Privacy policy

Wexlo is a trade name of Rybier Consulting (sole proprietorship), President Allendelaan 263, 1068 VM Amsterdam, registered with the Dutch Chamber of Commerce (KvK) under number 66637694, VAT NL001677588B25. We are the data controller for the processing described on this page. Contact: [email protected].

• Free scan. You submit a website URL and your email address. We scan the publicly reachable page, store the findings, and email you the results, followed by at most two follow-up emails about the full product. Every email contains an unsubscribe link; one click stops all further emails immediately. Legal basis: your consent.
• Scan results. We store structured findings only: the rule, the WCAG criterion, the severity and a CSS selector. We deliberately store no screenshots and no HTML snippets of scanned pages, so no personal data that may appear on your pages ends up in our database.
• Customer accounts and orders. When you subscribe we store your company name, contact email, VAT number, country and the domains you register, to run your scans and to invoice you. Legal basis: performance of a contract, and legal (tax) obligations for invoices.
• Reports. Your scan reports and PDF files are stored so you can download them from your portal.
• Payments. Payments run through Mollie. We never see or store your full payment details.
• Portal login. We use single-use magic links sent to your email and a functional session cookie. No passwords are stored for customers.
• Abuse prevention. We rate-limit requests by IP address. These technical logs are short-lived and used only to keep the service available. Legal basis: legitimate interest.

Scan findings are summarized into plain-language reports by an AI model from Anthropic (Claude). We send only the structured findings, never your account details. Under our API agreement Anthropic does not use this data to train its models.

Our application runs on EU infrastructure: hosting by Scalingo (Paris, FR), the scanner by Fly.io (Frankfurt region, DE), database by Neon (Frankfurt, DE), report storage on Cloudflare R2 with EU jurisdiction, rate limiting and job queue by Upstash (EU region), email by Mailjet (FR), payments by Mollie (NL), invoicing by Jortt (NL), VAT-number validation by vatverify.dev. One AI provider is US-based (Anthropic); transfers are covered by EU Standard Contractual Clauses.

Invoice and order data: 7 years, as Dutch tax law requires. Free-scan email addresses: until you unsubscribe or ask us to delete them. Scan results and reports: for as long as you have an account, or until you ask us to delete them. Magic links are single-use and expire automatically.

We set one functional session cookie when you log in to the portal. We use no analytics, advertising or tracking cookies, so we do not show a cookie banner.

You can ask us for access to, correction of, deletion of, or a copy of your personal data, and you can object to or restrict processing. Email [email protected] and we respond within 30 days. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

When this policy changes, we update this page and the date at the top. The current version always lives at https://wexlo.eu/privacy.