Privacy policy

This page is the source text. It is also available in Dutch and French.

Wexlo is a trade name of Rybier Consulting, President Allendelaan 263, 1068 VM Amsterdam, registered with the Dutch Chamber of Commerce (KvK) under number 66637694, VAT NL001677588B25. We are the data controller for the processing described on this page. Contact: hello@wexlo.eu.

• We collect the minimum we need to scan websites, deliver reports and invoice you, and deliberately store no screenshots or HTML from scanned pages.
• Our infrastructure runs in the EU. One step in the report pipeline (the AI text generation) currently runs at a US provider; we say so honestly below instead of hiding it.
• No advertising cookies, no cross-site tracking, no cookie banner needed. One functional session cookie when you log in, cookieless analytics.
• You can unsubscribe from every email with one click and request deletion of your data at any time.

• Free scan. You submit a website URL and your email address. We scan the publicly reachable page, store the findings, and email you the results, followed by at most two follow-up emails about the full product. Every email contains an unsubscribe link; one click stops all further emails immediately. Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.
• Scan results. We store structured findings only: the rule, the WCAG criterion, the severity and a CSS selector. We deliberately store no screenshots and no HTML snippets of scanned pages, so personal data that may appear on those pages does not end up in our database.
• Customer accounts and orders. When you subscribe we store your company name, contact email, VAT number, country and the domains you register, to run your scans and to invoice you. Legal basis: performance of a contract (art. 6(1)(b)), and legal (tax) obligations for invoices (art. 6(1)(c)).
• Reports. Your scan reports and PDF files are stored so you can download them from your portal. Legal basis: performance of a contract.
• Payments and invoicing. Payments run through Mollie; we never see or store your full payment details. Invoices are created in our bookkeeping system (Jortt) with your company name, address and VAT number, as tax law requires.
• Order and consent records. At checkout we record which version of our terms you accepted, when, and the IP address and browser identifier (user agent) of the request. We use this only to prevent fraud and to substantiate or defend payment disputes (chargebacks). Legal basis: legitimate interest (art. 6(1)(f): fraud prevention and legal claims).
• How you found us. If you arrive through a campaign link, we record the campaign parameters (UTM tags) and the referring page together with your lead or order. This is read from the address of the page; no cookies and no cross-site tracking are involved. Legal basis: legitimate interest (measuring which channels work).
• Portal login.We use single-use magic links sent to your email and a functional session cookie. No passwords are stored for customers: password sign-in is not offered at all. Optionally you can sign in with your Google account. Google’s consent screen shows what it hands over: your name, your profile picture and your email address. We store only the name and the email address; the picture is discarded on arrival and never written to our database. We ask for nothing beyond those three: no contacts, no calendar, no files, no other access to your Google account. The sign-in is linked to the account that already belongs to that email address. Google itself processes the sign-in as an independent controller under its own privacy policy, and therefore knows that you are signing in with us at that moment. If you would rather it did not, use the magic link; that route always stays available. Legal basis: performance of a contract.
• Abuse prevention. We rate-limit requests by IP address. These technical counters expire automatically and are used only to keep the service available. Legal basis: legitimate interest.
• Support correspondence. When you email us or ask a question through the portal, we keep that conversation: your email address, the messages themselves, and when they were sent. We use it only to answer you and to look up what was said if you come back to the same question. Support conversations are kept for up to 24 months after the last message, and then deleted. Legal basis: our legitimate interest in answering the people who contact us, and performance of the contract where you are a customer.
• Business contacts. If we approach your organization about Wexlo (business-to-business prospecting), we process business contact details obtained from public sources such as your company website, and findings from a scan of your public web pages. Legal basis: legitimate interest (direct marketing to businesses, within the channel rules of each country). You can object at any time via hello@wexlo.eu and we stop immediately.

Scanning a page necessarily means our scanner briefly loads it, including anything visible on it. By design we keep almost none of that content: no screenshots, no HTML, no running page text, only the structured findings listed above, which may contain a short quote of the element in question. Storing is not the same as sending: the AI judgment step does transmit bounded page fragments while it runs, which the transfers section below sets out. This is our main safeguard against collecting personal data of people who appear on scanned websites.

For your account, orders, invoices and this website we are the data controller. When we scan websites you designate under a paid plan, we act as your processor for any personal data that appears on those pages: you decide what we scan, we process it only to produce your reports. That processing is governed by our data processing agreement (DPA), which is part of our terms: no separate signature needed.

Scan findings are summarized into plain-language reports by an AI model from Anthropic (Claude), and on paid scans the same model judges five text-based WCAG criteria. For the report text we send only the structured findings. For the judgment step we also send bounded fragments of the scanned page: its title, headings, image alt texts, link texts, a short surrounding snippet per element, and sentences that hint at a sensory instruction. No account details are sent with these AI calls. The transmitted fragments are not stored; we do keep the structured findings that result, which may contain a short quote of the judged element. Under our API agreement Anthropic does not use this data to train its models. Anthropic is a US provider; see the transfers section below. We do not use AI to make automated decisions about you that have legal or similarly significant effects (art. 22 GDPR): the scan analyzes websites, not people.

If the account owner has enabled image analysis (an optional feature, off by default), paid scans also send the meaningful images from your scanned pages, their alt text and a short snippet of surrounding page text to Anthropic, solely to review those images for accessibility. The images are used solely to run the analysis and are deleted by Anthropic within 30 days as a rule (kept longer only where needed for abuse prevention or legal obligations); they are never used to train AI models. The transfer to the United States takes place under the European Commission’s Standard Contractual Clauses (see the transfers section below), and Wexlo itself keeps no copies of the images. Without this explicit opt-in, no images are sent, and the owner can withdraw the consent at any time in the portal settings. Legal basis: consent.

