Privacy Policy

1. Who we are

The data controller for personal data processed through Rampsight is Rampsight, based in Belo Horizonte, MG, Brazil. For anything in this policy, contact privacy@rampsight.com.

2. Data we collect

We collect only what the Service needs to work:

• Account data — your name, email address, and password. Passwords are stored only as salted hashes, never in plain text.
• Terms acceptance record — when you accept the Terms of Service (at registration and when joining a team), we record the date, the version of the Terms and the IP address the acceptance came from. This is our proof of the contract and is kept for as long as the account exists.
• Company details — when your agency provides them: legal name, VAT ID, address, country, billing email and phone number. They identify the contracting party on the Terms and the Data Processing Agreement and pre-fill the checkout so invoices carry your legal entity.
• Agency branding — the logo, brand color, and language you configure for white-label reports.
• Operational data — the site URLs you register, the page URLs found while crawling them, scan results (accessibility issues, scores), and the details you enter when generating accessibility statements (such as an organization name and contact email).
• Support communications — emails you send us, and messages sent through the form on our contact page: your name, email address, optional company, the message itself, and the IP address it came from (abuse control). We store the message as well as emailing it so a mail outage cannot lose it, and we keep it for two years so a thread can be picked up later. It is never used for marketing and never shared.
• Free accessibility check — when anyone uses the free scanner at /scan, without an account, we store the address scanned, the result, and the IP address the request came from. The IP is kept to stop abuse of an endpoint that costs us a browser crawl (Art. 6(1)(f) GDPR — our legitimate interest in keeping a free service available). If you ask us to email you a copy of a result, we also store that email address in order to send it (Art. 6(1)(b) GDPR — your request). Agreeing to occasional product emails is a separate, optional tick box (Art. 6(1)(a) GDPR — consent), never pre-ticked. An address that ticked it receives at most three emails over about two weeks, each with an unsubscribe link; unsubscribing stops them immediately. That address is kept for up to 30 days after the opt-in — as the record that you unsubscribed, if you did — and is deleted then. Everything else about a free check — result, IP and the email address a copy was sent to — is deleted 30 days after the scan.

Payments are handled by Creem (Armitage Labs OÜ, Tallinn, Estonia), our merchant of record, which acts as an independent data controller for checkout and billing data under its own privacy policy. We never receive or store your full payment card details. Scan results describe page structure — which rules failed and where — and are not designed to collect personal data from the pages scanned.

3. Cookies — none that track you

Rampsight sets no tracking or advertising cookies and runs no third-party analytics. We use exactly two things in your browser:

• an httpOnly session cookie that keeps you signed in; and
• a small preference that remembers whether your dashboard sidebar is collapsed.

Neither follows you across the web, which is why you will not find a cookie consent banner here — there is nothing to consent to.

4. Legal bases

Under the GDPR, we process personal data on these bases:

• Performance of a contract (Art. 6(1)(b)) — operating your account, running scans, generating reports and statements, sending transactional email.
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse of the scanner, and improving the product based on aggregate usage.
• Legal obligation (Art. 6(1)(c)) — keeping billing and tax records, together with our merchant of record.
• Consent (Art. 6(1)(a)) — only where we explicitly ask for it; we do not send marketing email without an opt-in, and every such email carries an unsubscribe link.

5. Subprocessors

These providers process data on our behalf to run the Service. Customer data lives in the EU:

Creem (payments, as merchant of record) is an independent controller rather than a subprocessor. We will update this table before adding a new subprocessor. Agencies that use Rampsight to process personal data of their own clients are covered by our Data Processing Agreement, which incorporates this list.

6. Retention

• Account and operational data — kept for as long as your account exists, including while it is in read-only mode (after the free trial, or when a subscription is paused or ended).
• Read-only accounts — an account that has been read-only for more than 12 months may be deleted; we email you 30 days in advance so you can export or resubscribe.
• After account deletion — personal data is deleted within 30 days; residual copies in encrypted backups expire within 90 days.
• Free accessibility checks — the result, the address scanned, the requester’s IP address and any email address given are deleted automatically 30 days after the scan. No account is involved and nothing survives that window.
• Contact messages — what you send through the contact form, with the IP it came from, is deleted automatically two years after you send it.
• Billing records — kept as long as tax and accounting law requires, by us and by our merchant of record.

7. Your rights

You can ask us at any time to exercise your GDPR rights over your personal data:

• access a copy of the data we hold about you;
• correct inaccurate data;
• delete your data (“right to be forgotten”);
• receive your data in a portable, machine-readable format;
• restrict or object to certain processing.

Write to privacy@rampsight.com from your account email and we will respond within one month. You also have the right to lodge a complaint with your local data protection authority.

8. International transfers

Rampsight is operated from Brazil, while customer data is stored and processed on servers in the EU (see Subprocessors). Where personal data is accessed from outside the European Economic Area — for example by our team, or by a provider operating globally — we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. Security

We protect your data with measures appropriate to a service of this kind: passwords stored as salted hashes, httpOnly session cookies, encryption in transit (TLS), EU-hosted infrastructure, and access limited to what operating the Service requires. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authority as the GDPR requires.

10. Changes to this policy

We will update this policy when our practices change — for example, when a subprocessor is added. Material changes will be announced by email or inside the product before they take effect. The date at the top always reflects the latest revision.

11. Contact

Privacy questions and data requests: privacy@rampsight.com. General questions: hello@rampsight.com. See also our Terms of Service and Refund Policy.