Privacy Policy
Last updated and effective: 28 October 2026
Who we are (controller): Glimscope ("we") is operated from Western Australia, Australia, and is responsible, as controller, for the personal information described in this policy. Contact: support@glimscope.com (support), legal@glimscope.com (legal and privacy), abuse@glimscope.com (abuse). Contact for all privacy matters: legal@glimscope.com. We reply within 5 business days. If you ask, we will tell you the name of the person or entity legally responsible for processing your personal information (and their contact details), so you can exercise your rights or complain. We provide Glimscope (https://glimscope.com), an automated website accessibility testing and monitoring service (the "Service").
Privacy contact: legal@glimscope.com
EU and UK representatives (GDPR / UK GDPR Art. 27): we have not appointed one. Contact us directly at legal@glimscope.com.
1. Summary
- We collect the minimum personal information needed to run accounts, billing, support and the scans you ask for.
- We do not sell personal information and do not use it for targeted advertising. We do not use advertising cookies. We use Google Analytics 4 (Google LLC) for website analytics: page views and conversion events such as sign-up, logging in, a free scan, starting checkout and a completed subscription. Where the law requires consent for analytics cookies, we ask first, and we do not load Google Analytics until you accept.
- We sell paid plans directly. Card payments are processed by Stripe, our payment processor. Stripe receives your card details directly; we never see or store your full card number.
- Scans look at public web pages you tell us to scan. Those pages can contain personal information (for example, staff names on a "Team" page). We keep only short snippets of the page elements that failed a check.
- Whatever privacy law applies to us, we aim to follow the Australian Privacy Principles (APPs) and GDPR-level standards.
2. Information we collect
| Category | What exactly | Source | Purpose | GDPR legal basis |
|---|---|---|---|---|
| Account | Email address, password (stored only as a one-way hash), plan, email-verification status, account creation date | You | Create and secure your account | Contract (Art. 6(1)(b)) |
| Address from your sign-up link | If you sign up using a link that contains a page address (for example, from a free scan report), that address, without any query string or #fragment | You, through the link you used | To fill in the "Add a site" form on your dashboard, so you don't have to type it again. We don't scan it, email it or add it as a site unless you choose Add site | Steps you ask us to take (Art. 6(1)(b)) |
| How you found us | When you sign up: the campaign tags in the link you arrived by (utm_source, utm_medium, utm_campaign, utm_term, utm_content), if any, and the name of the website that referred you (the domain only, not the full address). No cookies or tracking across sites are used to collect this | Automatically, from the link and your browser at sign-up | Understand which channels bring us new customers, counted in aggregate | Legitimate interests (GDPR 6(1)(f)) |
| Login and security | Session tokens (stored hashed), password-reset and verification tokens (hashed, expiring), failed-login counters keyed to your email and IP address, rate-limit records keyed to IP address | You / automatically | Keep accounts secure, prevent abuse | Legitimate interests (6(1)(f)) |
| Terms and authorisation records | For signup and for each site or free scan: the date and time, the version of the Terms or Acceptable Use Policy you accepted, and your IP address | You | Evidence that you accepted our terms and confirmed authority to scan | Legitimate interests; legal claims |
| Billing and tax | Name, email, billing address and country, business tax ID (if given), plan, subscription status, invoices and refunds. The card is entered into Stripe's form; we receive only its brand, last 4 digits, expiry and issuing country. Location evidence for tax (billing country, card country, IP-derived country) | You, Stripe | Billing, refunds, tax records (including VAT-number checks for EU/UK business customers), fraud prevention | Contract (6(1)(b)); legal obligation (6(1)(c)) for tax records and location evidence; legitimate interests (6(1)(f)) in fraud prevention |
| Scan configuration | Page URLs, platform (CMS) choice, schedule, domain-verification records | You | Run the scans you request | Contract |
