Privacy Policy

This policy explains what data Inkluo processes, why, for how long, and what your rights are.

1. Data controller

The data controller is Inkluo, reachable at contact@inkluo.com.

2. Privacy by design: no browsing data collected

The accessibility audit relies on a strictly local architecture and runs entirely in your browser. The content of the pages you audit, your browsing history, your inputs and the data present on the analysed sites are never sent, stored, sold or shared with Inkluo or any third party. No data from your analyses leaves the extension.

3. Data processed, purposes and legal bases

Email address (account)

Account creation and management, sign-in. Legal basis: performance of a contract.

Technical installation identifier

A unique pseudonymised identifier generated at installation, used solely to prevent trial abuse and account sharing. Legal basis: legitimate interest in protecting the business model.

Subscription and payment data

Subscription and billing management. Payment is handled by Stripe; no card details are stored by Inkluo. Your email is shared with Stripe for billing. Legal basis: performance of a contract.

User feedback (bug, suggestion)

When you send feedback, the following is transmitted: your email, your message, and technical information (operating system, browser, extension version, pseudonymised device fingerprint). Purpose: handle your request and improve the product. Legal basis: legitimate interest.

Per-device activity

A per-device activity trace (hashed identifier) helps detect account sharing. Legal basis: legitimate interest.

inkluo.com website traffic

An audience measurement with no cookie and no storage of any kind on your device, and no advertising tracking, operated by Cloudflare Web Analytics, counts page views and visits to the public website. It covers this website only, never the extension nor the pages you audit. Legal basis: legitimate interest in measuring traffic.

4. Retention periods

• Account data: for the lifetime of the account, deleted when it is closed.
• Per-device activity trace: 30 days (automatic purge), and deleted when the account is closed.
• User feedback: kept for 36 months from when the request is handled, then deleted.
• Account-closure log: kept in anonymised form, with no email or identifier allowing re-identification, for statistics.
• Trial anti-fraud traces: kept for 24 months after the trial expires, to prevent circumvention of the trial limits.
• Website audience measurement: Cloudflare keeps traffic data for 30 days. Inkluo only archives aggregated daily totals — page views, visits, most frequent pages and countries — with no data allowing re-identification.

5. Recipients and processors

To provide the service, Inkluo relies on the following processors:

• Supabase — authentication and database.
• Stripe — payment and subscription management.
• Resend — sending transactional emails (sign-in codes, invitations).
• Render — hosting the application server that handles authentication, billing and team management. Servers located in Frankfurt, within the European Union.
• Cloudflare — hosting the public website and measuring its audience.

6. Transfers outside the European Union

Account and authentication data are hosted within the European Union: Supabase in Ireland (eu-west-1) for the database and authentication, Render in Frankfurt for the application server. Transactional emails are sent from Ireland (eu-west-1).

Other data (billing, transactional emails, public website traffic) may be transferred to providers located outside the European Economic Area, in particular to the United States, to providers whose company is established there: Stripe for payment, Cloudflare for the public website and its audience measurement, and Resend for emails. These transfers are governed in accordance with Article 46 GDPR, either through the providers' certification under the Data Privacy Framework or through Standard Contractual Clauses adopted by the European Commission, ensuring a level of protection equivalent to that of the European Union.

7. Your rights

You have the right to access, rectify, erase, port, restrict and object. You can delete your account and data directly from the extension, via the “Delete my account” button in the settings. No decision producing legal effects or similarly significantly affecting you is taken on a solely automated basis. For any request: contact@inkluo.com.

8. Complaints

If you are in France, you may lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes. Otherwise, contact your local data protection authority.

9. Local storage

Inkluo uses the extension's local storage, on your device, to keep your session information and preferences. These items are strictly necessary for the service you request and do not require prior consent (Directive 2002/58/EC, “ePrivacy”). They are removed when the account or the extension is deleted.