EuroA11y

Privacy policy

No account, no cookie, no tracking. The service sees only the tool arguments your assistant sends, never your conversation.

Last updated: 5 October 2026

EuroA11y is published by Antoine Olivier (France), who is the data controller for the processing described here. Contact: contact@euroa11y.com

What the service receives

  • The arguments of each tool call, sent by the AI assistant you use: for the page scan, the page address and the options; for the EAA check, the service category, whether you sell to EU consumers, and the headcount, turnover or balance sheet figures you chose to give.
  • Technical request data: the network address of the client that calls the server, and standard HTTP headers. With ChatGPT or Claude on the web, that client is the AI platform's servers; with a client on your own computer, such as Claude Code or a code editor, it is your own address.
  • With ChatGPT, an anonymised identifier of your ChatGPT account, which OpenAI sends to the tools it calls for rate limiting.

What it does with them

  • The page is loaded in a browser, as a visitor would see it, to run the accessibility check. Nothing is submitted to it.
  • To run the check, that browser downloads the axe-core program from euroa11y.com itself, not from a third-party network.
  • The report returned to the assistant contains the page title, its final address, and short HTML excerpts of the failing elements. If the page itself shows personal data, an excerpt may contain it.
  • The EAA check only applies rules to the figures given: it opens no page and stores nothing.

Purposes, legal basis and retention

Each processing relies on the publisher's legitimate interest (GDPR article 6(1)(f)), stated below.

  • Answering tool calls. Tool arguments and the page loaded for the check, to provide the check you asked your assistant to run. Processed in memory during the call.
  • Reusing a recent result. The raw result of a scan, which includes the page address, its title and the HTML excerpts, to answer the same request again without a new scan, which limits cost and delay. Kept up to 24 hours in the cache of the Cloudflare data centre that ran the scan. It is stored under a hash of the request and encrypted with a key derived from the page address and options: it can be read only by a request for the same page, and it is linked to no one.
  • Running and securing the service. Logs of the time, MCP method, tool name, response status and duration, and, when a limit refuses a scan, of that limit and the kind of client (ChatGPT, Claude or other), to find faults and detect abuse. They contain no page address, no identifier, no tool argument and no report. Cloudflare keeps them for 7 days.
  • Usage limits. To share the service fairly and keep it free, the scans of each client and of each scanned site are counted: the client is the ChatGPT account identifier or, for a client on your own computer, its network address; the site is its domain name. Both are stored only as keyed hashes (HMAC-SHA-256), under a random key drawn each day. At midnight UTC the key and the counts are deleted. Cloudflare keeps a recovery history of this storage for 30 days: until then, a restored copy holds that day's key, which could link the hashes back to the client and to the sites it was scanning. Cloudflare's rate limiter also receives an unkeyed hash of the client, to count its calls of the last minute in each Cloudflare location. The total browser time per day is counted with no identifier.
  • Visits to this site. Your network address and request headers, processed by Cloudflare to deliver the pages and protect the site; the server logs no page visit. If a page fails to load, your browser may send Cloudflare a network error report, from which Cloudflare removes your network address once processed.
  • Messages to contact@euroa11y.com. Your address and message, to answer you. They are forwarded to the publisher's mailbox and kept as long as the exchange requires.

Giving data is not required by law or contract. A page scan needs a page address, and the EAA check needs the figures it asks for: without them, the tool gives no result. No decision with legal or similarly significant effects is made about you by automated means.

Who processes data

  • Cloudflare, Inc., as a processor: it hosts the server and this site, runs the scanning browser (Browser Run), resolves domain names (1.1.1.1), holds the cache and the logs, and forwards email (Email Routing).
  • The provider of the publisher's mailbox, as a processor, for messages.
  • The AI platform that called the tool, such as OpenAI or Anthropic, receives the result and handles it under its own privacy policy.

No data is sold, shared for advertising, or used to train models.

Transfers outside the EU

Cloudflare may process data in the United States and other countries. These transfers follow Cloudflare's data processing addendum, which relies on the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. A copy is available on request at the contact address.

Your rights

Under the GDPR you may ask for access, rectification, erasure, restriction or objection by writing to contact@euroa11y.com. Cached results are linked to no one, usage counts are deleted every day and tool arguments are kept nowhere else, so there is usually nothing to return. You may also complain to the CNIL (cnil.fr).

Do not put personal data in a page address you ask the assistant to scan.

Changes

Changes to this policy are published on this page with a new date.