Privacy Policy
On this page
1. Introduction
This Privacy Policy explains how AdaChecked ("AdaChecked," "we," "us," or "our") collects, uses, discloses, and protects information when you install or use the AdaChecked application for Shopify (the "App"), visit our website, engage our services, or contact us (together, the "Service"). By using any part of the Service, you acknowledge the practices described here.
This Policy applies only to information handled by AdaChecked. It does not apply to information handled by Shopify or any other third party, including any third-party site you reach from ours. Your use of Shopify is governed by Shopify's own privacy policy.
2. Information we collect
Information you provide
When you contact us, request a scan or audit, sign up for a plan, or engage our services, we collect the information you choose to share — typically your name, email address, company or store name, website URL(s), the contents of your message, and, for directly-billed services, billing details.
Shopify store data (the App)
When you install the App, Shopify provides us with your store's .myshopify.com domain, your store's primary storefront domain, basic shop details (store name and the account owner's email, where Shopify supplies them), and an offline access token. Using only the scopes you approve at install — read_themes, read_products, read_content, and read_locales — we read your storefront's themes, products, pages, content, and locales for the sole purpose of running accessibility scans. We do not request, access, or store your customers' personal data or your order data. The App does not ask for any customer or order scopes.
Web App account data
When you create an account at app.adachecked.com we collect your email address and a password, which we store only as a salted hash — we never hold your password itself. We record whether the address has been confirmed, your plan, your usage counts against that plan's allowances, and, for paid plans, your billing cadence, your subscription status, and a customer and subscription identifier. Payments for paid plans are taken by Stripe through its Link merchant-of-record service (see Section 4, Sharing and disclosure): card details are entered with them and never reach our own systems. In our Stripe account we can see the name, email address, billing location, invoices, and the brand and last four digits of the card used for a purchase, and we use that only to administer billing and provide support.
Alert recipients you add
The Web App lets you forward scan and regression alerts to a small number of additional email addresses. We store those addresses solely to deliver those alerts, and they receive nothing else — no marketing, and none of your account email. You are responsible for having that person's agreement before adding them; you can remove an address at any time in your settings, and doing so stops all mail to it. If you are a recipient and want to be removed, contact the account holder or write to us and we will remove you.
Websites you submit (services)
To deliver audit, remediation, and monitoring services, we crawl, scan, and analyze the public-facing pages of the website(s) you submit or that we are engaged to review. We may store the resulting data — page URLs, structure and metadata, and accessibility findings — for the duration of your engagement.
Websites you submit (Web App)
Scanning fetches the public-facing pages of a URL you submit, the way a visitor's browser would, and records the page URLs, structure and metadata, and the accessibility findings. We do not log in to your site and we cannot reach pages behind a password or a login.
Scan data
We store the results we generate — page data, accessibility findings, scores and verdicts, and the reports and accessibility statements we produce — for as long as the App is installed, your account exists, or your engagement is active.
Automatic information
When you visit our website we automatically collect technical information such as IP address, browser and device type, referring URLs, and pages viewed, via cookies and server logs.
3. How we use information
We use the information we collect to:
- provide, operate, maintain, secure, and improve the App, the website, and our services;
- run scans and produce scores, reports, remediation guidance, and accessibility statements;
- respond to inquiries and provide support, audits, and remediation services;
- administer billing (through Shopify for the App, through Stripe and its Link service for the Web App, and directly for services) and send service-related notices;
- send the scan and regression alerts you have switched on, to your account address and to any recipients you have added;
- monitor and analyze usage to improve our offerings and develop new features;
- detect, investigate, and prevent fraud, abuse, security incidents, or illegal activity; and
- comply with legal obligations and enforce our agreements.
We rely on these lawful bases where they apply: performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (e.g. for marketing email), and compliance with law.
4. Sharing and disclosure
We do not sell your personal information. We share information only as follows:
Service providers / subprocessors. We share information with vendors who help us operate: cloud hosting and database services (Fly.io), hosting for our accessibility scanning engine (Railway), website hosting (Vercel), website analytics (Google Analytics), transactional and alert email delivery (Resend), and payments, tax collection, and merchant-of-record services for Web App subscriptions (Stripe, including its Link service). We do not currently use an email-marketing platform. If we add one in future (such as Klaviyo) we will update this Policy and the list of subprocessors accordingly, and any marketing email will be sent only with the consent required by law (see Section 10, Marketing communications). These providers are bound by confidentiality and data-protection obligations and may process information only on our instructions.
