Legal
Privacy policy
Last updated . Short, because we collect little.
Who we are
Certistate is an automated web accessibility compliance engine. Questions about this policy, or about data we hold on you, go to contact@simucorps.org.
What we collect, and why
| What | Why | How long |
|---|---|---|
| The URL you submit | To run the Assessment and to show you the Statement afterwards. | Until you ask us to delete the Assessment. |
| Assessment results and screenshots | They are the Statement. Screenshots are of pages already public on the web. | Until you ask us to delete the Assessment. |
| Your IP address | To enforce the rate limit and to stop abuse. It is not used to build a profile of you. | 90 days. |
| Your email address, if you give us one | To send you a sign-in link and the Statements you asked for. Nothing else. | Until you delete your account. |
| A session cookie, if you sign in | To keep you signed in. It holds a random token and nothing about you. | 30 days, or until you sign out. |
Cookies
One cookie, set only when you sign in, holding a random session token. It is strictly necessary to keep you signed in, so there is no consent banner: there is nothing optional to consent to.
We set no advertising cookies, no tracking cookies, and no third-party cookies.
Analytics
Analytics is not enabled on this deployment. When it is, we use Plausible Analytics, which is cookie-free, stores no personal data, and produces only aggregate counts.
Fonts and third-party requests
The typeface is served from our own domain, not from a font CDN, so loading a page sends no request to a third party.
Who else sees your data
- Our hosting providers, who run the servers and the database.
- Resend, which delivers our email. They see the address we send to and the message. An address you give us is also stored in our mailing list at Resend, so that unsubscribing works from any message. Unsubscribing marks it unsubscribed there as well as here.
- Sentry, which receives error reports when something breaks. These can contain a URL and an Assessment identifier.
- Cloudflare Turnstile, if a captcha is shown, which sees your IP address to decide whether you are a bot.
We do not sell data, and we do not share it for advertising.
Assessing somebody else’s site
An Assessment reads pages that are already publicly available, in the same way a search engine crawler does. We honour robots.txt. We do not sign in to anything, and we do not submit forms.
A Statement is public to anyone with its link, because the link is meant to be shared. If a Statement about your site should not be public, tell us and we will remove it.
Your rights
You can ask us for a copy of what we hold on you, ask for it to be corrected, or ask for it to be deleted. Email contact@simucorps.org and we will act within 30 days. Deleting your account deletes your address, your sessions, and your monitoring settings.
Every email we send other than a sign-in link carries a link that stops all further email. Sign-in links have no such link because switching them off would lock you out of your own account.
Changes
If this policy changes in a way that matters, we will change the date at the top and note it in the changelog.