic and possible processing in the USA, the section AI features with Claude (Anthropic) applies. Only submit content you may have processed. Images can contain personal data, such as recognisable people; the tool is not intended to identify people.

For the document service you order, we store the uploaded PDF file, the extracted text, obstacles detected during the check, processing details and the generated PDF and HTML reading versions. The files are processed on our server; the conversion does not use any AI provider. The text of scanned pages is read by text recognition software (Tesseract) exclusively on our server; no data is transmitted to third parties in the process. Files and content data are available for at most 84 days within the respective processing cycle and are then removed automatically; you can see the expiry date in your account, and you can delete documents before then. We keep order, invoice and payment details for longer because of legal obligations (see Stripe). The legal basis is Art. 6(1)(b) GDPR. Only upload files for which you hold the necessary rights and have a basis for processing.

Website operators can embed our reading-aid widget on their website. When someone visits such a page, their browser requests the published widget configuration from api.accessonaut.com. In doing so, it transmits the project ID, the domain of the website and the address of the current page, so that we can deliver approved image descriptions for exactly this page, and, for technical reasons, the IP address and browser identifier. We do not store these details in our database. For the website operator, we store per project only when the widget was last loaded on the registered website and how often it was loaded on each calendar day (widget views for the plan’s quota). The timestamp is updated at most every 6 hours; neither value relates to individual visitors. If someone opens the reading-aid menu, the widget also reports, at most once per page view, that the menu was opened, the page path without parameters and without identifier-like components (such as order numbers), a rough device class (desktop, tablet, smartphone) and which reading aids and profiles were switched on. This report contains no cookies, no identifier and no referrer; we only count it as daily totals per project for the website operator’s usage statistics, store neither the IP address nor the browser identifier in the process, and delete the daily totals after about 13 months. Browsers with ‘Do Not Track’ or Global Privacy Control do not send such reports, nor does the shop privacy mode of our WooCommerce plugin. So that bots and automated checks are not counted, we evaluate the browser identifier only at the moment of the request and do not store it. To limit abuse, we count requests per IP address in memory for one minute; our API logs contain only the path without parameters (see Server logs). The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in delivering the widget securely.

The settings that visitors choose in the widget, such as font size or contrast, are stored by the widget in their browser’s local storage under ‘accessonaut_accessibility_settings’; they are not transmitted to us. Older versions used the key ‘inclulab_accessibility_settings’; it is carried over and deleted on the next visit. This is necessary for the function the visitor has expressly requested (§ 25(2) no. 2 TDDDG). On the Free plan, the widget shows a link to Accessonaut. Whether the widget is embedded is decided by the respective website operator, who provides information about it in their own privacy policy.

The private browser assistant on the Pro and Business plans shows logged-in project members findings directly on their website. For this, a start code valid for at most 10 minutes is exchanged for a session of at most 30 minutes; the page address and domain are transmitted so that the matching findings can be displayed. The legal basis is Art. 6(1)(b) GDPR.

We bill paid plans and the document service via the payment service provider Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). The data processed are your name or company, billing address and e-mail address, the plan or order booked, payment and invoice history and your payment method details. You enter your payment method details in a Stripe form embedded in Accessonaut; we do not receive full card numbers, only details such as the card brand, the last four digits and the expiry date. Stripe’s scripts are only loaded when you prepare a payment or change a payment method. For fraud prevention, they collect device and connection data such as the IP address and may use cookies or similar technologies for this purpose that are strictly necessary for the payment process you have requested (§ 25(2) no. 2 TDDDG).

Where Stripe processes payments for us, Stripe acts as our processor. For its own purposes, in particular fraud prevention, its own legal obligations and settlement with card and payment networks, Stripe is an independent controller (Stripe Privacy Policy). Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, Stripe uses EU standard contractual clauses (Art. 46(2)(c) GDPR). The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR. We keep invoices and accounting records for eight years (§ 14b(1) UStG, § 147 AO).

