Privacy Policy
Last updated: 4 September 2026
This policy explains what personal data Axlura collects, why, and what rights you have. If anything here is unclear, email support@axlura.com.
1. Who we are
Axlura ("the Service") is operated by Izaz Ahamed, trading as Smartprocessflow (Bangladesh). For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we are the data controller. Contact for any privacy matter: support@axlura.com.
2. Data we collect
| Category | Details |
|---|---|
| Account | Your name, email address, and a securely hashed password. |
| Billing | Payments are handled by Paddle as merchant of record. We receive your plan, subscription status, billing country, and the last four digits and brand of your card. We never receive or store full card numbers. |
| Scan data | The website URLs you scan and the accessibility results (WCAG findings, scores, counts). |
| Technical & security | Your IP address (used for rate limiting and abuse prevention), session data, and a Google reCAPTCHA risk assessment when you sign up. |
| Cookies / local storage | A session cookie to keep you logged in, a theme preference, and a temporary "pending scan" item. We do not use advertising or cross-site tracking cookies. |
3. Why we use it (legal bases)
- To provide the Service — creating your account, running scans, generating reports and statements (performance of a contract).
- Security — rate limiting, bot and fraud prevention, protecting accounts (legitimate interest).
- Transactional email — email verification, password resets, and payment receipts (contract). Weekly report emails are sent only if you enable them (consent), and you can turn them off at any time in Settings.
4. Sub-processors
We use the following third parties to run the Service. Each processes only the data needed for its function:
| Provider | Purpose | Location |
|---|---|---|
| Paddle.com | Payments, billing, invoicing (merchant of record) | UK / EU |
| Resend.com | Delivery of transactional and report emails | US |
| OpenAI | Generating fix suggestions from accessibility rule identifiers. We do not send your personal data. | US |
| Google reCAPTCHA | Bot protection on the sign-up form | US |
| Hetzner | Server and database hosting | Germany (EU) |
5. International transfers
Our servers and database are located in the EU (Germany). Some sub-processors (Resend, OpenAI, Google) are based in the United States and process limited data there under standard contractual clauses or their own data-transfer frameworks.
6. How long we keep data
- Account data — for as long as your account is active, and for a short period afterwards for legal and accounting purposes.
- Scan history — automatically pruned after approximately 180 days (the most recent scan per site is kept).
- Rate-limit and security records — a few days.
- You can ask us to delete your account and associated data at any time.
7. Your rights
If you are in the EU, UK, or another region with similar law, you have the right to access, correct, delete, restrict, or object to our processing of your data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority. To exercise any right, email support@axlura.com and we will respond within 30 days.
8. Children
Axlura is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.
9. Changes to this policy
We may update this policy. Material changes will be posted here with a new "last updated" date, and where appropriate we will notify you by email.
10. Contact
For any question about this policy or your data, contact us at support@axlura.com.
This document is provided for transparency and is not legal advice.