Privacy Policy

1. Who we are

VexNexa is an accessibility-scanning service developed in the Netherlands. We help website owners make their sites more accessible by testing WCAG compliance.

2. What data we collect

Scan data

• URL of the scanned page
• Technical metadata about accessibility issues
• Scan timestamps
• IP address for rate-limiting and abuse prevention

Important: we do not store personal data from page content (such as names, emails, phone numbers); we only analyze HTML structure and accessibility.

Account data (optional)

• Email address
• Name (if provided)
• Hashed password
• Account preferences

Contact

• Name and email address
• Message content
• Submission timestamp

3. Legal basis (Art. 6 GDPR)

• Performance of contract – scans, results, account management.
• Legitimate interest – security (rate-limiting, abuse detection), basic improvements.
• Consent – analytics/marketing cookies and any opt-in communication.
• Legal obligation – retention requirements and requests from authorities.

4. Cookies and tracking

Functional cookies (necessary)

• Session for logged-in users
• Preferences (language, theme)
• Cookie consent status

Analytics cookies (optional)

With consent, we may use privacy-friendly analytics (e.g., Vercel Analytics or alternative). We measure aggregated statistics, not individual profiles.

• Visitor statistics (aggregated/anonymous)
• Popular pages and features
• Technical performance

You can manage consent through the cookie settings.

UTM parameters

We may temporarily store UTM parameters to understand origin. These contain no personal data.

5. How and why we use data

• Performing scans and displaying results
• Account management and login
• Customer service and support
• Service improvement (with consent for analytics)
• Compliance with laws and regulations

We do not sell or rent your data to third parties for marketing purposes.

6. Recipients and processors

We only share data with service providers who process on our behalf under a data processing agreement.

• Hosting & edge:
• Database & opslag:
• Betalingen:
• E-mail/transactioneel:
• Monitoring/logging:

7. Transfers outside EU/EEA

If transfers outside the EU take place (e.g., edge-routing or support logs), we use appropriate safeguards such as EU Standard Contractual Clauses and additional measures.

8. Data storage, security & retention

Storage locations

• Database/compute in EU data centers
• Backups within Europe

Security measures

• TLS/HTTPS end-to-end
• Hashed passwords
• Least-privilege access control & monitoring
• Regular patches/updates
• Data minimization

Retention periods

• Scan data: 1 year (Free); longer for paid accounts (configurable in your account)
• Account data: until account deletion or as long as legally required
• Contact messages: up to 2 years
• Analytics: up to 24 months (aggregated/anonymized where possible)

We delete or anonymize earlier when data is no longer needed, unless retention is legally required.

9. Your rights (GDPR/AVG)

Je rechten uitoefenen? Mail info@vexnexa.com. We respond within 30 days.

10. Children

Not directed at children under 16 years. Contact us if data has been collected; we will delete it.

11. Data breaches

We immediately investigate the impact, limit risks and report if required to the Dutch Data Protection Authority and affected parties.

12. Automated decision-making

We do not make decisions based solely on automated processing with legal effects for you.

13. Changes to this policy

We communicate significant changes via email (if applicable), a notification on the site and update of the date.

14. Contact & complaints

Not satisfied? File a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.