This policy explains what personal data MSACAlab collects through corea11y.com, the CoreA11y software and our audit and remediation services, why we collect it, and the choices you have. "MSACAlab", "we" and "us" mean MSACAlab, a business registered in Pakistan. Questions: support@corea11y.com.
The short version
- The CoreA11y plugin does not send your website's content to us. Audits run in your browser and results are stored in your own WordPress database.
- We collect the minimum we need to sell you a licence, support you, deliver an audit and, if you ask, send you product news.
- We don't sell your personal data, and we don't use it for advertising.
What we collect and why
When you visit corea11y.com
- Usage data, only if you agree: pages viewed, approximate location (country or city), device and browser type, and how you arrived. We use Google Analytics to understand which pages are useful. Analytics runs only after you choose "Accept all" (or turn Analytics on) in the cookie banner, wherever you are.
- Server logs: our host records IP addresses and requests to keep the site secure and working. These logs are kept for a short time.
When you sign up for news or a waitlist
- Your email address, which form you used and, on the Downloads page, the platform you chose. We use it only to send what you asked for (product news, or one email when a platform launches). Every email has an unsubscribe link, or you can write to us to be removed.
When you buy CoreA11y Pro
- Payments are handled by Freemius, which sells CoreA11y Pro on our behalf and processes payments, taxes and invoices. Freemius collects your name, email, billing address and payment details; we never see your full card number. Freemius shares with us your name, email, plan, licence, purchase history and the websites where the licence is activated, so we can provide updates and support. See the Freemius privacy policy.
- When you activate a licence, the plugin sends your site address, WordPress and PHP versions and the plugin version to Freemius to check the licence and deliver updates.
When you use the free CoreA11y plugin
- The free plugin includes the Freemius SDK in anonymous mode: no opt-in screen and no data sent. Freemius is only contacted if you open the Upgrade page or buy and activate Pro.
- Audits, reports, settings and change history stay in your own WordPress database. Removing the plugin can delete them (see the user guide).
When you book an audit or remediation, or contact support
- Contact and project details: your name, email, company, the website to be checked and anything you tell us. We use them to deliver the service, send reports and answer you.
- Website access: we test public pages. If you give us a login or staging access, we use it only for the agreed work and ask you to remove it when we finish.
- Emails: we keep support and project emails so we can help you later.
Legal basis
Where data protection laws such as the EU or UK GDPR apply, we rely on: contract (selling licences, delivering services, support), consent (newsletter, waitlist, analytics cookies where required), legitimate interests (keeping the site secure, improving it, answering questions) and legal obligation (tax and accounting records).
Cookies
A cookie is a small file a website stores in your browser. When you first visit corea11y.com we ask which cookies we may use. Until you choose, and if you say no, no analytics or advertising code is loaded at all.
Necessary cookies (always on)
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
corea11y_consent | CoreA11y | Remembers your cookie choice | 6 months |
wordpress_*, wp-settings-* | WordPress | Only if you log in to this site: keeps you logged in | Session to 1 year |
Analytics cookies (only if you agree)
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
_ga | Tells visits apart | 2 years | |
_ga_* | Keeps track of a visit | 2 years |
We use Google Consent Mode, so Google is told whether you agreed. We don't use advertising cookies, and we don't share analytics data with Google for ads.
Changing your mind
- Use Cookie settings (also at the bottom of every page) to turn analytics on or off at any time. If you turn it off, we delete the Google Analytics cookies from your browser.
- If your browser sends a Global Privacy Control signal, we treat it as "no" to analytics.
- We ask again after 6 months, or sooner if we start using new kinds of cookies.
- You can also block or delete cookies in your browser settings.
Who we share data with
- Hostinger (website hosting and email).
- Freemius (sales, payments, licences, invoices).
- Google (Google Analytics).
- Professional advisers and authorities when the law requires it.
These providers may process data outside your country, including in the United States and the European Union. Where required, transfers are covered by the providers' own safeguards, such as standard contractual clauses.
How long we keep it
- Newsletter and waitlist: until you unsubscribe or the waitlist closes.
- Customer and licence records: for as long as you are a customer, then as long as tax and accounting rules require.
- Audit and remediation files: up to 24 months after delivery, unless you ask us to delete them sooner.
- Support emails: up to 36 months.
- Analytics data: 14 months.
Your rights
Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Write to support@corea11y.com. We answer within 30 days. If you are in the EU or UK, you can also complain to your local data protection authority.
Security
We use HTTPS across the site, limit who can access customer data, and use providers with strong security practices. No system is perfectly secure, so please tell us at once if you think your data has been exposed.
Children
Our website, software and services are for businesses and adults. We don't knowingly collect data from anyone under 18.
Changes
We will update this page when our practices change and show the new date at the top. For important changes, we will email customers.