Privacy notice

Controller

The controller is Us NV , VAT BE0669.636.926 , KBO 0669.636.926 , Veldkant 33A, 2550 Kontich. You can reach us at dev@mail-us.be.

Purposes and lawful bases

• Account. We process your email, hashed password, name, and optional contact details to create and run your account. Lawful basis: performance of a contract.
• Lead / contact request. We process the details you send on a contact form to reply about WCAG services. Lawful basis: legitimate interest in answering a request you initiated; we also store the privacy-notice version shown at that time.
• Billing. We process customer type, company name, VAT number (if given), and payment records to invoice, collect tax, and keep accounting records. Lawful basis: legal obligation (tax and bookkeeping) and contract.
• Scans and reports. We process the URLs you submit, scan results, and usage so we can run the service you asked for. Lawful basis: contract.

Retention

• Accounts: until you delete the account, then up to 30 days for residual copies to drain from backups.
• Leads: 12 months after the request.
• Guest scan data (teaser token, 1-page snapshot): 30 days.
• Invoices and payment records: 7 years.

Recipients and subprocessors

We use hosting and processors listed at /legal/subprocessors: OVH (VPS), the Postgres host, an SMTP provider for transactional mail, Stripe for payments and tax, Cloudflare Turnstile when captcha is enabled, Anthropic for optional WCAG write-ups, and Atlassian when you connect Jira. Typefaces are self-hosted; we do not send font requests to a third-party font CDN.

Transfers outside the EU

Some processors (including Stripe, Anthropic, Atlassian, and Cloudflare) may process data in the United States or other third countries. Where that happens we rely on an adequacy decision or Standard Contractual Clauses plus the processor’s documented safeguards.

Your rights

You may access, rectify, erase, restrict, or port your data, and object to processing based on legitimate interest. Exercise these rights by emailing dev@mail-us.be. You also have the right to lodge a complaint with the Gegevensbeschermingsautoriteit (Data Protection Authority), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be.