• Scalingo: application hosting (EU)
• Fly.io: scan worker, CRM and analytics hosting (lead and customer contact records; visitor statistics) (EU region; US company)
• Neon: database (EU region; US company)
• Cloudflare: report storage (R2, EU jurisdiction), DNS and firewall (US company)
• Upstash: rate limiting and job queue (EU region; US company)
• Mailjet: email delivery (EU; Sinch group)
• Google (Workspace): hosting of our support mailbox, so any email you send us passes through and is stored there (EU region; US company)
• Mollie: payment processing (EU)
• Jortt: invoicing and bookkeeping (EU)
• vatverify.dev: VAT number validation (receives only the VAT number you enter)
• Anthropic: AI report text, AI judgment of page text and, only with the owner’s image-analysis opt-in, page images (United States; our API agreement stipulates no training on this data)
• Sentry: error monitoring (EU data residency region)

Plausible is not in this list because nothing reaches it. Plausible is open-source software that we install and run on our own servers in the EU; the company behind it receives no data about your visit at all. The provider of those servers (Fly.io) is listed above.

We also measure which pages are visited inside your signed-in environment. This happens in the same cookieless way, with one extra safeguard the public site does not need. Addresses in the portal can contain an identifier, for example of a domain, a support request or an invitation. We strip that identifier before anything is recorded: our statistics show only that a settings page was visited, never which domain or which request it concerned. We measure that a page was visited, not who was there.

We share personal data with these parties only for the purposes above, under the agreements the law requires for each of them: a data processing agreement where the party acts as our processor. We never sell personal data. If you choose to sign in with Google, you authenticate with Google itself and Google is responsible for its own processing as an independent controller, not as our processor. All we keep from that sign-in is your name and email address. The same list, with the processor roles spelled out, is part of our DPA.

Our infrastructure is EU-hosted: application, scanner, database, storage, queue, email, payments and invoicing all run in EU regions. Two honest caveats. First, the AI text in our reports is currently generated through Anthropic’s API in the United States; that transfer is covered by the EU Standard Contractual Clauses, and we minimize it: the report step sends structured findings only, and the judgment step sends bounded fragments of the scanned page rather than the page itself. Your account data is never part of either. Second, some of our EU-region providers (Neon, Fly.io, Cloudflare, Upstash, Google) are US-owned companies; your data stays in their EU regions, but as US companies they can be subject to US law. Where a transfer to the US does occur, it relies on the EU–US Data Privacy Framework for entities certified under it, and otherwise on the EU Standard Contractual Clauses. You can request a copy of the Standard Contractual Clauses we rely on via hello@wexlo.eu; the model clauses themselves are published on the European Commission’s website. If you want the fully precise picture, the sub-processor list above names every party and location.

• Orders, invoices and checkout consent records: 7 years, the Dutch statutory retention period for administration.
• Customer account data: for as long as your account exists. On a deletion request we erase or anonymize everything except what tax law requires us to keep.
• Paid scan results and reports: for as long as your account exists, or until you ask us to delete them.
• Free-scan data (email address and results): until you unsubscribe or ask us to delete them, and no longer than 12 months after your last scan. After you unsubscribe we keep only what is needed to honor the opt-out.
• Support conversations: up to 24 months after the last message. Conversations that are still open are not deleted on age alone.
• Security and audit logs: up to 24 months, unless an ongoing security incident or dispute requires longer.
• Rate-limit counters: expire automatically within hours.
• Magic links: single use, valid for 15 minutes, purged automatically.

We set exactly one cookie: a functional session cookie in the customer portal, when you sign in, which is what keeps you signed in. Nothing else on this site sets a cookie. Our analytics stores nothing on your device at all, no cookies and no local storage (see Analytics below), and we use no advertising or tracking cookies. On that basis we do not show a cookie consent banner.

We use Plausible Analytics to see how our marketing pages are used. We run it ourselves: it is open-source software installed on our own servers in the EU, served from analytics.wexlo.eu, so your visit is never handed to the company behind Plausible.

Alongside page views we record a small number of anonymous interaction events (that a scan was started, that a checkout was completed, that a contact form was sent) so we can see where visitors get stuck. These events carry no personal data: no email address, no scanned website, no order details.

Our analytics stores nothing on your device: no cookies, no local storage. The only cookie we ever set anywhere is one functional session cookie in the customer portal, and only when you sign in (see Cookies above). To tell repeat visits apart within a single day, the software derives a hash from your IP address, your browser and the date, using a key that is destroyed and replaced every 24 hours. Your IP address itself is never stored, and once that key is gone the hash cannot be linked back to you or to the next day.

Because our analytics neither stores nor reads anything on your device (art. 5(3) ePrivacy Directive, art. 11.7a Dutch Telecommunications Act), we do not ask for consent for it. Legal basis for the analysis itself: legitimate interest (art. 6(1)(f) GDPR) in understanding how our own site performs.

All traffic is encrypted in transit (TLS, enforced with HSTS) and data is encrypted at rest at our database and storage providers. We minimize what we collect by design, use single-use login links instead of passwords, restrict internal access on a least-privilege basis, and log security-relevant events. No system is perfectly secure; if a breach ever affects your rights, we will notify you and the supervisory authority as the GDPR requires.

You have the right to access, rectify, erase and receive a copy (portability) of your personal data, to restrict or object to processing, and to withdraw consent at any time without affecting past processing. Customers can request deletion directly from the portal; anyone can email hello@wexlo.eu. We respond within one month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.

When this policy changes, we update this page and the date at the top; for material changes we notify customers by email. The current version always lives at https://wexlo.eu/privacy.