Privacy Policy — WebCheck Accessibility Extension
This policy explains how the WebCheck Accessibility Extension for Google Chrome and the audit service it connects to collect, use, protect and delete your information.
- Publisher and data controller
- National Science and Technology Development Agency (NSTDA), 111 Thailand Science Park, Phahonyothin Road, Khlong Nueng, Khlong Luang, Pathum Thani 12120, Thailand
- Contact email
- privacy@webcheck.in.th
- Effective date
- Audit service
- https://webcheck.in.th (opens in a new tab)
- Hosting provider and processing country
- Government Data Center and Cloud (GDCC), Thailand
Our single purpose
The extension helps web developers and website maintainers check a web page they choose against WCAG accessibility criteria and open the resulting audit report. We collect, use and keep information only for this purpose, including operating, securing and measuring the performance and reliability of the service.
Information we use
Google account. You sign in with Google. The extension reads your email address, name and profile picture to show your account in the side panel. Your name and profile picture stay on your device. The extension sends your Google access token to the audit service, which checks it with Google, reads your Google account ID and email address from Google's response, and issues a session. The audit service does not store your Google token.
Pages you audit. Only when you start an audit and allow access to a site, the extension sends the audit service the page URL without its query string or a fragment that holds parameters (after #), the page title, a snapshot of the page's HTML including any readable CSS (CSSOM), the WCAG standard and report language you chose, and the extension version. Before sending, the extension removes hidden form fields, CSRF and token meta tags, script contents, HTML comments, and values in form fields other than buttons, checkboxes and radio buttons. Text shown on the page, the page title, an anchor fragment such as #section-2 and other attributes are still sent and may contain personal data or confidential information, so do not audit pages you are not allowed to share. The extension does not collect your browsing history or any page you did not choose to audit.
Resources loaded by the service. To build the report, the audit service renders the snapshot and may load CSS and fonts from the audited site or from third-party providers. Those providers receive network requests from the service's servers, not from your browser, and do not receive your account details.
How we use information
| Information | Used to |
|---|---|
| Google token, Google account ID, email address | Sign you in, issue a session, and let you open your own reports |
| Page snapshot, URL, title, audit options | Run the accessibility audit and build your report |
| Report and share token | Show the report to you and to people you share the link with |
| Usage statistics | Measure usage, performance and reliability of the service, and fix and improve the audit (see below) |
| Infrastructure logs | Keep the service running and secure, and meet legal obligations (see below) |
We do not use your information for any other purpose. These rules apply equally to raw data and to any aggregated, anonymized, pseudonymized or derived data, such as statistics.
What we keep and for how long
| Where | What | How long |
|---|---|---|
| Your device | Profile details and display preferences in Chrome extension storage. Tokens and page snapshots are never written to storage. | Until you sign out (profile) or uninstall the extension (everything) |
| Audit service memory | The page snapshot (raw HTML) while the audit runs. It is never saved to disk or to a database. | Seconds, until the audit finishes |
| Reports | Request details (URL without its query string, title, standard, language); the report, which may include snippets of page content taken from the snapshot after the removals above; your Google account ID as the report owner; the expiry date; and a hash of the share token. | 30 days, then the report can no longer be opened and its files are deleted by an hourly cleanup |
| Usage statistics | See "Usage statistics" below | 12 months, then deleted |
| Infrastructure logs | See "Infrastructure logs" below | 90 days, then deleted, unless a competent authority orders us to keep specific logs longer |
| Backups | Copies of reports and statistics, used only to restore the service after a failure | 30 days, then deleted |
Usage statistics
For each audit we keep one statistics record. It does not contain your email address, name, profile picture, raw Google account ID, any token, your IP address, the page HTML, text from the page, or the list of issues and code snippets.
It contains:
- Technical data: audit status and error code, standard, report language, extension version, page size, number of elements, processing time, and the number of issues found in total and per WCAG success criterion.
- Data that could indirectly relate to a person, kept because the service needs it:
| Field | Why we need it |
|---|---|
| Pseudonymous user ID | A keyed hash (HMAC-SHA256) of your Google account ID, with the key kept separately from the statistics. Used to count distinct users and repeat use, detect abuse of the service per account, and find your records when you ask us to delete them, without storing who you are. |
| Email domain only | For example example.go.th, never the part before @. Used to measure aggregate adoption and usage of the accessibility-audit service by organization. |
| Page URL and title | Origin and path, without query string or fragment, and page title. Used to see which websites are audited and whether their results improve, and find pages where the audit repeatedly fails so we can fix the service. |
A URL path or page title can still identify a person, so we treat statistics as personal data: they are protected and limited in the same way as reports, and staff work with aggregated figures only (see "Human access to your data").
