Privacy policy

Last updated: October 27, 2026

1. Introduction

This Privacy Statement explains how Accessibird ("we", "us", "our"), operated by Accessibird Limited (Hong Kong), collects, uses, stores, and protects personal data in connection with the Accessibird accessibility platform (collectively, the "Service"). It covers three distinct products:

• The marketing website, accessibird.com, including our blog and campaign landing pages
• The dashboard application, app.accessibird.com, including the agency management platform
• The Accessibird widget, the accessibility widget our customers install on their own websites

These three products handle data differently: the marketing website uses consent-based analytics and an optional support chat, the dashboard processes account and scan data, and the widget is designed to collect no personal data at all. Each is described separately in the sections below, so please read the parts that apply to how you interact with Accessibird.

We are committed to protecting your privacy and processing data in compliance with the General Data Protection Regulation (GDPR), the ePrivacy Directive, the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), and other applicable data protection laws.

2. Data Controller

The data controller for personal data processed through the Service is:

Accessibird Limited
Unit 1801, 18th floor, Fortis Tower
77 Gloucester Road, Wan Chai
Hong Kong
Email: privacy@accessibird.com
Website: accessibird.com

For data protection inquiries, please contact our Data Protection Officer at dpo@accessibird.com.

3. What We Collect & Why

The data we collect depends on how you interact with Accessibird. We distinguish between the following categories of users:

3.1 Website Visitors (Widget Users)

When the Accessibird accessibility widget is embedded on a third-party website, we process no personally identifiable information (PII) from end-users. Specifically:

• No cookies are set or read
• No browser fingerprinting is performed
• No IP addresses are stored
• No cross-site tracking occurs

We collect only aggregated, anonymous usage data, such as which accessibility features are toggled (e.g., font size adjustment, contrast mode) and page view counts, to improve the widget. User preferences (font size, contrast settings) are stored exclusively in the browser's localStorage and never transmitted to our servers.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR), improving product functionality without identifying individuals.

3.2 Dashboard Users (Site Owners)

When you create an account and use the Accessibird dashboard, we process:

• Account data: Email address, display name, company name (optional)
• Website data: URLs, domains, verification status
• Scan data: Accessibility scan results, page analysis, findings, and remediation tasks
• Widget configuration: Color schemes, theme preferences, accessibility mode settings
• Task data: Accessibility tasks, comments, assignment history

Legal basis: Contract performance (Art. 6(1)(b) GDPR), necessary to provide the service you signed up for.

3.3 Agency Owners & Members

If you use the agency management features, we additionally process:

• Organization data: Agency name, branding (logo, colors), welcome text
• Team data: Member email addresses, roles (owner, admin, member)
• Client data: Client website associations, access permissions
• Invitation data: Email addresses of invited team members

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

3.3a Client and organisation details

Partners can record client details (contact name, company, contact email, town, country) for websites they manage for a client without an account. Site owners can optionally add the same details about their own organisation. We use these details only to check that partner commission is paid on genuine client websites. They are visible to the partner's team (for managed client websites), the owner (for their own organisation) and Accessibird admins. A partner sees only company, town and country of an owner it referred. The details are deleted when the website or account is deleted, or when the partner or owner removes them.

Legal basis: Legitimate interest in preventing commission fraud (Art. 6(1)(f) GDPR).

3.4 Embed / Lead Scan Users

When you use an agency's embedded accessibility scanner and provide your email address to receive results, we process your email solely for the purpose of creating your account and delivering scan results.

Legal basis: Consent (Art. 6(1)(a) GDPR), you actively provide your email and agree to account creation.

When you start a scan, we store your IP address with the scan to protect our system against abuse, such as automated or excessive scanning. This IP address is visible only to Accessibird admins and moderators. It is never shown to the agency or partner whose scanner you used. We automatically delete the stored IP address 90 days after the scan; the scan results themselves are kept.

Legal basis: Legitimate interest in keeping the service secure and preventing abuse (Art. 6(1)(f) GDPR).

If you have accepted marketing in Cookie settings, we also save the name, email address, phone number and website you type into the scanner's sign-up form, even if you do not finish signing up. Accessibird admins and moderators, and the agency or partner whose scanner or partner code you used, can see these details so they can follow up on your scan. We delete them 6 months after you entered them. If you withdraw marketing consent before finishing, your typed details for that scan are removed.

Legal basis: Consent (Art. 6(1)(a) GDPR), given through the marketing choice in Cookie settings.

