Last updated: May 22, 2026

This Privacy Policy describes how Inner Spark Media LLC ("Company," "we," "us," "our") collects, uses, shares, and protects your personal information when you use AccessSpark ("Service," "Platform"), including our website, browser extension, and application programming interface (API). By accessing or using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are

AccessSpark is a web accessibility auditing platform operated by Inner Spark Media LLC, a Texas limited liability company. We are the data controller for the personal information collected through the Service.

Contact: support@innersparkmedia.com

2. Information We Collect

We collect the following categories of information:

2.1 Account Information

When you create an account through our authentication provider, we receive and store your name, email address, and profile photograph. If you sign in via Google or GitHub OAuth, we receive only the information you authorize the provider to share.

2.2 Audit Data

When you run an accessibility audit, we collect the URL(s) you submit, the rendered page content necessary for analysis, a screenshot of the audited page, and the resulting audit scores, issues, and reports. If you use the AI Fix feature, we send issue context to our AI provider (Anthropic) and store the returned fix suggestions.

2.3 Browser Extension Data

If you install the AccessSpark Chrome Extension, the extension collects page content and accessibility data only when you explicitly initiate an audit. The extension does not run in the background, does not track your browsing history, and does not collect data from pages you do not audit. Extension audit results are transmitted to our servers over HTTPS and stored in your account alongside server-side audits. The extension stores your authentication token locally in Chrome storage; this token expires after 24 hours.

2.4 Payment Information

Payment processing is handled entirely by Stripe. We do not receive, store, or have access to your full credit card number, bank account details, or other sensitive payment credentials. Stripe provides us with limited transaction information (last four digits of your card, billing address, transaction amounts, and subscription status) necessary for account management. Stripe's handling of your data is governed by Stripe's Privacy Policy.

2.5 Usage and Analytics Data

With your consent, we use Google Analytics (via Google Tag Manager) to collect anonymized usage data, including pages visited, features used, session duration, referring URLs, browser type, operating system, and device type. We do not enable Google Analytics advertising features or cross-site tracking. Analytics cookies are only set after you provide consent.

2.6 Technical and Log Data

Our servers automatically collect certain technical information when you access the Service, including your IP address (which we do not store long-term), browser type and version, operating system, request timestamps, and referring URLs. This data is retained in server logs for up to 30 days for security and debugging purposes, then automatically deleted.

2.7 Communication Data

If you contact us through the in-app help form, we collect your email address, subject line, and message content. If you receive scheduled audit report emails, we track delivery status for troubleshooting purposes.

3. How We Use Your Information

We use your information for the following purposes:

Service delivery: To provide, maintain, and improve AccessSpark, including running audits, generating reports, and delivering AI-powered fix suggestions
Account management: To authenticate your identity, manage your subscription, and process payments
Scheduled audits and notifications: To execute scheduled audits and send you the results via email
Product improvement: To analyze usage patterns, identify bugs, and improve the Service (using aggregated, anonymized data where possible)
Customer support: To respond to your help requests and resolve technical issues
Security: To detect, prevent, and respond to fraud, abuse, and security threats
Legal compliance: To comply with applicable laws, regulations, and legal processes

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for processing your personal information depends on the context:

Contract performance: Processing necessary to provide the Service you signed up for (account management, audits, reports)
Legitimate interests: Processing for product improvement, security, and fraud prevention, where these interests are not overridden by your rights
Consent: Processing based on your explicit consent (analytics cookies, marketing emails). You may withdraw consent at any time
Legal obligation: Processing necessary to comply with applicable laws

5. Cookies and Tracking Technologies

5.1 Essential Cookies

These cookies are strictly necessary for the Service to function. They include authentication session cookies and Cloudflare Turnstile verification tokens. You cannot disable these cookies without losing access to the Service.

5.2 Analytics Cookies

We use Google Analytics cookies to understand how users interact with the Service. These cookies are only set after you provide consent. You can withdraw consent at any time by clearing your cookies or using your browser's cookie management settings. When you decline analytics cookies, no Google Analytics scripts are loaded.

5.3 No Advertising or Third-Party Tracking Cookies

We do not use advertising cookies, retargeting pixels, social media tracking pixels, or any third-party cookies for advertising purposes. We do not participate in ad networks or sell data to advertisers.

6. Data Sharing and Third-Party Service Providers

We do not sell, rent, or trade your personal information to third parties. We share data only with the following categories of service providers, each of which is contractually obligated to use your data only for the purposes we specify:

Provider	Purpose	Data Shared	Privacy Policy
Supabase	Authentication	Name, email, profile photo	supabase.com/privacy
Stripe	Payment processing	Billing info, transaction data	stripe.com/privacy
Google Analytics	Usage analytics (with consent)	Anonymized usage data	policies.google.com/privacy
Cloudflare	CDN, DDoS protection, Turnstile CAPTCHA	IP address, request metadata	cloudflare.com/privacypolicy
Anthropic	AI Fix suggestions	Issue context, code snippets from audited pages	anthropic.com/privacy
Resend	Transactional email delivery	Email address, report content	resend.com/legal/privacy-policy

We may also disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7. Data Retention

Account information: Retained while your account is active, plus 30 days after account deletion to allow for recovery
Audit data: Retained while your account is active. You can delete individual audits or your entire history at any time through the Service interface. Deleted audit data is permanently removed within 30 days
Shared reports: Retained until the sharing link is revoked by you or your account is deleted
Server logs: Automatically deleted after 30 days
Support tickets: Retained for up to 12 months for quality assurance, then deleted
Payment records: Retained as required by applicable tax and financial regulations (typically 7 years)

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

8.1 All Users

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information and account
Export: Download your audit data in a machine-readable format (JSON)
Withdraw consent: Withdraw consent for analytics cookies at any time

8.2 EEA/UK Users (GDPR)

In addition to the above, you have the right to: restrict processing of your data; object to processing based on legitimate interests; data portability (receive your data in a structured, machine-readable format); and lodge a complaint with your local data protection authority.

8.3 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to:

Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
Delete: Request deletion of your personal information, subject to certain exceptions
Opt-out of sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising
Non-discrimination: Exercise your privacy rights without receiving discriminatory treatment

In the preceding 12 months, we have collected the categories of personal information described in Section 2. We have not sold personal information to third parties. We have disclosed personal information to the service providers listed in Section 6 for business purposes.

8.4 How to Exercise Your Rights

To exercise any of these rights, contact us at support@innersparkmedia.com. We will verify your identity before processing your request. We respond to all data rights requests within 30 days (or within the timeframe required by applicable law). If we need additional time, we will notify you of the extension and the reason.

9. International Data Transfers

AccessSpark is operated from the United States. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States. We ensure that any such transfers comply with applicable data protection laws through appropriate safeguards, including standard contractual clauses where required.

10. Data Security

We implement and maintain appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in transit (TLS/HTTPS for all connections)
Secure authentication via OAuth with Google and GitHub
Access controls limiting employee access to personal data on a need-to-know basis
Regular security assessments of our infrastructure
Automated security header analysis as part of our own Service

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

AccessSpark is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@innersparkmedia.com.

12. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. Because there is no industry-standard interpretation of DNT signals, AccessSpark does not currently respond to DNT signals. However, you can control analytics tracking through our cookie consent mechanism as described in Section 5.

13. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us (for example, links within audit results to WCAG documentation). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by posting the updated policy on the Service with a revised "Last updated" date and, where feasible, by sending notice to the email address associated with your account at least fifteen (15) days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Inner Spark Media LLC
Email: support@innersparkmedia.com

We aim to respond to all inquiries within 30 days.