GDPR Art. 13–14
Privacy policy
Effective 10 October 2026.
This Privacy Policy explains how Altvisor collects, uses, and protects personal data when you visit our website, run a WCAG scan, or use the Altvisor application. It also describes your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Polish data-protection law, and how to exercise them.
We are the data controller for our own users’ account and usage data. When we process the images and content you submit for alt-text generation, we act as a processor on your behalf — those terms live in our Data Processing Agreement.
Who we are (the controller)
Altvisor is operated by Hleb Malyshau, a sole trader (jednoosobowa działalność gospodarcza) established in Poland.
- Correspondence address: plac Trzech Krzyży 10/14, 00-499 Warszawa, Poland
- NIP (VAT): PL5213990822
- Contact: hi@altvisor.eu
What we collect
- Account data — your email and the organisation name you choose at sign-up. We never read your OAuth provider profile beyond email and name.
- Usage data — quota counters, audit-log events, billing records, and product analytics, all hosted in the EU.
- Uploaded images — processed in memory and deleted from storage before the request returns. Only a content hash, image dimensions, and the generated alt-text are retained; the source image bytes are not.
- Technical data — for anonymous demo scans we store a short-lived rate-limit counter and a salted, daily-rotating hash of your IP address. The raw IP is never stored.
Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Altvisor service and your account | Performance of a contract — Art. 6(1)(b) |
| Billing, tax, and accounting records | Legal obligation — Art. 6(1)(c) |
| Product analytics, security, and abuse prevention (EU-hosted, no advertising) | Legitimate interests — Art. 6(1)(f) |
| Marketing-site traffic measurement (Google Analytics) | Consent — Art. 6(1)(a); ePrivacy Art. 5(3) |
Where your data lives
Our database, authentication, and file storage run on Supabase in eu-west-1 (Ireland). All AI processing uses Mistral on EU infrastructure — on every plan, your images are never sent to a non-EU AI provider. The full list — including each processor’s location and transfer basis — is on our subprocessors page.
International transfers
Customer data is hosted in the EU/EEA by default. Where a subprocessor located in the United States is involved (disclosed on the subprocessors page), the transfer relies on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, together with supplementary technical measures such as encryption in transit and at rest.
How long we keep it
Account data is kept for the life of your account. Compliance artefacts (audit reports, accessibility statements, and the audit log) are retained for 5 years as required by Annex IV of the European Accessibility Act. Demo rate-limit counters and IP-hash buckets are deleted within 48 hours. The full retention schedule is in §6 of the DPA.
Authenticated saved comparisons retain both submitted URLs and the automated comparison results privately for the lifetime of your organisation. They are deleted when your organisation is deleted. Anonymous comparisons are not saved to this history.
Altvisor browser extension
Scanning inspects up to 1,000 images in the current top document after your action. Frames, shadow roots, canvas and CSS backgrounds are outside scope. Scans stay in memory and scanning does not transmit the page or require an API key.
The background worker stores your API key in trusted local extension storage, never sync storage. Pages and content scripts cannot read it. The key is sent in the Authorization header only to https://altvisor.eu for a usage GET with no request body and for an explicitly requested generation POST. Requests do not send browser cookies or follow credentialed redirects.
Only after you select a current image and request a suggestion, the extension sends that image URL and your chosen output language to the EU service. The service retrieves and processes the image under the public API privacy and account terms described in this policy and the Data Processing Agreement. URL query strings may contain personal data: send only images you are permitted to process. The extension sends no full scan, DOM, browsing history, existing alt prose, cookies or page credentials. Review and copy never changes the website.
The key, output-language setting and minimal daily allowance use trusted local storage. The allowance contains no key, organisation, image URL or suggestion. Results and selected-image references use trusted session storage: at most one result per tab and five tabs, with a five-minute expiry. Tab closure, navigation, key changes and extension updates purge transient results. Scans and suggestions do not enter disk-backed storage or extension telemetry. Server-side account and processing retention follows this policy and the Data Processing Agreement.
A free installation may complete three successful generations per UTC day. Unresolved outcomes occupy a slot until the next UTC day; closing the popup or restarting does not retransmit a request. An uncertain outcome may also have consumed organisation usage. This local allowance is an installation control: uninstalling and reinstalling can reset local state. Canonical server authentication, rate, quota and cost limits remain authoritative for free and paid organisations.
Removing the saved key deletes the credential and transient results but preserves the daily allowance. Scanning remains available without a key. Removing a key from the extension does not revoke it on the server; create or revoke API keys separately in your account settings. Removing the extension deletes its local installation data.
Cookies
We use a small set of strictly-necessary cookies (session, language, and abuse-prevention) plus EU-hosted analytics. Google Analytics on our marketing pages is set only after you accept via the consent banner. The full cookie inventory — name, purpose, retention, and lawful basis — is in §7 of the DPA.
Your rights
Under the GDPR you have the right to access, rectify, export (data portability), erase, restrict, and object to the processing of your personal data, and to withdraw consent at any time without affecting prior processing. To exercise any of these rights, contact us at hi@altvisor.eu. You can permanently delete your organisation and all associated data from your account settings.
If you believe we have mishandled your data, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO), ul. Stawki 2, 00-193 Warszawa, Poland (https://uodo.gov.pl), or with the supervisory authority in your own EU/EEA country.
Changes to this policy
We may update this policy as the service evolves. Material changes will be reflected in the effective date above and, where appropriate, notified to you by email.