4. Widget-Specific Privacy

The Accessibird accessibility widget deserves special attention because it runs on third-party websites visited by end-users who have no direct relationship with Accessibird. Our commitment:

• No PII collection: We do not collect names, emails, IP addresses, or any identifying information from widget users
• No cookies: The widget does not set, read, or require any cookies
• No fingerprinting: We do not use browser fingerprinting, canvas fingerprinting, or any other identification technique
• Local storage only: User accessibility preferences (such as font size and contrast settings) are stored in the browser's localStorage and remain on the user's device
• No third-party requests: The widget does not load third-party trackers, analytics scripts, or advertising pixels
• Anonymous analytics only: If enabled by the site owner, we collect aggregated feature usage counts that cannot be linked to individual users

5. Data Processing & Sub-processors

We use the following sub-processors to deliver the Service:

5.1 Analytics on the marketing website

Our marketing website at accessibird.com uses Google Analytics 4, delivered through Google Tag Manager. These scripts are loaded only after a visitor has consented to analytics. We use them to measure page views, engagement and traffic sources, including visits from campaign links we share on LinkedIn.

Data processed by Google Analytics on our marketing website may include:

• Page URLs and page titles
• Campaign labels attached to the link you followed (for example UTM parameters)
• Browser and device information, such as browser type, operating system and screen size
• Interaction events, such as scrolls, clicks and outbound link clicks
• Cookie identifiers used to distinguish one visit or browser from another

The Google tag we use is also connected to Google Ads. As a result, once analytics is enabled, Google Ads may receive limited technical requests from your browser. Advertising cookie consent and ad personalization are switched off in our configuration.

Framer, our marketing website host, additionally provides built-in visitor statistics. This analytics and consent configuration applies specifically to accessibird.com. How cookies and local storage work in the dashboard and in the widget is described in section 10.

5.2 Support chat on the marketing website

Our marketing website offers an optional support chat provided by Chatbase. The chat is loaded only after you have consented to it. When you use the chat, the messages you submit are processed in order to answer your question, including any personal details you choose to enter yourself, such as your name, your email address or your website. Please do not enter sensitive information in the chat. If you prefer not to use the chat, you can reach us by email at privacy@accessibird.com.

6. Data Storage & Location

For the dashboard application and the widget, all primary data (user accounts, website data, scan results, accessibility findings) is stored in Supabase's EU region. This part of our infrastructure is designed to keep personal data within the European Economic Area (EEA) wherever possible.

Cloudflare may cache static dashboard and widget assets at edge locations worldwide, but no personal data is included in cached content.

The statements above describe our dashboard and widget infrastructure only. The marketing website's providers, Framer, Google and Chatbase, listed in section 5, store and process data under their own arrangements and privacy policies.

7. Data Retention

For the dashboard application and the widget, we retain personal data only as long as necessary to provide the Service:

• Widget findings: Retained according to your subscription tier (e.g., 30 days on the Free plan)
• Scan results: Retained according to your subscription tier (e.g., 60 days on the Free plan)
• Account data: Retained for the duration of your account; deleted within 30 days of account closure
• Aggregated analytics: May be retained indefinitely in anonymized form
• Security audit logs: Retained for up to 12 months for security and compliance purposes

These retention periods apply to data we hold for the dashboard and the widget. For the marketing website, retention depends both on settings we control within the provider's platform, such as the user and event data retention period configured on our Google Analytics property, and on the providers' own arrangements described in their privacy policies.

You can withdraw analytics consent through Cookie settings. This stops analytics and attempts to remove this website's analytics cookies. You can also delete cookies through your browser settings. Deleting cookies does not delete data already collected.

8. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

• Right of access (Art. 15), Obtain a copy of your personal data
• Right to rectification (Art. 16), Correct inaccurate personal data
• Right to erasure (Art. 17), Request deletion of your personal data ("right to be forgotten")
• Right to data portability (Art. 20), Receive your data in a structured, machine-readable format
• Right to restriction (Art. 18), Restrict processing of your data under certain conditions
• Right to object (Art. 21), Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)), Withdraw consent at any time where processing is consent-based
• Right to lodge a complaint, File a complaint with your local data protection supervisory authority

9. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at privacy@accessibird.com. We will respond to your request within 30 days in accordance with GDPR requirements.

You can also update your display name and account information directly from the Accessibird dashboard at any time.

10. Cookies & Local Storage

Dashboard application (app.accessibird.com)

The Accessibird dashboard uses essential session cookies only to maintain your authenticated session. These are strictly necessary for the dashboard to function and do not require consent under the ePrivacy Directive. It also reads and writes the shared advertising choice cookie described below. It may use localStorage for interface preferences such as sidebar state and filter settings, and a local consent history that preserves earlier acceptance when you withdraw.

Shared advertising and marketing choice

One advertising and marketing measurement choice covers both accessibird.com and app.accessibird.com, including the app's scanner frame on our website. We store it in the ab-consent cookie on .accessibird.com, for six months (15,724,800 seconds), with path /, Secure and SameSite=Lax. Its URL-encoded value records granted or denied, notice version 2026-10, and the ISO date and time of that choice. The app reads an existing choice without asking again. In the EU/EEA, United Kingdom and Switzerland, and when your region cannot be determined, app advertising tracking stays off until you accept. Elsewhere it may run unless you refuse. We check the country through our own Cloudflare connection without storing an IP address. A refusal overrides the regional default.

