This page describes what Perceva stores, where it is stored, and who else can see it. It is written from the actual database schema rather than from a template, so it is specific and it is short.
If something below is unclear, that is a bug in this page and we would rather fix it than leave it vague.
Where everything runs
Perceva runs on servers in the United States. The application, the database, and the scan engine are all in the same US region. That is a deliberate choice, not an accident of hosting — it is stated on our footer and we would rather be plain about it than have you find out from a DNS lookup.
What happens when you run a scan
You give us a URL. We load that page in a real browser from our own server and run an accessibility test against it. We are visiting a public web page in the same way any visitor would.
We store, for each scan:
- The URL you submitted, and the URL the browser finished on if it was redirected.
- The Issue severity score and the count of issues at each severity.
- The full scan result, as returned by the test engine. This includes, for each issue, the rule that failed, the WCAG criterion, a CSS selector identifying each failing element, and a short snippet of the HTML of the failing element — because a report that cannot show you the offending markup is not much of a report.
- Your IP address. This is stored for one reason: the scanner allows five scans per IP address per hour, and enforcing that limit requires knowing which address asked. It is not used to build a profile and it is not sold or shared.
- The time of the scan.
- An email address, only if you gave us one — by asking for the report by email, or by signing up.
The HTML snippets are worth calling out. If you scan a page that contains information you would not want us to hold, we will hold a fragment of it. Scan a page you are comfortable with, or ask us to delete a scan.
Scan results are private by default. Every scan is created with its public flag off. A result lives at an unguessable URL, and that page is marked noindex so search engines do not list it. Publishing a scan under our domain is a separate, deliberate act that we take — for example, we publish the scan of our own site, because pointing the tool at ourselves in public is the entire pitch. We do not publish yours because you ran it.
What we store if you give us your email
- Email captures — your email address, where on the site you gave it to us, the scan it was attached to if there was one, and when. We use it to send you the report you asked for and to tell you when the product is ready.
- Subscribers — if you pay: your email address, your Stripe customer and subscription identifiers, which plan you are on, and the subscription status.
Payment details: we never see them
Payment is handled by Stripe, using Stripe’s own hosted checkout page. When you pay, you are entering your card details on a page Stripe serves, not on a page we serve.
We never store card data. There is no field for it in our database and there is no card form anywhere in our code. What we hold is Stripe’s identifiers for your customer and subscription record, so we know which account is active. Everything else stays with Stripe under their terms.
Analytics
We use Plausible for analytics, and we send exactly four events. This is the complete list:
| Event | What is sent with it |
|---|---|
SCAN_RUN | the score and the number of issues |
EMAIL_CAPTURE | which part of the site the address came from |
CHECKOUT_CLICK | which plan was clicked |
CHECKOUT_COMPLETE | which plan was purchased |
No email address, no URL you scanned, and no IP address is attached to any of them. These four numbers are how we know whether the product is working; there is nothing else we are trying to learn about you.
There is no Google Analytics on this site, no advertising pixel, no remarketing tag, and no cross-site tracking. We self-host our fonts rather than loading them from a font service, so loading our pages does not tell a third party that you were here.
Who else touches your data
Being specific about this matters more than a paragraph about how seriously we take security:
- Stripe — payment processing and subscription records, for paying customers only.
- Plausible — the four analytics events above.
- Sentry — error monitoring on our application and scan engine. If something breaks while you are using the site, a technical report is sent, which may include the URL that was being processed.
- Our hosting provider and backup storage — the servers the application runs on, and the nightly database backups.
We do not sell your data, and we do not share it with anyone not on this list.
Backups
The database is backed up nightly to object storage. Backups contain the same data described above, which means a deleted record can persist in a backup until that backup is rotated out. That is how backups work everywhere; we would rather say it than let you assume deletion is instantaneous everywhere.
Data retention
Some of what we collect is sensitive, so here is exactly how long we keep it.
Failing-element markup — 90 days. When a scan finds a problem, we store a short snippet of the HTML that caused it, so the report can show you the element rather than describe it. This is the most sensitive thing we hold: on a page behind no login it is public markup, but it is still a fragment of your site’s source. We delete these snippets 90 days after the scan.
Scan records — kept while your account is active. The URL, the date, the score and the list of issues stay so you can see whether your site is improving. Comparing a scan against your history is what makes monitoring work at all. Delete your account and they go with it.
Free scans by people without an account — 90 days.
IP addresses — 30 days. We record the address a scan came from for one reason: to enforce the limit of five free scans per hour, so one person cannot exhaust the service for everyone. It is not used to build a profile of you and it is not shared.
Email addresses. Kept until you ask us to remove them, or until you unsubscribe. If you gave us an address and never became a customer, tell us and we will delete it.
Backups. Nightly, encrypted, held in a US region like everything else, and rotated out after 30 days. A deletion you request is applied to live data immediately and works through the backups within 30 days.
Ask us to delete something: email privacy@percevahq.com and we will confirm when it is done. You do not need an account, and you do not need to explain why.
Your choices
You can ask us to delete a scan, an email address, or an account, and we will. Email privacy@percevahq.com and tell us which. If you ask us to delete a scan, tell us the URL you scanned and roughly when, since we do not require an account to run one and we may need that to find it.
If you are in the EU or the UK, you have rights of access, correction, deletion and portability under the GDPR. Exercising them is the same email address; we are a small company and it will be a person who answers.
Changes to this page
If we change what we store, we change this page, and the change is dated. We are not going to bury a material change in a “we may update this policy from time to time” sentence.
Last updated: 1 September 2026
Contact: privacy@percevahq.com