We send the service’s e-mails – that is, confirmation of your address, password and security notices, requested PDF reports, monitoring notices, reminders about statements, messages about document orders, invoices as PDF attachments, notices about your plan’s widget views, setup tips and monthly overviews, and our internal notifications about partner enquiries – via Resend, a service of Plus Five Five, Inc., San Francisco, USA. For this, Resend receives the recipient address, subject, content and, where applicable, the attachment of the respective e-mail as well as the delivery data. Open and click tracking are switched off. We send via Resend’s EU region; because Resend is a US company, data may nevertheless be transferred to the USA. The basis is Resend’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, EU standard contractual clauses are agreed in Resend’s data processing agreement (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR and, for security notices, setup tips, monthly overviews and internal notifications, Art. 6(1)(f) GDPR. For deliveries, our own logs contain only the category and type of error, never recipients or content.

After you sign up, we send a few e-mails to your account address to help you get started: a welcome with the next step once your address is confirmed, at most two reminders (about 3 and 10 days after sign-up) as long as no scan has been completed or the widget has not yet been detected on your website, and, while you are on the Free plan, a monthly overview with the latest scan, the open barriers, the scans left and a reference to our plans with automatic monitoring. For this, we use your e-mail address, your first name, your account language and information from your account (websites, scan results, whether the widget was detected, plan). We store which of these e-mails we sent and when with your account, so that none arrives twice. We do not evaluate opens or clicks; delivery is via Resend (see E-mail delivery via Resend).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is that you can set up and use the service you signed up for, and to inform you about our own similar services (direct marketing, Recital 47 GDPR). For the promotional references, we rely on Section 7(3) of the German Act against Unfair Competition (UWG): we only refer to our own similar services, received your address when you signed up and point out your right to object there and in each of these e-mails. You can object at any time without incurring any costs other than the transmission costs at the basic rates: via the unsubscribe link in each of these e-mails (also via your e-mail program’s unsubscribe function), in your account under “Profile & security” or by e-mail to info@accessonaut.com. After that, we will not send you any of these e-mails; security notices, invoices and e-mails you request yourself are not affected. We store your objection with its time so that we can respect it. Accounts created before these e-mails were introduced only receive them if they switch the setting on themselves.

To understand which pages of accessonaut.com and the application are used, we use the open-source software Umami. We run Umami ourselves at analytics.accessonaut.com on our server in the EU (see Hosting). The measurement data stay there; we do not pass them on to anyone, not even to the maker of Umami.

No script is loaded from analytics.accessonaut.com. Instead, our own page reports each page view with a single request. It contains only the website ID, the host name and the page path; we replace project and document IDs in the path with generic labels. We do not send query parameters, URL fragments, referring pages, e-mail addresses or account data. We do not report views of login, administration and checkout pages. In the same way, we additionally report a few steps as an event with a fixed name, for example “website check started”, “sign-up completed”, “e-mail address confirmed”, “website added”, “widget installation detected” or “purchase completed”. An event contains at most short codes such as the selected plan, the sign-in method (password or Google), the range of the check result (for example “70–89”) or an error code, never the checked website, e-mail addresses, IDs or free text. Sign-up and sign-in with Google are reported by our server; it passes on only the browser identifier, not your IP address. As with any request, your browser technically transmits your IP address and browser identifier. From these, Umami derives the browser, operating system, device type and approximate location, and uses a secret value that changes daily to create a hash as a session ID, so that visits can be counted without recognising you; the IP address itself is not stored.

The measurement does not set cookies and does not store anything on your device. If ‘Do Not Track’ or ‘Global Privacy Control’ is switched on in your browser, we do not send any reports. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to understand reach and usage and to improve content and features, with as little data as possible, without profiles and without disclosure to others. Consent is not required for this because we do not store or read anything on your device. We delete the measurement data automatically after 90 days. You can object at any time by e-mail to info@accessonaut.com or block analytics.accessonaut.com with a content blocker.

