Privacy

1. What this covers

This policy covers the limena platform, the limena app for Shopify, the free test, and this website. It does not cover the sites and documents you point limena at, which remain yours.

limena Technologies Inc. is the controller of the personal information described here, and its registered office and contact details are at the end of this page. Canada's federal privacy law applies to it. Where you are somewhere with its own rules, the rights in section 10 are honoured regardless of where you are.

This policy was written by working through the code and the database rather than from a template. Everything below is something we can point at in the system. Where a commitment is not enforced by anything yet, the section says so instead of implying it is.

2. What we collect

From your account

• Identity: your name, work email, organization, and role, as you provide them.
• Workspace data: the programmes you create, the products you bring under governance, and your team's roles.
• Billing details, handled by our payment processor.
• An audit trail of changes inside your workspace: what changed on a finding, who recorded a verdict, and when. We do not record who read something, and we do not record exports.

From the products you test

• Page markup and screenshots, kept as the evidence behind each finding. A screenshot is a full-page image of the page as it rendered. If you test a page while signed in, whatever that page was showing at the time is in the image and in the markup, including any real customer data on screen. We do not detect or mask personal data in evidence. This is why we recommend a dedicated test account with representative permissions rather than a real user account.
• Uploaded documents, in the formats you submit them.
• Findings and verdicts, including who signed off and when, because that record is the point.
• A captured browser session for authenticated testing, encrypted before it is stored and decrypted only on our servers when a scan runs.
• A single site gate password, if you choose to give us one. Some sites sit behind one field: a Shopify storefront password, a basic-auth wall, a one-field staging login. If you configure one, we store it encrypted and submit it to reach the page. We do not ask for and do not accept credentials for your internal systems, your identity provider, or a real user account. Earlier versions of this site said we never accept a password of any kind. That was wrong, and this is the correction.

From this website

• No cookies. This site sets none, and neither does the signed-in console. Your sign-in session is held in your browser's local storage instead.
• No analytics, no tag manager, no session recording, no advertising identifiers, on either surface.
• One third-party request: our typefaces are served by Google Fonts, which means Google receives your IP address and browser user agent when a page loads. It sets no cookie. We intend to serve the fonts ourselves and remove this.
• If you arrive with a partner referral code in the URL, we hold that code in your browser until sign-up so the referral is attributed, then remove it. It is not shared with anyone else.

From a LinkedIn lead form

• If you submit a lead form on one of our LinkedIn ads, LinkedIn passes us the fields you confirmed before submitting: your name, work email, job title, and company. They come prefilled from your LinkedIn profile. We receive only those fields, not the rest of your profile, and only after you press submit.
• We use them to reply to you about limena and for nothing else. They are not sold, not enriched against other sources, and not added to any list you did not ask to be on.
• We do not run LinkedIn's Insight Tag or any other advertising pixel. The form is hosted by LinkedIn, so nothing is set on this site and section 8 stays true: still no cookies, still no advertising identifiers here.
• LinkedIn holds its own copy under its own policy, which we do not control. Deleting your details from us does not delete their copy, and their retention is set by them.

From the free test

• The address you asked us to test, and the result.
• Your IP address, used to rate limit the endpoint so it cannot be used to hammer someone else's site.
• Your email address, only if you choose to enter one to receive the result.

An earlier version of this page said free test inputs were processed in memory and never retained. That was not true. They were written to the same tables as any other scan, and nothing deleted them. Section 6 states what is kept and for how long.

3. Shopify store analytics

If you install limena in your Shopify admin, limena reads your store's aggregate performance for the last 30 days while you are looking at a finding.

What is read: total sales, order count, average order value, sessions, conversion rate, and the session counts at each step of the checkout funnel, meaning sessions that added to cart, reached checkout, and completed checkout. Currency, so the number can be formatted. That is the complete list.

What is not read: no individual shopper, no customer record, no order, no email address, no name, no address, no payment detail. Nothing that identifies a person passes through this at all. The figures are store totals.

How it is handled: the request goes to Shopify when you open the screen, the numbers come back, they are rendered, and that is the end of them. They are not written to our database, not written to a log, and not retained anywhere. Close the screen and there is nothing left. If your Shopify permissions do not allow the read, the screen simply does not show the section.

Why we read it at all: it is the difference between "this button fails contrast" and a number a business will act on. An accessibility finding on its own competes for engineering time against every other ticket and usually loses. Next to it, "4,000 sessions and 420 of them added something to a cart in the last 30 days, and this finding is on that path" tells you what the queue should look like. That is the argument that gets accessibility funded, and it is why the section exists.