| Scan results | Accessibility issues found, up to 3 example HTML snippets per issue (each cut to 200 characters), CSS selectors, page title, final URL, timestamps. No screenshots or full-page copies are stored | Automated scan of the pages you specify and, where your plan includes crawling, same-site pages linked from them (robots.txt is respected) | Show issues, fix guidance, evidence log, alerts | Contract; legitimate interests where the data belongs to third parties appearing on scanned pages |
| Emails we send | A copy of each email we send (verification, password reset, regression alerts, account notices, and free-scan confirmation and report emails): recipient address, subject, body and send time | Automatically | Delivery audit trail and troubleshooting | Legitimate interests |
| Support | Emails and attachments you send us | You | Answer questions, improve the Service | Contract; legitimate interests |
| Website visit log | When you visit our website, our web server (Caddy) records a shortened version of your IP address (the last part is removed: the last 8 bits for IPv4, and everything after the first 48 bits for IPv6), the page address requested without any query string, your browser's user-agent, the response status and the time. It records no cookies, no referrer and no full IP address, and it does not log pages with private links (for example email verification, password reset, report and scan-confirmation pages). Our hosting provider and server also keep ordinary system and error logs | Automatically | Security, fixing problems and counting visits in aggregate. We do not use it to track you across sites or build profiles | Legitimate interests (GDPR 6(1)(f)) in keeping the service secure and understanding how it is used |
| Cookies | One essential session cookie (sid) | Automatically | Keep you logged in | Strictly necessary (no consent needed under ePrivacy/PECR) |
| Analytics choice | A first-party cookie (gs_analytics) recording whether you accepted or refused Google Analytics, if analytics is switched on | You | Remember your choice so we do not load Google Analytics if you refused, and so we do not ask on every page | Strictly necessary to honour that choice |
| Website analytics | Pages you view on our website, and conversion events (sign-up, logging in, a free scan, checkout started, subscription purchase). We do not send your name, email address or password. Query strings and tokenised paths (such as email verification, password reset and report links) are removed before a page address is sent. Google receives technical data from your browser, including an IP address, and uses it as described in its own policy | Your browser, via Google Analytics 4, only after you accept | Measure how the website is used, in aggregate | Consent where the law requires it for analytics cookies (GDPR Art. 6(1)(a) and PECR). Where consent is not required, legitimate interests (Art. 6(1)(f)) in understanding use of the site. In both cases we do not load Google Analytics until you accept |
| Free instant scan (on our website, no account, no email) | The page URL you enter, the scan report, the time, a keyed hash of your IP address and your confirmation that you are authorised to scan the site | You | Run the one-off scan you ask for; evidence of your authorisation; prevent abuse | Legitimate interests (6(1)(f)) |
| Free scan by email (no account) | Your email address, the page URL, the scan report, the time and your authorisation confirmation; a one-way hash of your address for the per-address daily limit; a keyed hash of your IP address (see section 3A) | You | Send the confirmation email and the one report you ask for; prevent abuse | Steps you ask us to take (6(1)(b)); legitimate interests in preventing abuse (6(1)(f)) |
| Free-scan suppression list | A one-way hash of your email address, if you use the "stop emails" link or unsubscribe from marketing | You | Make sure our free scanner never emails that address again | Legitimate interests (6(1)(f)) in honouring your objection, and our legal obligations to respect opt-outs where they apply (6(1)(c)) |
| Marketing emails (optional) | Your email address, the date and time you opted in, and the version of the opt-in wording you agreed to. Collected only if you tick the separate, unticked box on the free-scan form | You | Occasional emails about accessibility tips and product updates. We currently send no marketing email | Your consent (GDPR Art. 6(1)(a)), which is also your express consent under Australia's Spam Act 2003. You can withdraw it at any time |
We do not knowingly collect sensitive information (e.g. health information) except where it incidentally appears in a snippet of a public page you ask us to scan. We do not intentionally extract it.
