This page explains what data TOA11Y collects, why we collect it, how long we keep it, and what rights you have over it. It is written in plain language on purpose — a privacy policy nobody can read is not a privacy policy.
TOA11Y is a small web development studio that audits and rebuilds websites for accessibility and performance. The studio is operated by a single engineer and is based in [JURISDICTION]. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, TOA11Y is the data controller for personal data collected through toa11y.com.
If you have any question about this policy or about how we handle your data, you can reach us using the contact details in section 13.
We collect the minimum amount of data needed to answer your request and deliver the services you ask for. Here is exactly what that looks like.
| Where | What we collect | Why |
|---|---|---|
| Audit request form | Name, email address, website URL, request type, optional notes | To reply to your request and scope the work |
| Contact form | Name, email address, message | To reply to your message |
| Newsletter signup | Email address | To send you the weekly teardown, if you asked for it |
| Server logs | IP address, browser user agent, requested URL, timestamp | Security, abuse prevention, and diagnosing errors |
| Cookies | Session cookie and CSRF token | Required for the site's forms to work and to prevent cross-site request forgery |
We do not collect payment card data on this site. We do not use tracking pixels, fingerprinting scripts, or advertising cookies. We do not buy or scrape personal data from third parties. We do not collect any special category data (such as health, racial or ethnic origin, religious beliefs, or political opinions).
We use the data we collect for exactly four purposes:
We do not use your data for advertising, profiling, automated decision-making, or any purpose you did not ask for. We do not sell your data, and we do not share it with anyone except the service providers listed in section 6.
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:
We do not rely on consent for anything other than the newsletter. If you would like more detail about our legitimate-interest assessment, contact us.
We keep the number of third parties to an absolute minimum. The only services that may process your data are:
Each of these providers is bound by a data processing agreement and is only permitted to use your data to provide their service to us. We do not use any advertising networks, retargeting services, social media pixels, or data brokers.
We keep data only for as long as we need it. Specifically:
If you ask us to delete your data, we will do so within 30 days, unless we are legally required to keep it (for example, for tax or accounting purposes).
Depending on where you live, you may have some or all of the following rights over your personal data:
To exercise any of these rights, email us using the details in section 13. We will respond within 30 days. There is no charge. If you are in the EU or UK and are unhappy with our response, you have the right to lodge a complaint with your national data protection authority.
If you are a California resident, you also have the right to know what categories of personal information we have collected, to request deletion, and to opt out of any “sale” of personal information. We do not sell personal information.
We take reasonable technical and organizational measures to protect your data, including:
No website can promise perfect security, and we will not pretend otherwise. If we ever become aware of a data breach that affects you, we will notify you and the relevant authorities within the timeframes required by law.
Our servers are located in [JURISDICTION]. Some of the third-party services listed in section 6 may be located outside your country, including in the United States. When we transfer data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.
This site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
If we change this policy in a way that materially affects you, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email. We will not retroactively change how we handle data we have already collected without your consent.
For any question about this policy, or to exercise any of your rights, contact us:
Email: privacy@toa11y.com
Or use the contact page.
We aim to reply to privacy inquiries within 5 business days.