What we will not claim: that a finding caused a sales result. We show store scale alongside a finding so you can prioritize. That is correlation for the purpose of ranking work, not proof of cause, and the product says so on the screen itself.

4. AI processing

limena uses AI to explain findings and draft fixes, which means the relevant element and its surrounding context are sent to a model provider. We use enterprise API tiers with training disabled by contract: your content is not used to improve any model, ours or the provider's. Our sub-processor list is available, and existing customers are notified before it changes.

If you supply your own model provider key, it is stored against your workspace and used only to make those calls on your behalf.

AI explanations can be disabled per workspace. Detection, routing, and evidence all continue without them.

AI never signs off conformance. A judgment call is always recorded against a person.

5. Where your data lives

Your database records and uploaded files sit with our managed database and storage provider. Our application and API run on our hosting provider's platform. The browser that performs a scan runs in a managed container service. Model API calls go to the provider you or we have configured. These providers are named in our sub-processor documentation, which is available on request.

Data residency is available as a contractual commitment on the Enterprise plan. The residency of the underlying hosting is a configuration held with those providers rather than something visible in our own code, so we state it in that documentation, where it can be checked against the provider's own records, rather than asserting it here.

6. How long we keep it, and what enforces that

A retention period that nothing enforces is not a retention period. Each item below names the mechanism. A daily scheduled job carries out the deletions marked as enforced by it.

Enforced on a schedule

• Evidence behind a finding, meaning page markup and screenshots: 12 months. The clock starts when the last finding that rests on that evidence is closed, whether that closure was a fix, an accepted risk, or a false positive. A finding awaiting verification counts as open, because that evidence is the "before" half of the comparison. At 12 months the markup, the screenshots, and the accessibility tree snippets are stripped from the record and the image files are deleted. The finding, the verdict, the counts, and the dates remain, because those are the compliance trail and are covered by the next line.
• Captured session for authenticated testing: 30 days maximum. Deleted 30 days after it was last updated, whether or not it has expired. You can revoke it sooner.
• Free test: the IP address for one hour, the scan itself for at most seven days. The IP is held only long enough to rate limit the endpoint, then removed from the record. The scan and its result are deleted 24 hours after the result is first shown, so a link you open later that day still works, and in any case within seven days. The rate limiting ledger, which holds an IP and the host that was tested, is kept for 24 hours.
• API key usage log: 30 days. Endpoint, method, and response status per call.
• Expired sign-in grants and refresh tokens: removed once expired.

Kept until you or we act, with no timer

• Findings and verdicts: the life of the account. They are the compliance trail. This is deliberate, not an omission.
• Workspace audit history: the life of the account. Nothing expires it. It is not exportable yet, and it covers changes rather than reads.
• Uploaded documents: until the workspace is deleted. Deleting the workspace removes the records immediately and queues the stored files for deletion. There is no per-document delete in the product yet. Until there is, ask us and we will remove a specific document.
• A site gate password and any crawler credentials you configure: until you remove them or close the account. They are encrypted the whole time they are stored, but nothing expires them on a timer. We have not set a period for these because we would rather name the gap than publish a number nothing honours.
• Contact and sign-up records, such as a guide download or a partner enquiry: kept until you ask us to delete them. No automatic period is set.
• LinkedIn lead form submissions: kept until you ask us to delete them. No automatic period is set. Write to privacy@limena.app and we will remove yours, and stop emailing you, without asking why.

Logs

Our scan worker logs the host it visited and nothing more of the address. Paths, query strings, and fragments are stripped before anything is written, and no credential, session, or cookie is ever logged. Our platform providers also keep their own operational logs of requests to our application, which will contain the hostname of a site that was tested. Those logs are held under the retention setting of our plan with each provider, which is theirs to define and ours to disclose once we have confirmed it. We have not confirmed it yet, so we are not going to print a number here.

Backups

Deletion removes data from the live system. It does not reach into a backup that was taken before the deletion.

Our database is backed up once a day, and the seven most recent daily backups are kept. Point-in-time recovery is not enabled, so the smallest unit we can restore is a whole day. In practice this means every period stated above is the period in the live system, and a copy may persist in a backup for up to seven further days before it ages out. If you ask us to delete something and you need that confirmed all the way through, tell us and we will confirm once the last backup containing it has expired.

Backups are taken and stored by our hosting provider. Their encryption is the provider's to implement and attest, and it is not something we can verify from our own systems, so we rely on it rather than claim it. We do not hold or manage a separate copy of your data anywhere else.

