Privacy notice

The controller is Nimavera Inc. (in formation), operating Reachcanon. Write to support@reachcanon.com for anything in this notice, including a request to exercise your rights. No data protection officer is appointed; the operator handles these requests directly. For the data in your workspace — the sites, team and scan credentials you add — your organisation is the controller and Reachcanon is its processor, under the data processing agreement.

A postal address for service of notice is available on request at support@reachcanon.com.

Account data: your email address, your name if you give one, a hashed password, your role, and your organisation; if you turn on two-step verification, the authenticator key (encrypted) and your recovery codes (stored only as hashes). Usage data: the sites you add, the scans you run, and an audit record of state-changing actions with the IP address they came from. Scan data: the URLs fetched, the HTTP status observed, page titles, and for each finding the rule, the criterion, the clause, a CSS selector, and a truncated HTML snippet.

The HTML snippet is capped at 600 characters and exists so an element can be found again after a redesign. Reachcanon does not store page content beyond that, does not take screenshots, and does not record video of your site.

Account and usage data are processed to perform the contract you enter when you create an account (Article 6(1)(b) GDPR). The audit log and the IP addresses in it are processed on the basis of legitimate interests (Article 6(1)(f)) — specifically, being able to reconstruct who changed what, which is both a security necessity and the evidentiary value of the product. Scan data is processed to perform the contract.

Scans, findings and statements are kept until you delete the site they belong to, which deletes them. Audit entries outlive the account they refer to, because a record of who decided what is only useful if it cannot be removed by the person who decided; the user row is retained in deactivated form so those entries keep pointing at a real person. Backups are kept for fourteen days and then pruned.

The sub-processors are listed on a page of their own, with what each one receives. Reachcanon sends nothing to an AI model: findings, suggested fixes and statement drafts come from rule checks and fixed templates, so your content is not used to train any model. No personal data is sold, and none is shared for advertising.

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Every scan exports as CSV or JSON from inside the product at any time, which covers portability without a request. If you believe your data has been mishandled you may complain to your national supervisory authority; in Spain that is the Agencia Española de Protección de Datos.

The application and database run on servers in the European Union. Where a sub-processor is established outside the EU, the transfer relies on the European Commission's standard contractual clauses. The sub-processor page says which ones those are.