Privacy policy

Who is responsible

The controller for the processing described here is the operator named in the imprint. Write to hello@passa11y.com for anything on this page — questions, corrections, or a request to delete your data.

What we collect, and why

The waitlist

One field: your email address. We use it to send you a confirmation link, and then a single message when Passa11y ships. Nothing else — no sequence, no newsletter, no partner mail. The legal basis is your consent, given when you submit the form (Art. 6(1)(a) GDPR).

The waitlist is double opt-in: an address that is never confirmed is not on the list and is removed by our email provider as an unconfirmed record.

The beta invite form

The invite form asks five questions about your setup — what your design system is built with, roughly how many components it has, whether anyone has already asked you for a conformance statement, who decides, and whether there is budget — plus the address you want the answer at. There is one hidden field that only automated submissions fill in; if it arrives filled, the submission is rejected and nothing is sent.

The answers go to one inbox as a plain-text email so that a human can read and reply to them. The legal basis is your consent, given when you submit the form (Art. 6(1)(a) GDPR).

Analytics

We count page views and a handful of named events — which call to action was clicked, which form was submitted. The counter is Umami, a cookieless analytics tool running on our own instance rather than as a third-party service. It sets no cookies, stores no identifier in your browser, and does not build a profile across sites. That is also why this site has no cookie banner: there is nothing to ask you about.

The legal basis is our legitimate interest in knowing whether the page works (Art. 6(1)(f) GDPR). If you would rather not be counted, any tracker blocker or the browser’s do-not-track setting is enough — the script is a single external file and blocking it breaks nothing on the page.

Server logs

Our hosting provider records the technical data every web server records: IP address, timestamp, requested address, user agent. These logs exist to keep the site running and to deal with abuse, are kept by the provider for a short period, and are not combined with anything else we hold. The legal basis is our legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR).

Your theme preference

If you switch between the light and dark theme, that choice is saved in your browser’s local storage under the key passa11y-theme. It never leaves your device, is not sent to us, and is not a cookie. Clearing your browser storage removes it.

How long we keep it

We run no database. Form submissions are held in memory only for as long as the request takes and are never written to disk or to a log on our side. After that:

• Waitlist addresses stay with our email provider until you unsubscribe or ask us to delete them, and are deleted once the launch announcement has gone out and the list has served its purpose.
• Invite form answers exist as an email in one inbox. They are deleted once the conversation they started is over, and at the latest twelve months after they arrive.
• Analytics are aggregate counts with no personal data attached, so there is nothing in them to delete on request.
• Server logs are kept and rotated by the hosting provider under its own retention schedule.

Who processes data for us

Three providers, each doing one thing. Each acts as a processor under a data processing agreement.

• MailerLite (established in Lithuania, EU) — the waitlist: storing confirmed addresses and sending the confirmation and launch emails.
• MailerSend (established in Lithuania, EU) — delivery of the single notification email carrying your invite form answers.
• Vercel (established in the United States) — hosting and delivery of this site, of the one function that handles the two forms, and of our analytics instance.

Umami is not a fourth name on that list because it is not a third-party analytics service: the instance is ours, it runs on the hosting already named above, and the counts never leave it.

Transfers outside the EEA

The email providers are established in the European Union. Hosting is provided by a company established in the United States, so some processing — in practice, the technical logs described above — may take place outside the European Economic Area. Those transfers are covered by the European Commission’s standard contractual clauses under the provider’s data processing agreement.

Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you, and give you a copy of it;
• correct anything that is wrong;
• delete it;
• restrict what we do with it, or object to processing based on legitimate interest;
• hand it over in a portable format, or send it to someone else.

Where processing rests on your consent, you can withdraw that consent at any time. It does not undo what happened before you withdrew it. Every waitlist email carries an unsubscribe link, and one line to hello@passa11y.com is enough for any of the above.

You also have the right to complain to a data protection supervisory authority — in the EU member state where you live, where you work, or where you think something went wrong.

What we do not do

• We do not sell or rent your data, and we do not share it for anyone’s marketing.
• We set no cookies and run no advertising or social media trackers.
• We do not profile you, and no decision about you is made automatically.
• We do not ask for data we have no use for — that is why the waitlist is one field and the invite form is six.

Changes to this policy

When what we do changes, this page changes with it and the review date at the top moves. Anything that materially affects data you have already given us is announced by email to the address you gave, not just posted here.

Contact

hello@passa11y.com. A person reads it.