7. Encryption

In transit: every connection to limena is HTTPS, plain HTTP is redirected before any of our code runs, and both limena.app and the console send a strict transport security header. Connections between our application and our database run over TLS 1.3.

At the application layer: captured browser sessions, site gate passwords, and crawler credentials are encrypted with AES-256-GCM before they are written. The key lives in our application environment and is never stored in the database, so a copy of the database on its own does not yield those values. They are decrypted only on our servers, only when a scan needs them, and are never returned to a browser.

Evidence files: screenshots and uploaded documents are held in private buckets. There is no public URL. Every read goes through our application, which checks your workspace membership and issues a short-lived signed link.

At rest, below the application: our database and file storage sit on managed infrastructure whose disk encryption is our provider's to implement and attest. We can tell you that we rely on it. We cannot verify it from our own code, and this page will not assert something we cannot check. If you need it stated with evidence, ask and we will provide the provider's own attestation rather than our paraphrase of it.

8. Consent, tracking, and privacy signals

There is no consent banner on this site because there is nothing to consent to. No cookies are set, no analytics run, and no advertising or tracking technology is present. A banner that asked you to accept nothing would be theatre.

Because we run no analytics, a Do Not Track or Global Privacy Control signal from your browser has nothing to switch off, and we do not currently read one. If we ever add analytics, honouring those signals is a precondition of adding it, not a follow-up.

If you own a site we visit

Two kinds of request come from limena, and they are treated differently on purpose.

• A scan you commissioned runs because you asked for it. It does not consult robots.txt, in the same way that opening your own site in your own browser does not.
• Discovery and analysis requests, meaning sitemap discovery, site analysis, platform detection, and reachability checks, do check robots.txt first and obey what they find. Blocking the user agent named limena in your robots.txt stops all of them.

Two limits on that, because they are true today. If your robots.txt is served by a redirect, for example from the bare domain to the www one, we currently treat it as absent rather than following the redirect, which means the block would not take effect. And a small number of internal checks carry one of those user agent names without performing the robots.txt check first. Both are being fixed. If you want to be certain limena is not touching your site in the meantime, write to us and we will stop it.

9. When limena staff can see your data

Almost never, and never silently. limena staff are not members of your workspace and cannot open it the way you can. There are two exceptions, and both leave a record you can read.

• Support and incident work. If you ask us for help, or something breaks, an operator may need to look at the affected records to fix it.
• Checking a property was authorized. Our terms say you may only test properties you are authorized to test. To be able to act on that, an operator can list the hosts an account has scanned, with counts and dates. Not paths, not page titles, not findings, not screenshots: enough to see that a site was scanned, not enough to read your work.

Every one of those accesses writes a row naming the person, the reason and the time, and you can read that log yourself under Settings, Operator access, in your own console. If the log is empty, nobody has looked.

10. Who we share it with

Sub-processors strictly necessary to run the service, each contractually bound to handle data only as we instruct; your chosen model provider for the AI calls described above; and the people inside your own workspace, scoped by their role. We do not sell, rent, or transfer customer data to third parties for marketing.

11. Your rights

You can access, correct, export, or delete your data. Workspace admins can do most of this directly in the product. Deleting a workspace removes its records immediately. For anything the product does not yet let you do yourself, including deleting an individual uploaded document, write to us and we will action it.

12. What we are still fixing

We publish this list rather than wait until it is empty, because you are entitled to weigh it.

• No per-document delete in the product. Ask us and we will do it.
• No expiry on a stored site gate password or crawler credential.
• No stated retention period for contact and sign-up records.
• Backup encryption is our provider's to attest. We rely on it and cannot verify it ourselves.
• Platform log retention at our hosting and database providers is set by them, not by us.
• The two robots.txt gaps in section 8.
• Typefaces served by Google rather than by us.
• No detection or masking of personal data that appears in captured evidence.

13. Contact

Privacy questions: privacy@limena.app. Security questions, including completed questionnaires and a data processing agreement: security@limena.app, or see the security page. Post reaches us at the registered office below, and a complaint you are not satisfied with can be taken to the Office of the Privacy Commissioner of Canada.

Who is responsible for your data

limena Technologies Inc. is incorporated federally in Canada under the Canada Business Corporations Act, corporation number 1812063-3, with its registered office at the address above. The record is public and can be looked up in the Corporations Canada register. It operates the limena platform and is the party you contract with, and the party responsible for personal information handled through the service.