Privacy Policy

Last updated: September 11, 2026

What we collect

• Account: your email address and an authentication token (via Supabase). No password is stored by us in plain text.
• Free scan, no account: the URL you enter and the email you give us to send the report, so we can send you the result and limit abuse. We do not create an account for you or add you to a mailing list from this alone.
• Sites and scans: the URLs you register, the pages we discover on them, the accessibility, security, privacy and legal-page findings, the HTML snippet of each affected element, and screenshots of individual elements used to describe images. Screenshots are processed transiently and are not stored.
• Billing: handled entirely by Paddle.com (Merchant of Record, the company that is legally the seller and handles tax). We store only your Paddle customer and subscription identifiers, plan and status — never card numbers.
• Emails: scan alerts are sent through Resend to the address on your account.

How we use it

• To run the scans you request and show you the results.
• To propose corrections: the HTML of an affected element (and, for images, a screenshot of that element) is sent to Anthropic's API to generate a suggested fix. Anthropic does not use API data to train its models.
• To send you alerts when a scan finds new issues (you can stop monitoring a site at any time).
• The security, privacy and legal checks only read what a page already makes public. A check that goes further (for example, testing a database key) only runs once you have verified you own that site and given written authorization for it.

If we scanned your site and you did not ask us to

Anyone can run the free scan on a URL, the same way anyone can open a page in a browser or a search engine can crawl it. If you own a site and do not want it scanned at all, we respect a Disallow rule in your robots.txt file automatically; a scan will not fetch a page your robots.txt blocks. If you want us to stop entirely, even without a robots.txt rule, email hola@rampa.solutions with the domain and we will add it to a do-not-scan list and delete any existing scan of it.

Contacting site owners

When we email you about a scan result, we follow CAN-SPAM (the US law on commercial email): a real reply-to address, an honest subject line, a one-click way to opt out, sent from a company mailbox, never a spoofed address. In the EU/UK, we only email a business contact once, for a relevant reason, and we honor an opt-out immediately.

Sub-processors

Supabase (database and authentication), Vercel (hosting), GitHub (scan workers), Anthropic (AI corrections), Resend (email), Paddle (payments). Each processes only the data needed for its function.

Retention and deletion

Scan history for a monitored site is kept while the site is monitored. Removing a site deletes its scans. Deleting your account deletes everything associated with it. A free scan run without an account (URL, email, report) is kept until you ask us to delete it. We do not yet delete these automatically after a fixed time, so email us if you want one removed sooner. Billing records are kept by Paddle for as long as tax law requires.

Your rights

You can access, export or delete your data at any time from the app or by emailing hola@rampa.solutions. We do not sell personal data and we do not use tracking cookies; the only cookies set are those needed to keep you signed in.

Contact

hola@rampa.solutions — the operator is an individual provider based in Ecuador.