3. How scan data is handled
3.1 Your role and ours. For scan results about websites you control, you decide what is scanned. To the extent scan data contains personal information about third parties, we process it on your behalf as your processor (GDPR) / service provider, under our Data Processing Addendum, available on request from legal@glimscope.com. For account, billing, security, support and marketing data, we act as controller.
3.2 Minimisation. We store short snippets of failing elements only, never full page copies or screenshots.
3.3 No logins. We do not scan password-protected pages and never ask for or store website passwords.
3A. Free scan by email
- Double opt-in, transactional only. We email you a link to confirm the scan. Nothing is scanned or sent until you confirm, and an unconfirmed request expires after 24 hours. After you confirm, we send one report email. We don't add you to any mailing list and we send no marketing.
- Your email address is removed from the scan request as soon as the report has been sent (or when the request fails or expires). A one-way hash of the address, used only for the per-address daily limit, stays with the request until it is deleted after 30 days. We keep a copy of the confirmation and report emails in our sending log for 90 days, as we do for all emails, but your address is removed from those copies once they are sent. Our email provider, Resend, also keeps delivery logs under its own policy.
- The page URL and the report are deleted 30 days after your request.
- For the free scan, your IP address is not stored in readable form. For rate limiting, we keep only a keyed hash of it. The key is held in memory, changes every day and is never stored, so the hash cannot be reversed or linked across days. The hash is deleted with the request after 30 days.
- "Stop emails" link: if you use it, we cancel any pending request and add a one-way hash of your address to a suppression list, so our free scanner will not email that address again. We keep that hash for as long as we need it to honour your request; deleting it would mean we could email you again. Legal basis: our legitimate interests in respecting your objection, and our legal obligations to honour opt-outs where they apply (GDPR Art. 6(1)(f) and 6(1)(c)).
- Free instant scan on our website (no email): the page URL, the report and your authorisation confirmation are deleted after 30 days. Your IP address is stored only as the same daily-keyed hash, and is deleted with them.
- Marketing opt-in (optional, separate from the scan). The form has a separate box, unticked by default, for occasional emails about accessibility tips and product updates. The scan works the same whether or not you tick it. If you tick it, your opt-in only takes effect once you confirm the scan with the link we email you. If you never confirm, it is deleted with the request. Once it takes effect, we keep your email address with the date and time of your opt-in and the version of the wording you agreed to. This record is not part of the 30-day free-scan deletion: we keep it until you unsubscribe or withdraw consent. You can do that at any time, using the unsubscribe link in any marketing email or by emailing legal@glimscope.com. Withdrawing doesn't affect emails sent before you withdrew. We then delete the opt-in record and keep only a one-way hash of your address on our suppression list, so we don't email you again.
4. AI processing
The fix guidance in our reports comes from a fixed library that we maintain. We do not currently send your account details, URLs or scan data to any AI model provider. If we start using a third-party AI provider (for example for support replies), we will update this policy and the subprocessor list first, send only the minimum needed, and use a provider that does not train on our API data. We do not use AI to make decisions about you that have legal or similarly significant effects.
5. Who we share information with
We share personal information only with:
- Service providers (subprocessors) who host or operate parts of the Service under contracts that require them to protect it:
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe (Stripe Payments Australia Pty Ltd, Stripe, Inc. and affiliates) | Payment processing, subscription billing, working out whether any tax is included in the price and recording it (Stripe Tax, using your billing address, tax ID and location evidence), invoices and receipts, refunds and disputes. Stripe processes payment data on our behalf, and as an independent controller for its own purposes such as fraud prevention and legal compliance (see https://stripe.com/privacy) | Australia / USA / Ireland and other countries where Stripe operates |
| Hetzner Online GmbH | Application hosting, database, scanning and database backups | Germany (Falkenstein) |
| Resend (Plus Five Five, Inc.) | Sending our emails (account, service and free-scan emails, and marketing emails if you opt in) | USA |
| Dynadot Inc | Domain name and DNS, forwarding of emails you send to our @glimscope.com addresses (support@, legal@, abuse@), and hosting of the mailbox where we receive and keep them | USA |
| Google LLC (Google Analytics 4) | Website analytics: page views and conversion events. See Google's privacy policy and how Google uses information from sites or apps that use our services | United States and other countries where Google operates |
- Professional advisers (lawyers, accountants, insurers), under confidentiality.
