Privacy policy
The short version. We never record your IP address. We set no cookies and load no third-party advertising or analytics scripts. We do count visits, using our own code and a random number that dies with your browser tab — which is why there is no consent banner on this page. If you run a free scan we keep the URL you submitted, and your name and email if you gave them, so a person can reply to you. Email us and we will delete it.
Who we are
Mend Access is a website-accessibility remediation practice operated by Parveen Sharma. No company has been incorporated for it yet; if that changes we will update this page. You can reach us at parveen@mendaccess.com about anything on this page, including a deletion request.
What we collect, and when
When you run a free scan or use a form on this site
Submitting either form on this site sends us a single record containing:
- the URL you typed, and the summary result of scanning it (risk score, issue counts, the top issue found);
- your name and email address, if you chose to give them, and whether you ticked the consent box;
- the host name of the page that referred you (for example
google.com) and any campaign tag in the link you followed; - a two-letter country code and a coarse device class
(
desktop,mobileorbot), derived by our host from the request; - a timestamp and a random identifier for that submission.
We do not collect your IP address. Our capture code has no field for one and our intake refuses any record that carries one, so there is no copy of it for us to lose, sell or be compelled to hand over.
When you email us
We keep the email, because that is how a conversation works. It sits in a normal mailbox until you ask us to delete it.
When we do work for you
To remediate a site we generally need access to your theme or a staging copy. We take the narrowest access that lets us do the job, we do not use it for anything else, and we ask you to revoke it when the engagement ends. Anything we learn about your business in the course of the work stays confidential.
Cookies, analytics and tracking
This site sets no cookies and includes no third-party analytics, advertising or social scripts. There is nothing to consent to and no banner to dismiss, which is deliberate.
We do count visits, with a small piece of our own code that runs on this site and sends nowhere else. We said we would name it here before turning it on, so: it is called mend-px, we wrote it, and this is exactly what it does.
- It gives your tab a random number, kept in
sessionStorage. That is not a cookie: it is scoped to this one tab, it is erased when you close the tab, and it cannot be read by any other site. We cannot tell that two visits came from the same person. - Once, as you leave, it sends us: that random number, which pages you opened, which of a fixed list of actions you took (opened the pricing section, submitted the scan form, clicked an email link), roughly how long you stayed, the host name of the site that referred you, any campaign tag in the link you followed, whether your window was phone-, tablet- or desktop-sized, and a two-letter country code from our host.
- It never sends your IP address, and we never store one. It builds no profile, follows you to no other site, and is shared with nobody.
- Turn JavaScript off and none of it runs — the site works exactly the same.
One more thing that is not tracking: the scan-result page stores your own scan
record in your browser's localStorage if our mail server was
unreachable when you submitted it, so the browser can retry delivery on your next
visit and your enquiry is not silently lost. It contains only the record described
above, it never leaves your browser except to come back to us, and clearing site
data removes it.
If we ever add anything else we will name it here before we turn it on, and it will be a privacy-preserving one that does not build profiles of visitors.
Why we are allowed to hold it
We hold scan and contact records because you asked us to do something for you and we need them to do it and reply. We send marketing email only where we have a lawful basis to and where you can opt out in one click; every commercial email we send carries our postal address and an unsubscribe path, and we honour opt-outs permanently.
Who else sees it
A short list, and we do not add to it quietly:
- Our hosting provider (currently Vercel) runs this site and the scan endpoint and therefore processes requests to it.
- Our email provider (currently GoDaddy) carries mail to and from us.
- Nobody else. We do not sell, rent, or share personal data with advertisers, data brokers or "enrichment" services, and we do not buy your data from them either.
If a law required us to disclose something we would comply, and we would tell you unless we were legally forbidden to.
Where it is kept, and for how long
Records are held in our mailbox and in systems we run ourselves. We work from India and our hosting and email providers are US companies, so your data crosses borders in the ordinary course of us reading it. We keep scan and enquiry records for as long as there is a live conversation and for up to 24 months afterwards, then delete them. Individual visit records are deleted after 180 days, after which only anonymous daily counts remain. Records tied to paid work are kept as long as we need them for the engagement and for any tax or record-keeping obligation that applies.
What you can ask us to do
Regardless of where you live, email parveen@mendaccess.com and we will:
- tell you what we hold about you;
- correct anything that is wrong;
- delete it, unless we are legally required to keep it;
- stop emailing you, permanently;
- send you a copy in a portable format.
We aim to answer within five business days and will not charge you for it. We are a small practice: we are describing what we will actually do, rather than claiming certification under any particular privacy regime.
Security, honestly
The site is served over HTTPS, scan records are signed so they cannot be forged in transit, and access to client systems is limited to the person doing the work. We are not going to claim a security certification we do not hold. If you need a specific control for your own compliance programme, ask before you engage us and we will tell you plainly whether we have it.
Children
This is a business-to-business service and is not directed at children. We do not knowingly collect data about them.
Changes
If this policy changes materially we will update the date at the top and, where we have your address and the change matters to you, tell you directly.