Stripe and Link. Paid Web App plans are sold through Link, Stripe's merchant-of-record service. Link is the seller of record for the purchase: it processes your payment, calculates and collects any applicable sales tax, VAT, or GST, sends your receipts and invoices, and handles transaction-level support and refunds. To do that, Stripe and Link collect your payment details, billing address, and contact information, and act as independent controllers of that data under their own privacy policies. We pass them only what a purchase needs — your account email, an internal account reference, and the plan you are buying — and receive back a customer and subscription identifier and the status of your subscription. Card details never reach our systems. If you ask Link to delete your information, Link may cancel subscriptions you bought through it.
Shopify. The App runs on Shopify and relies on Shopify for installation, authentication, and billing. Information necessary for those functions is exchanged with Shopify.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction.
Legal requirements. We may disclose information where required by law or legal process, or to protect our rights, property, or safety, or that of others.
Aggregated or de-identified data. We may share data that cannot reasonably be used to identify you.
5. Cookies and tracking
The App uses a signed session cookie to keep you authenticated after you install and open it from Shopify. Our website uses essential cookies and standard server logs to operate the site and remember basic preferences. We also use Google Analytics 4 to understand aggregate traffic — which pages get read, which links get used, and where visitors arrive from. It sets its own cookies in your browser to tell one visit apart from the next; Google Analytics 4 does not log or store individual IP addresses. We do not use advertising or cross-site tracking cookies, and we do not run remarketing. If that changes, this Policy will say so before it goes live. You can control cookies through your browser; disabling them may affect functionality.
6. Data retention and deletion
We retain your store, submitted-site, and scan data for as long as the App remains installed or your engagement is active. When you uninstall the App, we stop scheduled scans, delete your sessions, and mark the store uninstalled; Shopify then sends a shop-redaction request (typically about 48 hours later), at which point we permanently erase that store's scans, pages, issues, leads, and remaining records. On completion or termination of a services engagement, we delete or de-identify the associated data on request. We may retain limited records where necessary to comply with legal obligations, resolve disputes, or enforce our agreements, after which they are deleted or de-identified.
Web App accounts. Your sites, scans, reports, and saved alert recipients are kept while your account exists. Ask us to delete the account and we erase them; scans and reports cannot be recovered afterwards. Cancelling a subscription does not by itself delete anything — the account moves to the free tier and keeps its history. Payment and tax records held by Stripe and Link are retained under their own policies and legal obligations, and our own billing records under ours.
7. Security
We use commercially reasonable technical and organizational measures to protect information, including transmitting data over encrypted connections (TLS), HMAC-signing communications between the App and the scanning engine, restricting and controlling access to data, and hosting with reputable cloud providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a security incident affecting personal information, we will comply with applicable breach-notification laws.
8. International data transfers
We and our service providers may process and store information in countries other than your own, including within the European Union, the United States, and Canada, depending on where our cloud provider and subprocessors operate. Where data is transferred across borders, it may be subject to the laws of, and lawful access by authorities in, those countries. We take steps to ensure such transfers are subject to appropriate safeguards. By using the Service you understand that your information may be transferred to and processed in those locations.
9. Your privacy rights
Depending on where you live, you may have rights to access, correct, update, delete, or restrict processing of your personal information, to withdraw consent, and to data portability. To exercise any right, contact us at hello@adachecked.com; we will respond as required by applicable law and may need to verify your identity first.
Canada (PIPEDA). You may request access to the personal information we hold about you and ask us to correct it. You may also raise concerns with the Office of the Privacy Commissioner of Canada.
Shopify data-protection webhooks. We honor Shopify's mandatory webhooks — shop/redact, customers/redact, and customers/data_request. Because the App holds no customer data, customers/redact and customers/data_request are answered as no-ops, while shop/redact deletes your store's data as described in Section 6 (Data retention and deletion).
EEA / UK / California. Users in these regions may have additional rights under the GDPR, UK GDPR, or CCPA/CPRA, which we honor as required by law.
10. Marketing communications (CASL)
If we send you commercial electronic messages, we do so consistent with Canada's Anti-Spam Legislation (CASL): we send them only with the required consent, we identify ourselves and provide our contact information, and every such message includes an easy way to unsubscribe. Service and transactional messages (e.g. scan results, billing, security notices) are not marketing and may still be sent.
11. Children's privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If we learn we have, we will delete it.
12. Changes to this policy
We may update this Policy from time to time. The "Effective" date at the top reflects the most recent revision. Material changes will be communicated by reasonable means, including posting the updated Policy. Your continued use of the Service after changes take effect constitutes acknowledgement of the revised Policy.