Privacy Policy

Data controller

The Conformly service (“we”) is operated by BAKCHICH, société par actions simplifiée (SAS), 37 rue Guibal, 13003 Marseille, France (company no. 942 552 274 R.C.S. Marseille (SIRET 942 552 274 00022)).

For any question about your data or to exercise your rights: contact@conformly.online.

Data we collect

We only collect data needed to run the service:

• Account: your email address (magic-link or Google sign-in), and your name if provided by Google.
• Monitored sites: the URLs you add and scan.
• Scan results: detected accessibility violations, scores, and screenshots of scanned pages (evidence).
• Technical data: server logs, IP address and user-agent, for security and reliability.
• Audience measurement: pseudonymous identifiers set by Google Analytics, only if you consent.

Purposes and legal bases

• Provide the service (account, scans, monitoring, alerts) — performance of the contract.
• Secure the platform and prevent abuse (logs) — legitimate interest.
• Send service and alert emails (regressions) — performance of the contract.
• Measure site audience with Google Analytics — your consent.

Processors and recipients

We do not sell your data. It is processed by providers strictly needed for the service:

• Supabase — database, authentication and evidence storage (EU hosting).
• Contabo — application server hosting (Germany, EU).
• Cloudflare — proxy, network protection and DNS.
• Resend — transactional and alert email delivery.
• Google Analytics — audience measurement, only after consent.
• Google Search Console — only if you connect your account in the SEO area: read-only access to your search data, revocable at any time (“Disconnect” button or your Google account).

Transfers outside the EU

Primary hosting (Supabase, Contabo) is located in the European Union. Some providers (Google, Resend, Cloudflare) may process data in the United States; such transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Retention periods

• Account data: kept while your account is active, then deleted on request.
• Sites, scans and evidence: kept while you use the service, then deleted when the account is closed.
• Technical logs: up to 12 months.
• Audience measurement (Google Analytics): up to 14 months.

Cookies and audience measurement

The site works without tracking cookies by default. Google Analytics is loaded in “consent denied” mode: no measurement cookie is set until you click “Accept” in the banner. You can change or withdraw your choice at any time by clearing site data in your browser.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your data. To exercise them, email us at contact@conformly.online.

You may also lodge a complaint with your data protection authority (in France, the CNIL — www.cnil.fr).

Security

We apply appropriate technical and organisational measures: encrypted communications (HTTPS), per-site access isolation (RLS), unversioned secrets and backups managed by our host.

Changes

This policy may change. The last-updated date is shown at the top; for significant changes, we will notify you.