1. Controller

The controller is GE-KO, spletne storitve in grafično oblikovanje, Maja Dolžan s.p., Cesta Toneta Tomšiča 71, 4270 Jesenice, Slovenija, Slovenia, registration number 8732043000. For privacy questions and to exercise your rights, write to info@ge-ko.si.

2. Free analysis and accessibility check

We store the submitted URL, the analysis result, the language, and your IP address together with the country derived from it. The IP address is used to prevent abuse (at most 10 analyses per hour) and is deleted after 30 days; the country is kept for statistics. Legal basis: legitimate interest (secure operation of a free tool).

Results are available to anyone with the report link. Result pages are excluded from search engine indexing (noindex), but this is not access control: share the link only if you want others to see the result. Analyses are deleted 24 months after they are created; the result link then stops working.

Accessibility check (where included): the result also contains the Lighthouse score, automated rule identifiers, WCAG criteria, priorities and limited technical details of affected elements, namely a CSS selector without attribute values, the HTML tag reduced to its name, id and class, and a short visible label of the element. Before storing them, we mask e-mail addresses and phone and other long numbers in labels, and the values of parameters such as tokens, sessions and e-mail addresses in URLs. Even so, in individual cases these details may contain personal data from the checked public page. We do not create or store screenshots for the accessibility check.

We process these data to prepare and display the informative check you requested and to prevent abuse. The legal basis is legitimate interest (Article 6(1)(f) GDPR: operating and protecting a publicly available tool) and, for a paid order, also the performance of the contract (Article 6(1)(b) GDPR). Personal data of third parties that appear on a checked page are used only to the extent needed to show the issue clearly. If your data appear on a page that someone has checked: the source is that publicly accessible page, submitted by a user of the tool; the categories are what the page itself shows (for example names, contact details or quoted text); we keep them only as described in this point, and you can object or ask for erasure at any time (point 8). Informing each such person individually is not possible without disproportionate effort, which is why we provide this information here (Article 14(5)(b) GDPR).

Element details (selectors, labels, snippets and examples) are deleted automatically: after 90 days for a free analysis and after 12 months in a Site Report. The score, the rules and the number of affected elements remain part of the result. Contact details and texts about people that the analysed page contains (e-mail addresses, phone numbers, quoted reviews, a short text excerpt and lists of form fields), are used by the analysis only while it runs and are not stored with the result.

We check publicly available pages. Do not submit private or signed-in URLs, links with secret tokens or addresses that contain personal data. Parameters with known sensitive names (for example token, session, password, email) are removed automatically from a submitted URL before the page is checked; data in the URL path itself cannot be recognised reliably. The analysis and the Site Report refuse addresses on social networks and profile platforms: they are pages about people, not websites to check.

Score badge: if you embed the badge from the result page, your visitors' browsers load a small image from our server. We set no cookie for it, do not count it in our visit statistics and do not store the visitor's IP address ourselves; like any web server, our server may technically log requests (IP address, time) for security and operation. The badge address contains the link to your result, so embedding it makes that result visible to anyone who reads the source of your page.

AI crawler checker: we fetch the robots.txt of the domain you enter (and look for llms.txt and the sitemap) and keep the result for one hour so the same domain is not requested repeatedly. To prevent abuse we count checks per visitor using a keyed hash of the IP address, not the address itself; this hash is deleted within one day. The domain you enter is not linked to you.

Meta tag checker and canonical & hreflang checker: we fetch the page you enter (the hreflang checker also up to 10 of its language versions and its canonical URL) and keep the result for up to one hour. Abuse protection works as for the AI crawler checker, with a keyed hash of the IP address deleted within one day. The address you enter is not linked to you.

PageSpeed Insights also returns small images of how the page loads (thumbnails of the mobile view); we store them with the analysis, show them in the speed section and delete them after 90 days, because they can show people on the page. The Site Report additionally contains a screenshot of the homepage (point 4).

3. Inquiries

If you send an inquiry we process your name, e-mail, phone (optional), message, the related analysis, language, IP address and country. We use them only to reply and, if requested, to prepare a GE-KO quote (steps prior to a contract). Inquiries are deleted 24 months after they were sent; if a contract follows, GE-KO keeps the correspondence with the contract records. The IP address is deleted after 30 days and is not included in the e-mail we receive about your inquiry.

