Axively

Privacy Policy

Last updated: June 23, 2026

This Privacy Policy explains how DEBRUSK s.r.o. ("we", "us", Axively operator) collects, uses and protects your personal data when you use the Axively service. We comply with the EU General Data Protection Regulation (GDPR, Regulation 2016/679).

1. Data controller

The data controller for your personal data is DEBRUSK s.r.o., Mukařovského 1985/5, 155 00 Praha 5, Czech Republic, Company ID: 09999973 VAT ID: CZ09999973. For privacy questions, contact us at privacy@axively.com.

2. What data we collect

Account data: email, name, organisation. We use passwordless e-mail login codes, so we do not store a password. Scan data: URLs you submit, publicly available HTML content of scanned pages, violation reports. Usage data: IP address (hashed), user agent, scan volume, billing events. Payment data: processed by Polar; we never see full card numbers.

3. Legal basis

We process data on three legal bases: (a) contract performance, to provide scans and reports you requested; (b) legitimate interest, fraud prevention, rate limiting, product improvement; (c) legal obligation, tax records, accounting.

4. How long we keep data

Account data: kept for the life of your account; after closure we delete it within 90 days. Only data needed to defend legal claims is kept for the 3-year limitation period. Audit data: within 90 days after account closure, or immediately on request. Inactive accounts: after 24 months without a sign-in we notify you and then delete or anonymize the account. Billing and tax records: 10 years (legal obligation). Logs: 90 days.

5. Where your data is stored

All personal data is stored in the European Union. Our application servers and the PostgreSQL database run on a single dedicated server located in the Czech Republic; we do not use a separate managed database or object-storage provider. Apart from storage, limited processing takes place outside the EU: transient API calls to our AI provider (OpenAI or Anthropic, USA) with the HTML snippets of flagged elements, and payment processing by Polar as Merchant of Record (USA) — see section 6.

6. Who we share data with

We use the following processors under GDPR Article 28 contracts: our hosting provider Huko.net (Czech Republic, application servers and PostgreSQL database), OpenAI (active) and Anthropic (standby) (USA, generating and translating accessibility fix suggestions from the HTML snippets of flagged elements), Polar (payment processing) and efik.cz (transactional e-mail delivery). We never sell your data.

7. Your rights

Under GDPR you have the right to: access your data, correct inaccurate data, delete your data (right to erasure), restrict processing, data portability, object to processing, and lodge a complaint with your national data protection authority. To exercise these rights, email privacy@axively.com. We respond within 30 days.

8. Cookies

We use essential cookies to operate the service (for example authentication session and CSRF protection). If you consent, we also use Google Analytics with Google Consent Mode to measure visitor traffic and improve Axively. Analytics storage is denied by default and is enabled only after consent. We do not use advertising cookies and do not grant ad_storage, ad_user_data or ad_personalization. Your choice is stored locally in your browser.

Technical cookies, analytics and local storage

  • axively_session is an essential HttpOnly cookie used for sign-in and keeping your account session active.
  • Google Analytics cookies, for example _ga and _ga_*, are used only after you consent to analytics. We do not enable advertising purposes.
  • Axively's own anonymous visit beacon at /api/track does not use cookies, localStorage or sessionStorage; it is used only for aggregated statistics and service protection.
  • Your Google Analytics preference is stored locally in your browser as axively.analyticsConsent.

9. Security

All traffic is encrypted in transit (TLS 1.3). Passwords are never stored in plaintext. Access to production systems is limited to the operator and protected by 2FA. Incidents involving personal data are reported to the relevant DPA within 72 hours.

10. Changes

Material changes to this policy will be announced by email to account holders at least 30 days in advance. The current version is always available at this URL.

Data Protection Officer

For questions on personal data processing, incidents or supervisory authority contacts, reach our DPO at dpo@axively.com.