Privacy policy
Last updated:
Operational statistics
Orvel records operational events such as sign-in outcomes, completed operations, checkout progress, safe error categories and response times in its private product dashboard. Optional identifiers are pseudonymised separately for each product; they do not contain your email. These events are kept for up to 90 days, with scheduled deletion. They exclude passwords, tokens, invoice or CSV contents, raw URLs and IP addresses. No advertising cookies are added. Contact privacy@orvel.dev about these records.
The data controller is Antoine LE BORGNE, Entrepreneur individuel, trading as Orvel, reachable at privacy@orvel.dev. Publisher identity: studio legal notice. This policy covers the Access Record service and the access.orvel.dev website.
Scans may retain a private homepage viewport screenshot for 90 days. A minimal domain trial-use record remains after account deletion to prevent repeat free trials.
Data we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Account creation, sign-in, password recovery, service notifications | Contract | Life of the account, then 3 years |
| IP address, browser | Sign-in security, rate limiting | Legitimate interest | 30 days |
| Audited domains, scan results | Providing the service, compliance file history | Contract | Life of the account |
| Entity name, published contact | Generating and publishing the accessibility statement | Contract | While the statement is published |
| Billing data | Payment, invoices, accounting obligations | Legal obligation | 10 years |
Scans only cover the public pages of the site you register. We collect no data about that site’s visitors. HTML snippets kept in the results are limited to the failing element.
Processors
- Railway: Application hosting and database (USA).
- Stripe: Payments, invoices and subscriptions (USA / Ireland).
- Resend: Transactional email (sign-in links) (USA).
Transfers outside the EU rely on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU–US Data Privacy Framework. Card details are handled directly by Stripe; we never see them.
If you choose Google, we receive your verified email and a stable Google account identifier. We request no Gmail or Drive access. The identifier and any password hash are kept for the life of the account and removed with it. Google applies its own privacy policy.
Shared sign-in is managed by Orvel Accounts. Access Record receives your stable Orvel identifier and verified email; passwords are verified by Orvel Accounts. Deleting an Access Record workspace does not automatically delete your Orvel account or other products’ workspaces.
Cookies
The ar_session cookie keeps the Access Record session for eight hours after Orvel sign-in. Older email-link sessions may last up to 30 days until replaced when the account is linked. The temporary __Host-ar_orvel cookie protects the sign-in return and expires after ten minutes. Orvel Accounts manages its own session on accounts.orvel.dev for up to 30 days. The ar_google cookie used by the older Google flow expires after ten minutes. These cookies are used only for authentication. No advertising cookies.
Your rights
You can access, rectify, erase, restrict, object to and port your data. Write to privacy@orvel.dev; we answer within one month. You may lodge a complaint with your supervisory authority (in France, the CNIL, cnil.fr).
Security
Argon2id password hashes, optional Google sign-in, single-use sign-in and password-recovery links valid 15 minutes, hashed tokens, TLS in transit, database access limited to the application and authenticated administration.