Privacy policy

Last updated : 20 September 2026

Data controller

The controller responsible for processing personal data collected through the Inclusa service is the publisher identified in our legal notice. Any question relating to the processing of your data may be sent through our contact form. (our contact form).

Applicable legal framework

This processing is governed primarily by the Swiss Federal Act on Data Protection (revised FADP, in force since 1 September 2023), and, for data subjects residing in the European Union, by the General Data Protection Regulation (GDPR).

Data collected

• Account data: email address (encrypted at rest), password (hashed, never stored in plain text), preferred language, role within the account;
• Site data: name and URL of the site(s) submitted for analysis, audit configuration (encrypted at rest);
• Scan results: technical excerpts from the audited public pages (page URL, CSS selectors, short source-code snippets) needed to build the report, encrypted at rest;
• Billing data: managed directly by our payment provider, Stripe; Inclusa only keeps an external subscription reference, never any bank details;
• Minimal technical logs required for the security and proper operation of the service (timestamps, operation status).

Purposes of processing

• providing the accessibility audit service and generating the corresponding reports;
• managing the user account, authentication and subscription billing;
• responding to requests submitted through our contact form;
• ensuring the security of the service (two-factor authentication, rate limiting, abuse detection);
• improving the service based on aggregated internal metrics.

Legal basis

Processing is based on the performance of the contract between you and Inclusa (provision of the subscribed service), on our legitimate interest in ensuring the security and proper operation of the service, and, for the language preference, on your explicit choice.

Sub-processors and recipients

• Infomaniak SA (Switzerland): hosting of the infrastructure and data, as well as the technical delivery of the service's transactional emails;
• Stripe: payment processing. As this company is established outside Switzerland, the transfers of billing data required for this purpose are governed by the standard contractual clauses and compliance commitments offered by Stripe.

Data location

Personal data is hosted and stored at rest in Switzerland.

Retention period

Account data is retained for as long as the account remains active. Upon deletion, the account is immediately soft-deleted, followed by a permanent purge of the data according to our internal procedures.

Data relating to a site (configuration, scan history) is retained for as long as the site has not been deleted by its owner; its deletion follows the same soft-deletion-then-permanent-purge logic.

Scan history is automatically retained for 90 days on the Free plan, 180 days on the Starter plan, and 365 days on the Pro and Agency plans, counted from each scan; a site's most recent completed scan always remains accessible beyond that period. If a site is deleted, its entire scan history is permanently purged 90 days after deletion, without exception.

Data security

• encryption at rest (AES-256-GCM) of fields containing personal or sensitive data;
• passwords hashed with a resistant key-derivation algorithm (Argon2id), never stored in plain text;
• two-factor authentication available for all accounts, mandatory for owner and administrator roles;
• systematic encryption of communications (HTTPS) and strict isolation of data between the different customer accounts.

Your rights

Subject to the conditions set out by applicable law, you have a right of access, rectification, erasure, portability and objection with respect to your personal data.

The rights of access, rectification and deletion of your account can be exercised directly and immediately from your personal area. Any other request may be sent through our contact form; we endeavour to respond within 30 days. (our contact form).

Complaint to a supervisory authority

You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, if you reside in the European Union, with the data protection authority competent in your country of residence.

Changes to this policy

This privacy policy may be updated to reflect changes to the service or to applicable regulations. The date of the last update appears at the top of this page.