You can change or withdraw this choice through Cookie settings on either site, including the cookie icon in the app and scanner. Opening settings does not change your choice. Rejecting advertising stops Meta tracking in the app immediately; other open app tabs and frames check for changes every half second and on return to the page. We retain the date and version of earlier acceptance in this browser's local consent history rather than erasing it on withdrawal. Clearing browser storage deletes that local history. Choices made on another site before this app first opens cannot be reconstructed from the cookie.

Where installed and permitted, Meta receives page visits, interactions, browser information and cookie identifiers for advertising measurement and ad optimization. Withdrawal prevents new events, not data already received by Meta. Our app uses Accessibird's Meta Pixel in a separate measurement frame so dashboard addresses, scanned website addresses and form data are not sent to Meta. Scanner frames do not install another Pixel. Completed scans and active trials use the custom events ScanCompleted and TrialStarted, only when your advertising choice is explicitly granted, in every region. Successful registrations may use a standard event. Events use random event identifiers. No names, emails, account identifiers, scan results or customer matching data are sent by this installation. Advertising permission does not authorize sharing sensitive information or subscribe you to marketing emails. Email subscriptions remain a separate account choice. Analytics and support-chat choices remain separate. Contact privacy@accessibird.com for help with your choices.

Sharing with a referring partner's Meta Pixel

If you arrive through a partner's referral link and allow advertising cookies, that partner's saved Meta Pixel may receive the pages you visit on accessibird.com and whether you completed a website check. Completed checks may also be reported from the scanner on app.accessibird.com, using the same random event identifier as Accessibird's Pixel. With your advertising consent, the recorded referring partner may also receive a TrialStarted event when a trial is successfully created in the app, if partner trial measurement is enabled. Partners do not receive dashboard page visits or purchase events from the app. Names, email addresses, the website you scanned and scan results are never included in these events. Public page visits may reveal the public page address, browser information and Meta cookie identifiers, so this measurement is not anonymous.

Your advertising consent is the basis for this optional sharing, for advertising measurement and ad optimization. Accessibird controls when these events are sent; the referring partner is responsible for subsequent use, its privacy information and its agreement with Meta. The precise responsibilities depend on the applicable arrangements and law.

You can withdraw at any time through Cookie settings. Withdrawal stops new sharing immediately, but does not remove data already received. Contact privacy@accessibird.com for questions about the referring partner or your choices.

Accessibird widget on customers' websites

The accessibility widget stores visitor preferences (e.g., font size, contrast settings) in the browser's localStorage. This data never leaves the visitor's device and is not transmitted to our servers. As described in section 4, the widget sets no cookies.

Marketing website (accessibird.com)

On our marketing website, including the blog, both Google Analytics and the Chatbase support chat remain switched off until you separately enable them. Google Analytics, Google Tag Manager and Chatbase are not loaded unless the relevant consent has been granted. Saved choices are applied on subsequent visits.

• You can accept both optional services, reject both, or enable only one of them, analytics and support chat are separate choices.
• Rejecting them does not prevent you from browsing the website; all content stays available.
• A permanent "Cookie settings" button is available on the website so you can change or withdraw your consent at any time.
• Your choices are stored locally in your browser for 180 days.
• When you withdraw consent, the page reloads so the affected scripts stop running in your browser.
• When analytics is enabled, Google Analytics may set cookies such as _ga and _ga_* to distinguish visits and browsers.
• Framer, our website host, also provides built-in visitor statistics, which do not use tracking cookies.

The separate analytics and support-chat choices described here apply to accessibird.com. The advertising and marketing measurement choice is shared with app.accessibird.com as described above. These settings do not change your choices on LinkedIn, Facebook or other platforms where you clicked an ad.

11. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us at privacy@accessibird.com and we will promptly delete it.

12. International Transfers

The primary data infrastructure for the dashboard application and the widget is located in the EU. Accessibird Limited is established in Hong Kong, so this data may be accessed from Hong Kong. Where personal data from the dashboard or the widget is accessed from or transferred outside the EEA, including to Hong Kong, we use appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission where required, to protect such personal data.

The marketing website's providers listed in section 5, Framer, Google and Chatbase, may process data outside the EEA. Their processing is governed by their own privacy policies, which are linked in section 5. If you would like details of the transfer arrangements that apply to a specific provider, contact us at privacy@accessibird.com.

13. Changes to This Statement

We may update this Privacy Statement from time to time. For material changes, we will provide at least 30 days' notice via the dashboard or email. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact

If you have any questions about this Privacy Statement or our data practices, please contact us:

• Email: privacy@accessibird.com
• Data Protection Officer: dpo@accessibird.com
• Company: Accessibird Limited, Unit 1801, 18th floor, Fortis Tower, 77 Gloucester Road, Wan Chai, Hong Kong
• Website: accessibird.com