What we touch, and what we don't.

User-agent

AccessibleOrNotBot/1.0

Rate

No more than 1 request per second

robots.txt

Follows its rules

To block our crawler, add these lines to your robots.txt file:

User-agent: AccessibleOrNotBot
Disallow: /

Data controller

The operator of AccessibleOrNot [company name, address and registration details to be added before launch]. Contact: kvkk@accessibleornot.com

Free scan requests

Your email address, the address of the site to scan, the time of the request, browser information (user-agent) and a one-way hash of your IP address (keyed SHA-256). We don't store your raw IP address.

Purpose and legal basis

To receive your request, scan your site and deliver the report: performance of a contract or steps before entering into one (GDPR Art. 6(1)(b); KVKK Art. 5/2-c). IP hash and browser information: to prevent abuse and excessive requests, our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).

Report link

The report only opens with the secret link we give you. Anyone you share the link with can see the report. Your email address does not appear in the report.

When you write to us

Your name, email address and message are processed so we can reply (legitimate interest, GDPR Art. 6(1)(f); or contract, Art. 6(1)(b), if you are asking about a service). Incoming emails are forwarded by Cloudflare Email Routing to our Google (Gmail) mailbox.

Measurement

Cloudflare Web Analytics: cookieless, aggregate page statistics; legitimate interest (GDPR Art. 6(1)(f)). Google Analytics 4: only with your consent (GDPR Art. 6(1)(a); KVKK Art. 5/1). Details: see Cookies.

Recipients

The providers we use to run the service: Cloudflare (hosting, security, email routing, cookieless analytics), Neon (database, EU/Frankfurt region), Google (Google Analytics if you consent; our inbox for incoming email). Public authorities where the law requires it. We don't sell your data or share it for advertising.

International transfers

Some of these providers are based in, or owned by companies in, the US. Our database is in the EU (Frankfurt), but data may still be transferred outside the EEA and Türkiye. We are completing the required safeguards with each provider (for the GDPR, Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider is certified; for KVKK, Art. 9 standard contracts and notification to the Authority). The current status is in our sub-processor list.

Retention

Scan requests and reports: up to 12 months, then deleted. Abuse prevention (rate limit) records: short term. Email correspondence: 12 months after the conversation ends. Google Analytics user- and event-level data: 2 months (aggregate reports may stay with Google for longer).

How we collect data

From you, through forms and email; and automatically while you use the site.

• Hosting region: to be confirmed before launchTo be confirmed before launch
• Sub-processor listTo be confirmed before launch
• TLS in transitTo be confirmed before launch
• AES-256 at restTo be confirmed before launch

Our technical team is verifying these lines. Treat them as unconfirmed until then.

Under GDPR Articles 15–22, you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. If you are in Türkiye, you also have the rights in KVKK Article 11, including the right to know which recipients your data was transferred to and to claim compensation for unlawful processing. Send your requests to kvkk@accessibleornot.com. We reply free of charge within 30 days. If you are not satisfied with our reply, you can complain to your data protection supervisory authority (in the EU or UK) or, in Türkiye, to the Personal Data Protection Board (KVKK Art. 14).

Strictly necessary

Our site sets no cookies. Your theme preference and your cookie choice (with the time you made it) are kept only in your browser (localStorage) and are not sent to us.

Cookieless analytics

Cloudflare Web Analytics. Cloudflare states that it does not use cookies, local storage or browser fingerprinting for this measurement. It collects aggregate data such as page views and load times; we don't build a profile that identifies you.

Google Analytics 4

Only with your consent. If you don't click "Accept", Google Analytics doesn't load and no _ga cookie is set. If you accept, Google Analytics cookies (_ga, _ga_*; up to 2 years by Google's default) are stored on your device; the pages you visit, the referring site, device and browser information and your approximate location are sent to Google and processed outside the EEA and Türkiye. Google states that GA4 does not log or store IP addresses; the IP address is used to derive approximate location. Advertising, ad personalisation and Google signals are off.

Advertising cookies

None.

Changing your choice

At any time, with the button below. When you withdraw consent, Google Analytics stops and the _ga cookies are deleted. Withdrawing consent doesn't affect the lawfulness of processing before it.

If you have found a security vulnerability, write to security@accessibleornot.com. Disclosure rules: /.well-known/security.txt