- Authorities, where required by law or to protect rights, safety or security.
- A buyer or successor of the Glimscope business, subject to this policy. We will tell you before your information is transferred.
We will publish changes to this subprocessor list at https://glimscope.com/privacy at least 14 days before a new subprocessor starts processing customer personal data.
6. International transfers
We are based in Australia, and our providers operate in other countries, including Germany (our hosting provider) and the United States (Resend for sending email, Dynadot for forwarding and storing email you send us, Stripe, which may also process payment data in other countries, and Google LLC for Google Analytics). When we transfer personal data out of the EU/EEA or UK, we rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified), Standard Contractual Clauses, or the UK International Data Transfer Addendum. Before disclosing personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs (APP 8).
7. Retention
| Data | Retained for |
|---|---|
| Account data | While your account exists. If you ask us to delete your account, we delete or anonymise it within 30 days of the request (except records we must keep by law, below) |
| Accounts that are never verified (including any first scan and terms record) | Deleted automatically 7 days after sign-up if the email address is never verified |
| Address from your sign-up link (if any) | Until you add a site, or 7 days after sign-up, whichever comes first. Deleted with your account |
| Paid plans: scan results and evidence log | While your paid subscription is active. Site-level evidence (scan dates, issue counts, rule list and PDF reports) is kept for as long as you are subscribed, and page-by-page detail for at least 24 months |
| Paid plan ended (lapsed): scan history | Kept read-only for 12 months after your paid plan ends. You can export a CSV summary and download reports during that time, and we email you 30 days and 7 days before the 12 months end. Your dashboard also shows the date the 12 months end. After that, Free plan retention applies (next row) |
| Ended trials (no-card trial) | Trial data is kept for 30 days after the trial ends, in case you choose a paid plan. After that, Free plan retention applies |
| Free plan: scan history | The last 3 scans per site, up to 90 days old. The most recent scan of each site is always kept while the account exists. Older scans are deleted automatically |
| Free instant scan (no account): URL, report, authorisation record and keyed IP hash | 30 days, then deleted automatically |
| Free scan by email: email address | Until the report is sent, or the request fails or expires (unconfirmed requests expire after 24 hours). The address is removed from our copies of the emails once they are sent |
| Free scan by email: URL, report, address hash and keyed IP hash | 30 days, then deleted automatically |
| Free-scan suppression list (hash of your address) | As long as needed to honour your "stop emails" request |
| First scans of sites whose domain was never verified | 30 days, then deleted automatically |
| Copies of emails we send | 90 days, then deleted automatically (free-scan copies keep no recipient address) |
| Terms and authorisation records (accounts and monitored sites; free-scan records follow the free-scan rows above) | While your account exists, and up to 7 years after it is deleted (evidence for legal claims) |
| Rate-limit records | 7 days |
| Login-protection records (email address and IP address after failed logins) | Deleted on your next successful login, otherwise within about 24 hours of the last failed attempt (or once any lockout ends) |
| Completed scan-job records | 30 days |
| Sessions | Until logout or expiry (14 days) |
| Billing and tax records, including invoices, refunds and customer-location evidence (held by us and Stripe) | As long as tax law requires: generally 5 years in Australia, 10 years for EU non-Union OSS records, and 6 years in the UK |
| Support messages | 24 months |
| Website visit log (shortened IP address, page, browser, status, time) and server security logs | 30 days, then deleted automatically. Only the people who run our server can read them |
| Rate-limit records (our counters for sign-ups, logins and scans, keyed to your IP address) | 7 days, then deleted automatically |
| Terms and consent records (date and time, version accepted, IP address) | Kept while your account exists and deleted with it when you ask us to delete your account, except where we need to keep a record to deal with a legal claim |
| Database backups | 14 days, then overwritten |
| Marketing opt-in (email address, opt-in time, wording version) | Until you unsubscribe or withdraw consent. Not deleted with the free-scan data after 30 days. After that, only a one-way hash of your address is kept on our suppression list, for as long as needed to honour your choice |
Analytics choice cookie (gs_analytics) | 180 days, or until you choose again, whichever is sooner |
| Google Analytics event data | Held by Google under its own settings and policies, not in our database. This software does not set Google's retention period |
These periods can be shortened by deleting a site (which deletes its scans and alerts) or by asking us to delete your account.