In the event of technical errors, we transmit selected error events to our self-hosted GlitchTip service at errors.accessonaut.com; there are no other recipients for this. An event contains the error class, sanitised references to the affected location in the program code, the time, a random event ID and details of the software version, runtime and technical operation. Error message texts, visited page addresses, query parameters, account data, IP addresses, headers and request content are not included; we do not record sessions, inputs or performance data. When the connection is established, the service technically receives the IP address; it is not stored in the event. In the browser, ‘Do Not Track’ and ‘Global Privacy Control’ prevent events from being sent. Error events are deleted automatically after 30 days. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in detecting and fixing technical faults.

Accessonaut only sets technically necessary cookies: ‘auth_token’ keeps you logged in after you log in (HttpOnly, at most 7 days, deleted when you log out); a cookie for the Google sign-in process protects it against misuse and is valid for 10 minutes. The free website check stores its access token in the tab’s session storage; your browser deletes it when you close the tab. The automatic security check does not set a cookie; its one-time token is held only in the page’s memory. Widget preview settings and earlier local statement drafts are kept in your browser’s local storage until you delete them yourself or expressly transfer them to your account. We store manual checklists in your project (see Account); a checklist previously stored only in the browser is transferred once to your project the next time you open it and then removed from the browser. The legal basis is § 25(2) no. 2 TDDDG; consent is not required for this, and we do not set any analytics or marketing cookies. For Stripe, see Payment processing; for the widget on customer websites, see Reading-aid widget.

Personal data is received only by the service providers named in this policy, each for the purpose described:

• Contabo GmbH, Munich: hosting in Lauterbourg (France), processor
• Google Cloud EMEA Limited (Ireland): encrypted offsite data backup in Frankfurt am Main, processor
• Resend (Plus Five Five, Inc., USA): e-mail delivery, processor
• Stripe Payments Europe, Limited (Ireland): payment processing, processor and independent controller
• Anthropic Ireland, Limited (Ireland): AI features at your request, processor
• Cloudflare, Inc. (USA): security check for the website check, processor and independent controller
• Google Ireland Limited (Ireland): sign-in with Google, independent controller

With Resend, Stripe, Anthropic, Cloudflare and Google, data may be transferred to the USA; we state the respective basis in the corresponding section. Beyond this, we only disclose personal data where we are legally obliged to do so.

• Account data, projects and reports: until deleted by you or at your request
• Results of the free website check: 24 hours
• Inputs and results of the AI tools: not stored beyond the request; usage counters until the account is deleted
• Contact requests about the check and partner enquiries: 90 days
• Delivery references for PDF reports: up to 90 days
• Uploaded PDF files and reading versions: at most 84 days
• Audience measurement (page views and events): 90 days
• Sign-up source, delivery log of the setup tips and monthly overviews, and your objection to them: until your account is deleted
• Error events: 30 days
• Web server error logs: at most 15 days
• Database backups: 30 days on our server, up to approximately 13 months (encrypted offsite backup)
• Invoices and accounting records: eight years

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, simply contact info@accessonaut.com; no particular form is required. Statutory retention obligations may prevent the immediate erasure of individual billing data.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that we carry out on the basis of our legitimate interests (Art. 6(1)(f) GDPR). This applies in particular to the server logs and abuse limitation, error diagnostics, audience measurement with Umami, the sign-up source, delivery of the widget, security notices, setup tips and monthly overviews by e-mail and data backups. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object at any time and without giving reasons to the use of your data for direct marketing, such as the references to our plans in the monthly overview (Art. 21(2) GDPR), most easily via the unsubscribe link in these e-mails (see Setup tips and monthly overview). You can send your objection to info@accessonaut.com; no particular form is required.

You are not legally obliged to provide us with personal data. For an account, however, we need your name, e-mail address and password or your Google account, and for paid plans also a billing address and a payment method; without them, we cannot create an account or provide a paid plan. The details on invoices are prescribed by tax law. You provide your e-mail address for the free check voluntarily. The data in the server logs arises technically with every request.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not carry out profiling. Only fixed rules such as plan quotas and the rejection of too many requests in a short time are applied automatically. Stripe may automatically decline payments as part of its own fraud prevention; Stripe itself is responsible for this.