What we collect, and what we don't do

This policy explains what Personaudit collects, why, who processes it on our behalf, and the rights you have over it.

What we collect

Account data. Your email address and a password hash, for authentication.

Audit data. The URLs you submit and the results we generate for them, accessibility violations and persona findings, stored against your account so you can track them over time.

Optional grade email. If you enter an email address on a free grade, we use it only to send you that one result email, then delete it (an address we could not send to is deleted within 7 days); it is stored apart from the grade, and we never send it to analytics or error reports.

When you run an audit, we browse the URL you provide with automated browsers to inspect it. Persona runs can retain screenshots, visited URLs, actions, generated reasoning, and task-check results so you can replay the run. Screenshots and page context can include content visible on the audited site. Do not submit credentials, personal information, or confidential content in task instructions.

Subprocessors

We rely on these services to run Personaudit. Each processes only what its function requires.

• Supabase: authentication, database, and private screenshot storage (your account and audit data).
• Anthropic: the AI (Claude) that produces persona usability findings; the page context of an audited site is sent to their API. See Anthropic's privacy policy.
• Stripe: checkout and billing. We send your account identifier and email, or an existing Stripe customer identifier, to link your subscription. Payment details are collected by Stripe. See Stripe's privacy policy.
• Resend: delivers the emails you ask for, such as a grade result or a scheduled scan summary.
• Cloudflare Turnstile: abuse prevention when configured.
• Vercel: web hosting and delivery.
• Railway: the worker that runs browser audits.
• Sentry: error monitoring (active only when configured); we scrub personal data from error reports.
• PostHog: product analytics (active only when configured); we capture pageviews and coarse product events, disable session recording and autocapture, respect Do Not Track, remove query strings from URLs, and never send emails, notes, result tokens, or full submitted URLs.

Storage and access

Saved audit results and replay screenshots are retained to make reports and replays available after a run. Screenshots use private storage with temporary access links; expiration of a link does not delete the stored screenshot. Public grade results can be viewed by anyone with the result link, so treat that link as shareable.

Deleting a project removes that project's saved runs and the replay screenshots already stored for those runs. The project is kept if those screenshots cannot be removed. A screenshot uploaded while deletion is in progress can remain in private storage. Deleting a project does not delete your account or billing records.

To request deletion of your account or other stored data, contact us below.

Your rights

You can request access to, an export of, or deletion of your data at any time. Contact us at the address below for account export or deletion requests.

Depending on where you live, you may have additional rights under the GDPR (EU/UK) or CCPA (California). We honor these requests regardless of jurisdiction.

What we don't do

We do not sell your data. We do not use advertising trackers. When product analytics are enabled, they are limited to privacy-conservative pageview and product-flow analytics; otherwise we set no non-essential cookies (only the session cookie required to keep you signed in).

Contact

Privacy questions or data requests: hello@personaudit.com.