8. Security
All connections to our website and app use encryption in transit (TLS). Our database and its backups are stored on our server in Germany (Hetzner, Falkenstein). The app runs in a container as a non-administrator user. Passwords are hashed with scrypt. Session, password-reset and email-verification tokens are stored only as one-way hashes, and free-scan IP addresses only as keyed hashes. No system is perfectly secure. If a data breach is likely to result in serious harm, we will notify affected individuals and regulators as required by law, including the OAIC under the Notifiable Data Breaches scheme where it applies to us, and EU/UK supervisory authorities within 72 hours where the GDPR requires.
9. Your rights
Everyone: you can ask to access or correct your personal information, or to delete your account, by emailing legal@glimscope.com. We will respond within 30 days. We may need to verify your identity.
EU/EEA and UK: you also have the rights to erasure, restriction, data portability, objection (including to direct marketing at any time), withdrawal of consent, and not to be subject to solely automated decisions with legal or similarly significant effects. You may complain to your local supervisory authority, e.g. the Information Commissioner's Office (UK).
Australia: you may complain to us first. If you are not satisfied with our response within 30 days, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).
United States: depending on your state, you may have rights to know, access, correct and delete personal information, and to opt out of its "sale" or "sharing", plus the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioural advertising. You can make a request at legal@glimscope.com or through an authorised agent.
People whose information appears on a scanned website: if your information appears in our scan data because someone scanned a website you are on, contact us. We will help, or refer you to the website's owner.
10. Cookies
We use one essential cookie, sid, to keep you logged in. It is set only when you sign up or log in, is not readable by scripts (HttpOnly), and is deleted when you log out or it expires.
When Google Analytics is switched on, Google may set cookies (for example _ga) or use similar storage to recognise a browser across visits. We also set a first-party cookie, gs_analytics, to remember whether you accepted or refused. That choice cookie is not an advertising cookie and is not sent to Google as the contents of an analytics hit.
We do not use advertising cookies, and we do not turn on Google's advertising or ads-personalisation features in the tag. We do not load Google Analytics until you accept. Where the law requires consent for analytics cookies, we ask first, and the question on the site is that request. If you refuse, Google Analytics is not loaded. If you accept and later refuse, we stop loading it on later pages. Cookies Google has already set may stay in your browser until they expire or you clear them. You can change your choice with the analytics control on the site.
Our own fonts and scripts are served from our domain. Google Analytics, only after you accept, loads its script from Google (www.googletagmanager.com). Our website visit log (section 3) uses no cookies and no device fingerprinting, and it only records a shortened IP address, so that log cannot follow you from one visit to the next.
11. Marketing
We send marketing emails only if you opt in, or where the law otherwise allows (e.g. to existing customers about similar services, with an easy opt-out). Every marketing email has an unsubscribe link and identifies us (Spam Act 2003 (Cth), CAN-SPAM, PECR/ePrivacy). Service emails, such as verification, password resets and the regression alerts you set up, are not marketing.
12. Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect their personal information.
13. Changes
We will post updates here and, for material changes, notify account holders by email or in-app before they take effect.
14. Contact
Glimscope, operated from Western Australia, Australia · legal@glimscope.com. On request, we will tell you the name of the person or entity legally responsible for your personal information.