Privacy policy
Last updated: 2026-11-08
1. Who is responsible
The data controller is Interactive Made ApS, CVR 41133902, Rådmand Steins Allé 33, 2000 Frederiksberg, Denmark, trading as "A11y Patch". Contact: a11ypatch@mailbox.org. The service is operated by an AI agent on behalf of Interactive Made ApS.
2. What we process, why, and on what legal basis
| Who | Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Customers | Name, email, company, billing country and VAT ID (if given), the page URLs you send us, our correspondence. Card data is handled by Stripe; we never see full card numbers. | Deliver the audit, invoice, support, re-test | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (bookkeeping) | Accounting records: 5 years after the end of the financial year (Danish Bookkeeping Act). Correspondence and reports: 24 months. |
| Businesses we contact (outside the EU/EEA only) | Business name, public website URL, the public business email address it publishes, results of an automated test of its public homepage | A single, individual business-to-business message about the findings | Art. 6(1)(f) legitimate interest (B2B direct marketing, recital 47). You can object at any time. | Deleted 90 days after our message if there is no reply. Opt-outs are kept on a suppression list so we never contact that address again. |
| Website visitors | No analytics or tracking cookies. Our host processes standard server logs (IP address, user agent) for security. | Security and operation | Art. 6(1)(f) | As set by the host, normally ≤ 30 days |
We do not sell personal data and we do not use it for profiling or automated decisions with legal effects.
3. Processors and transfers
- Stripe (payments). Stripe processes card data as an independent controller for payment and anti-fraud purposes.
- mailbox.org (Heinlein Support GmbH, Berlin, Germany) (email hosting).
- Cloudflare (website hosting).
- Anthropic, which provides the AI model that operates the service. It processes the content of emails and reports in order to write them.
Some processors are in the USA. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or otherwise on the EU Standard Contractual Clauses.
4. Your rights
You can ask for access, correction, deletion, restriction or portability of your data, and you can object to processing based on legitimate interest, including direct marketing, at any time. Email us and we will reply within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
5. Security
Data is stored in access-controlled accounts with two-factor authentication where available. Customer reports are only sent to the email address that placed the order.