Perceivable. Version of 7 August 2026.
Summary. Perceivable requests read only access to a store’s theme, product records and published content. It holds no permission to access customer records, order records or payment data, and consequently processes no personal data relating to a merchant’s customers.
The controller responsible for the processing described in this policy is Paolo Khoury, 121 rue de Paris, 91120 Palaiseau, France. Enquiries concerning this policy or the exercise of the rights described in section 8 should be addressed to paolok5@hotmail.com.
In respect of data retrieved from a merchant’s store, the merchant acts as controller and Perceivable acts as processor. The processor terms required by Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”) are set out in Annex A to the Terms of Service.
In respect of the merchant’s own account and correspondence, Perceivable acts as controller, and this policy applies directly.
| Category | Purpose | Legal basis |
|---|---|---|
| Store domain and the access token issued by Shopify on installation | Authenticating the merchant and retrieving store data | Performance of a contract, Article 6(1)(b) |
| Theme source files, product records including image alternative text, and published page and article content | Producing the accessibility assessment requested by the merchant | Performance of a contract, Article 6(1)(b) |
| Business name, accessibility contact address and telephone number, and target remediation date, where entered by the merchant | Generating the accessibility statement and evidence report | Performance of a contract, Article 6(1)(b) |
| Storefront password, where supplied by the merchant | Reaching a storefront that is not publicly accessible | Performance of a contract, Article 6(1)(b) |
| Correspondence sent to the support address | Responding to enquiries and maintaining a record of support | Legitimate interests, Article 6(1)(f) |
Perceivable requests the access scopes read_themes, read_products and read_content. It holds no scope permitting access to customers, orders, fulfilment or payment data, and therefore cannot retrieve such data.
Personal data is not sold, rented, or disclosed for advertising purposes. No automated decision making producing legal or similarly significant effects is carried out.
Hosting is provided by Fly.io, Inc. on infrastructure located within the European Union. Subscription payments are collected by Shopify, which acts as an independent controller in respect of that processing. Perceivable neither receives nor stores payment card details.
Notice will be given before any additional sub-processor is engaged, and merchants may object in accordance with Annex A of the Terms of Service.
Personal data is stored within the European Economic Area. No transfer to a third country takes place.
Subject to the conditions set out in Chapter III of the GDPR, you have the right to request access to your personal data, its rectification or erasure, restriction of processing, and portability, and to object to processing carried out on the basis of legitimate interests.
Requests should be sent to paolok5@hotmail.com and will be answered within one month, extendable by two further months where necessary in accordance with Article 12(3). Uninstalling the application results in deletion of the associated data and is the most direct means of exercising the right to erasure.
You also have the right to lodge a complaint with a supervisory authority. In France, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).
Technical and organisational measures appropriate to the risk are applied in accordance with Article 32, including encryption of credentials at rest, transport encryption for all connections, and access controls scoping every record to the store that owns it. The application requests the minimum access scopes necessary for its function.
Where a store has begun a free trial, a single record is kept recording that fact: a one-way SHA-256 hash of the store domain and the date. It contains no store name, no contact details and no assessment data, and it cannot be reversed to identify the store. Its only use is to answer whether that store has already had its free trial.
This record is not deleted on uninstallation or on a shop redaction request, because deleting it would allow the free trial to be taken repeatedly by uninstalling and reinstalling. The legal basis is Article 6(1)(f), the legitimate interest in preventing abuse of a free offer, and the data minimisation required by Article 5(1)(c) is why it is stored as a hash rather than as the domain. Everything else held about the store is deleted as described in section 7.
Sections 1 to 9 concern merchants who have installed the application. This section concerns anyone who simply visits this website, including the free accessibility scan.
No account is required and no email address is requested. When the free scan is used, the store address entered is sent to Shopify’s public Storefront API in order to read that store’s published catalogue, and the result is rendered and discarded. It is not stored, and no record of who scanned which store is kept.
The visitor’s IP address is held in memory only, for at most one minute, solely to apply a rate limit that prevents the scanner being used to crawl other people’s stores. It is never written to disk and never linked to anything. The legal basis is Article 6(1)(f), the legitimate interest in preventing abuse of a public service.
One cookie may be set, named pv, and only while parts of this site are in preview before launch. It records that a preview key was supplied so navigation keeps working, contains no personal data, and is not used for analytics or advertising. There are no analytics, no advertising, no tag manager and no third-party scripts on this site.
Server logs kept by the hosting provider record the usual request metadata, including IP address, for the operation and security of the service.
This policy may be amended. Where an amendment is material, merchants holding an active subscription will be notified by electronic mail, and the version date above will be updated.