Privacy Policy
Last updated: May 25, 2026
1. Data Controller
RegLayer ("we", "us", "our") is the data controller for personal data processed through this platform. We process data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the ePrivacy Directive.
2. Data We Collect
Account Data: Email address, name (via Google OAuth). Legal basis: Contract performance (Art. 6(1)(b) GDPR).
Scan Data: URLs you submit for scanning, scan results, violation data. Legal basis: Contract performance.
Usage Data: Page views, feature usage (only with your consent). Legal basis: Consent (Art. 6(1)(a) GDPR).
Technical Data: IP address (anonymized), browser type, for security. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
3. How We Use Your Data
- Provide accessibility scanning and compliance monitoring services
- Generate compliance reports and accessibility statements
- Send scheduled scan notifications (only when configured)
- Improve our service (aggregated, anonymized analytics only with consent)
- Protect against abuse and ensure platform security
4. Data Storage & Transfer
All data is encrypted in transit and at rest. Our infrastructure and sub-processors may be located outside the EEA (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and Data Processing Agreements, as required by GDPR Chapter V.
5. Data Retention
Account data: Retained while your account is active, deleted within 30 days of account closure.
Scan results: Retained for 12 months, then automatically anonymized.
Audit logs: Retained for 24 months for compliance purposes.
6. Your Rights (GDPR Articles 15-22)
- Access (Art. 15): Request a copy of your personal data
- Rectification (Art. 16): Correct inaccurate personal data
- Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Portability (Art. 20): Receive your data in a machine-readable format
- Restriction (Art. 18): Restrict processing of your data
- Objection (Art. 21): Object to processing based on legitimate interest
- Withdraw consent: Withdraw consent at any time without affecting prior processing
To exercise your rights, contact us at privacy@reglayer.dev. We respond within 30 days as required by GDPR.
7. Cookies
Essential cookies: Authentication session, theme preference. Cannot be disabled.
Analytics cookies: Usage analytics (only with consent). Can be managed in Settings.
You can change your cookie preferences at any time via the cookie settings in the platform footer or Settings page.
8. Sub-processors
| Processor | Purpose | Location |
|---|---|---|
| Neon (Neon Inc.) | Database hosting | US |
| Vercel Inc. | Application hosting | US |
| OpenAI | AI explanations, demand-letter parsing and visual review (may process submitted text/screenshots; DPA in place) | US (DPA in place) |
9. Supervisory Authority
You have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Irish Data Protection Commission (DPC).
10. Contact
For privacy-related inquiries: privacy@reglayer.dev