4. Purchases

For purchases we process your e-mail, the website checked, language, package, amount, billing country, Stripe payment identifiers, the time and wording of the consent under section 7 of the terms, and the IP address (for 30 days, to prevent abuse). We need these to perform the contract, deliver the report and e-mails, and meet legal obligations; checkouts that were not paid are deleted after 30 days. For a paid order we keep the report with its web, PDF and CSV versions, your e-mail address and the checked website for 24 months after the purchase (access is promised for at least 12 months) and then delete them. The transaction record (package, amount, time, Stripe identifiers and the accepted terms) is kept for 10 years after the purchase because of accounting and tax rules and as proof of the contract.

Payment data (e.g. card numbers) is processed by Stripe; we never see it. As merchant of record, Stripe processes data for VAT and invoicing as an independent controller under its own privacy policy (stripe.com/privacy). Stripe's transfers outside the EEA rely on the EU–US Data Privacy Framework and standard contractual clauses; details are in its privacy policy and data processing agreement (stripe.com/legal/dpa).

When checking your website, our crawler only visits publicly accessible pages. The report may contain public information from your site (e.g. page titles and a screenshot of the home page).

The accessibility check in a Site Report follows the rules in point 2: limited element details, no screenshots for this purpose, and element details deleted after 12 months. A re-check may compare newly detected, persisting and fixed findings. The results are not a legal certificate of conformity. The provisions on payments and on keeping accounting records above remain unchanged.

5. Cookieless visit statistics

For internal statistics we count page views without cookies. We store the page, language, traffic source (e.g. a search engine), device type and country. We do not store IP addresses or browser details: a visitor is counted with a one-way hash of the IP address and browser string combined with a random key that is replaced and deleted every day. While the key exists (one day) this value is pseudonymous; once the key is deleted it can no longer be linked to an IP address, across days or to you. The data is kept for 25 months. Legal basis: legitimate interest (understanding how the tool is used). We also keep anonymous daily totals of completed tool checks and viewed analysis reports (date, tool, language and page type only, no address, IP or browser details, bots not counted).

6. Cookies

We only use one strictly necessary session cookie (sitequiry_session) for form security and the operation of the site; scripts cannot read it, it is sent only over HTTPS and it is deleted when you close the browser. There are no advertising, analytics or tracking cookies, so no cookie consent is needed.

7. Processors and recipients

We do not sell personal data. We only share it with providers that help us run the service:

a server in Slovenia, provided by G-SERVER d.o.o. and run by us as part of our hosting service eStrežnik: the website, the database and the sending of e-mails (order confirmations, reports and inquiries);
Stripe Payments Europe, Ltd., Ireland – payments, VAT and invoices (independent controller, see section 4);
Google LLC (PageSpeed Insights/Lighthouse) – receives the URLs of the pages we analyse, loads those public pages itself and processes the data as an independent controller under the Google APIs Terms of Service and its controller data protection terms. Google LLC is certified under the EU–US Data Privacy Framework, which covers the transfer to the United States. A URL can contain personal data (for example in the path or parameters), so do not submit links with such data; known sensitive parameters are removed before sending. We do not send data from the inquiry form or payment data to Google.
The country is derived from the IP address locally with the DB-IP Lite database; nothing is sent to anyone.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interest. Send your request to info@ge-ko.si; we reply within one month at the latest.

You may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or with the supervisory authority in your country.

If a report or part of it contains your personal data (for example from your website), write to us at info@ge-ko.si. We will review the request and, where there are grounds for it, delete the data or restrict their further display. We do not need any additional personal data from you for this beyond what is necessary to handle the request. The right to object is particularly relevant where processing is based on legitimate interest.

9. Security

Connections are encrypted (HTTPS), the administration is protected, and links to results and orders are unguessable. The server and database are in Slovenia; fonts and other files are served from our own server, so your browser does not contact third-party servers. Server access logs (IP address, time, requested address) and backups are deleted after 30 days at the latest.

We store only the element details needed to show an issue clearly; the masking described in point 2 happens before storage. A publicly accessible result link does not mean that the data in it are anonymous.

10. Changes

We may update this policy; the effective date is shown at the top.

Privacy policy