Privacy Policy

This Privacy Policy explains how Inclusive App Craft ("Inclusive App Craft", "we", "us", or "our") collects, uses, shares, and protects personal information when you use Webscan, our accessibility auditing and compliance platform (the "Service"), and this website. It also describes your rights and how to exercise them.

Inclusive App Craft is based in Accra, Ghana. We are the data controller responsible for the personal information processed through the Service. Our contact details are set out in the "Contact us" section below.

1. Scope of this policy

This policy applies to visitors of our website and to registered users of the Service, including account holders and members of the organisations that use Webscan. It does not apply to third-party websites that you choose to scan with the Service, which are governed by their own privacy policies.

2. Information we collect

We collect the following categories of information:

Account and profile information

When you register, we collect your name, email address, and a securely hashed password. We never store your password in plain text. We also record the organisation memberships and roles (owner, administrator, auditor, developer, or viewer) that determine what you can access.

Workspace content

As you use the Service, we store the organisations, projects, websites, scans, findings, manual audit results, remediation issues, comments, journeys, reports, and related records that you and your team create. This content is confined to your organisation and is not shared with other tenants.

Scan targets and results

When you queue a scan, we store the target website addresses you provide and the results our scanner produces, including rendered page URLs, accessibility findings, affected page elements, screenshots or HTML snippets used as evidence, and behavioural observations captured during automated journeys.

Authentication credentials and access tokens

If you configure authenticated scanning, we store the browser session state needed to sign in to your own target website. If you connect a source-code repository, we store the access token you provide. This sensitive material is encrypted at rest and is decrypted only in memory, momentarily, when a scan or remediation task needs it. We do not display these secrets again after you enter them, and we exclude them from normal application logs.

Technical and usage information

Like most online services, our servers automatically record limited technical data such as your IP address, browser type, request times, and error diagnostics. We use this information to operate, secure, and troubleshoot the Service.

Cookies

We use a small number of strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. These cookies are essential to the operation of the Service and cannot be switched off through the Service. We do not use advertising or third-party tracking cookies.

3. How we use your information

• To create and administer your account and organisation workspace.
• To provide the Service: running scans, storing evidence, managing audits and remediation issues, generating reports, and monitoring for regressions.
• To secure the Service, prevent abuse, and enforce our Terms of Service.
• To communicate with you about your account, security matters, and material changes to the Service.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

4. Legal bases for processing

Where the law requires a legal basis, we rely on the following: performance of our contract with you to provide the Service; our legitimate interests in operating, securing, and improving the Service in a way that does not override your rights; your consent, where we ask for it; and compliance with legal obligations.

5. AI-assisted features

Webscan can generate advisory drafts, such as explanations, remediation suggestions, alternative-text proposals, and summaries. By default these drafts are produced by a deterministic, offline template engine, and no data leaves our systems. If an administrator of your organisation enables an external AI provider, a bounded snapshot of the relevant accessibility evidence is sent to that provider to generate a draft. Generated drafts are always advisory, are recorded with their provenance, and require human approval; they never automatically change your data or assert legal conformance.

6. How we share information

We do not sell your personal information. We share information only in these limited circumstances:

• Within your organisation. Content is visible to other members of your organisation according to their assigned roles.
• Service providers. We use infrastructure and processing providers that host the Service on our behalf under appropriate confidentiality and data-protection commitments.
• Optional integrations you enable. If your organisation enables an external AI provider, evidence snapshots are processed by that provider. If you connect a code repository (for example, GitHub), we interact with that provider using the token you supply. These providers process data under their own terms and privacy policies.
• Legal and safety reasons. We may disclose information where required by law, to enforce our terms, or to protect the rights, safety, and security of our users, the public, or Inclusive App Craft.

7. International data transfers

We are based in Ghana and may process information there or in other countries where our service providers operate. Where personal information is transferred across borders, we take steps to ensure it remains protected in accordance with applicable data-protection law.

8. Data retention

We retain your account and workspace information for as long as your account is active and as needed to provide the Service. We retain records longer only where necessary to comply with legal obligations, resolve disputes, or enforce our agreements. When you delete content or close your account, we delete or anonymise the associated personal information within a reasonable period, subject to backups that are cycled out over time.

9. How we protect your data

We apply technical and organisational safeguards designed to protect your information, including strict separation of each organisation's data, enforcement of access boundaries in our application logic rather than by hiding interface elements, encryption of sensitive credentials at rest, protections against server-side request forgery when scanning, and secure production configuration. No system can be guaranteed perfectly secure, but we work continuously to protect your information and to respond promptly to security issues.

10. Your rights

Subject to applicable law, including the Ghana Data Protection Act, 2012 (Act 843), you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Object to or request restriction of certain processing.
• Request a copy of certain information in a portable format.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us using the details below. We may need to verify your identity before responding. You also have the right to lodge a complaint with the Data Protection Commission of Ghana.

11. Your responsibilities when scanning websites

The Service is a tool for auditing websites that you own or are authorised to test. You are responsible for ensuring you have the necessary rights and permissions before scanning any website, and for the lawful handling of any personal data contained in the pages you choose to scan. Please see our Terms of Service for full details.

12. Children's privacy

The Service is intended for use by organisations and professionals and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

Data protection registration

Inclusive App Craft is in the process of registering as a data controller with the Data Protection Commission of Ghana under the Data Protection Act, 2012 (Act 843). Once registration is complete, our registration details will be published here. In the meantime, you can contact us using the details below for any data-protection query.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date shown at the top of this page. Material changes may also be communicated through the Service. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy.

14. Contact us

If you have questions about this policy or wish to exercise your rights, please contact us:

Inclusive App Craft
Information Technology Directorate, ATL Building
University of Ghana, Legon
Accra, Ghana
General enquiries: [email protected]
Data protection contact: [email protected]

Accessibility auditing browser extension

We offer an optional browser extension, the Webscan Session Recorder, that an auditor may install to record a real browsing session for accessibility review. This section explains its data handling.

What it captures

Only while you have pressed Start, and only on the specific website you grant it access to, the extension records interaction events: clicks, focus changes (including automatic or programmatic focus), navigation, key presses limited to non-character control keys (such as Tab, Enter, and Escape), and accessibility-significant page changes (such as alerts, status messages, and dialogs).

What it never captures

The extension does not record typed text or credentials. Printable characters you type are dropped, and the values and labels of password, card, and other sensitive fields are redacted in your browser before anything is transmitted.

Where the data goes

Captured events are sent only to the Webscan address you configure, authenticated by the session token you provide. They are not sent to any third party or to the extension's authors. You can stop recording at any time to end capture, and the extension requests access only to the site you are auditing — it holds no standing access to the rest of your browsing.