Privacy policy
Last updated 2 November 2026. In short: we keep what we need to run audits and apply fixes. Visitors to your site are not tracked.
Who we are
CoreA11y for Wix ("CoreA11y", "we") is an accessibility checking and fixing app at wix.corea11y.com, run by MSACAlab. You can reach us at support@corea11y.com.
This policy covers site owners who install CoreA11y on a Wix site, and visitors to those sites.
Information we collect from site owners
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Your email address and the Wix IDs of your site, app install and account | Wix, when you install and open the app |
| Site details | Site address, site name, language, your plan, which fixes are on | Wix and you, in the app |
| Audit results | Page addresses and titles, the type of each problem found, a CSS selector pointing to the element, colour values for contrast problems, image addresses for alt text problems | Your browser, while you run an audit on your own site |
| Your answers | Alt text you write, the alt text it replaced (so you can undo), dismissed issues and your reasons, accessibility statement details | You, in the app |
| Branding (Agency plan) | Logo image and colours for white-label reports | You, in the app |
Audits run in your own browser. We store the results, not the content of your pages: no page text, form entries or screenshots are sent to us. To write alt text, we read the product or blog post it belongs to from Wix at that moment and keep only the alt text. We never see your payment details: Wix handles billing and tells us only which plan the site has. Wix access tokens are kept in memory for a few hours and never stored.
Visitors to sites that use CoreA11y
CoreA11y's script does not track visitors. It loads the accessibility fixes the site owner turned on and changes the page in the visitor's browser, for example by adding labels or a "Skip to content" link.
- It sets no cookies and does not read the visitor's cookies.
- It sends nothing about the visitor back to us: no clicks, form entries, page content or identifiers.
- To load the script, the visitor's browser makes a normal request to wix.corea11y.com. Like any web request, it carries the visitor's IP address and browser type. We do not log or store these. We only note the time the script last loaded on the site, so the app can show the owner that CoreA11y is live.
Audits run only when the site owner starts one from their own browser; visitors are never audited.
How we use information
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Run your account, audits, fixes, reports and accessibility statement | Performing our contract with you |
| Send service emails: weekly check results | Performing our contract with you |
| Check your plan with Wix | Performing our contract with you |
| Keep the service secure: sign-in sessions and form protection | Legitimate interests |
We do not sell personal information, show ads, or use your data to train AI models. We send no marketing email. You can stop weekly check emails with the unsubscribe link in each one.
Who we share it with
Only the providers that run parts of the service, and only what each one needs.
| Provider | What they do | What they receive |
|---|---|---|
| Fly.io (opens in a new tab) | Hosts the app and its database (servers in Virginia, United States) | Everything stored in the app |
| Wix (opens in a new tab) | Runs your site, the app install and billing | Alt text you choose to save to your products and blog posts |
| Our email provider | Sends our emails | Your email address and the emails we send you |
We may also disclose information if the law requires it, or to a buyer if CoreA11y is sold; we would tell you first.
Cookies and browser storage
| Name | Purpose | Lasts |
|---|---|---|
| ca11y_sid (wix.corea11y.com, inside your Wix dashboard only) | Keeps you signed in to the app | 1 day |
| Session storage on your own site (not a cookie) | Tracks which page an audit is on while it runs in your browser | Until you close the tab |
Visitors to your site get no CoreA11y cookies. There are no tracking or analytics cookies.
How long we keep it, and how we protect it
- While the app is installed, we keep your site and audit history so you can compare audits over time.
- Uninstalling turns the script off straight away. Write to support@corea11y.com and we delete the site and its history within 30 days.
All traffic uses HTTPS, sign-in cookies are HTTP-only, and forms are protected against cross-site requests. Requests from Wix are checked against Wix's signatures.
Your rights
You can ask us to access, correct, export or delete your personal information, or object to how we use it. Email support@corea11y.com; we reply within 30 days. If you are in the UK or EU, you can also complain to your data protection authority.
Visitors to a site that uses CoreA11y: we hold no personal information about you. For anything else about that site, contact its owner.
International transfers
Our servers are in the United States. Where UK or EU law applies, transfers rely on our providers' Standard Contractual Clauses or the EU–US Data Privacy Framework.
Children
CoreA11y is a business service and is not meant for anyone under 16.
Changes to this policy
If we make an important change, we will email site owners before it takes effect. The date at the top shows the latest version.
Contact
support@corea11y.com · MSACAlab