Infrastructure logs
The Thai Computer Crime Act B.E. 2550 (2007), as amended in B.E. 2560 (2017), Section 26, and the Ministry of Digital Economy and Society Notification on the Retention of Computer Traffic Data by Service Providers B.E. 2564 (2021) require us, as a service provider, to keep computer traffic data for at least 90 days. We keep:
- Required by law (traffic data): source IP address and port, date and time, request method and path, response status, and, for audits started from the extension, the Google account ID that identifies the user of the service. Our gateway may also record the browser user agent.
- Beyond the legal requirement: system error messages (for example, when the browser engine or database fails or a sign-in token is rejected), kept to keep the service running and to investigate security incidents.
Logs do not contain request bodies, page HTML, authorization headers, share tokens or email addresses.
How we protect information
In transit:
- All traffic between the extension, your browser and the audit service uses HTTPS.
- The connection between the audit service and the statistics database is encrypted with TLS.
Minimizing what we keep:
- The extension removes form values, hidden fields, tokens and scripts before sending a snapshot.
- The raw page HTML is processed in memory only and never stored.
- Query strings and fragments are removed from stored URLs.
- Share tokens are stored only as SHA-256 hashes and are sent in the link's fragment (after
#), so they never reach server logs. - Statistics use a keyed hash instead of your Google account ID and keep only the domain of your email address.
Access control:
- A report can be opened only by its owner's session or with its share token; any other request gets the same "not found" response.
- Sessions with the audit service expire after 15 minutes.
- Your Google token is checked with Google and never stored by the service.
Storage and infrastructure:
- Server disks, the statistics database and backups are encrypted at rest.
- Pages are rendered in a sandboxed browser inside a locked-down container (no root user, restricted system calls, no extra privileges) that can reach only public websites.
- Expired reports are deleted automatically; statistics, logs and backups are deleted at the end of the periods above.
Incidents:
- If a personal data breach occurs, we notify the Personal Data Protection Committee within 72 hours and inform affected users without delay where the Personal Data Protection Act B.E. 2562 (2019) requires it.
Human access to your data
The audit runs automatically. No person at NSTDA or our hosting provider reads your account data, the pages you audit, your reports, or statistics about you, except in these cases:
- With your explicit consent, to read specific data — for example, when you ask us to look at a report to solve a problem with the service. We tell you which data we will read and use it only for your request.
- For security, such as investigating abuse, malware, fraud, spam or an attack on the service.
- To comply with applicable law, such as a lawful order from a competent authority.
- When the data is aggregated and anonymized, such as the total number of audits or issues per WCAG criterion, for internal operations, in line with applicable privacy law.
In cases 1–3, only authorized staff who need the data can access it, they access only what the case needs, and each access is recorded.
Who receives information
We transfer information to others only when needed to provide the service, to comply with the law, to protect against malware, spam, phishing, fraud or abuse, or as part of a merger, acquisition or transfer of the service — and in that last case only after obtaining your explicit prior consent.
- Google receives the sign-in and profile requests, and the audit service sends your Google token to Google to verify it, under Google's privacy policy (opens in a new tab).
- Government Data Center and Cloud (GDCC) hosts the audit service and processes data only on our instructions to run it in Thailand.
- Competent authorities, only when the law requires it.
- Anyone with a report link. A report link includes a share token; anyone who has the link can open the report until it expires. Share it only with people who should see it.
What we never do
- Sell your data.
- Use or transfer your data for personalized advertising.
- Transfer or sell your data to advertising platforms, data brokers or other information resellers.
- Use, transfer or sell your data to determine creditworthiness or for lending.
- Use your data for any purpose other than the single purpose described above.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy (opens in a new tab), including the Limited Use (opens in a new tab) requirements.
Legal basis
We process personal data under the Personal Data Protection Act B.E. 2562 (2019): performance of the service you request (Section 24(3)) for sign-in, audits and reports; legitimate interest (Section 24(5)) for statistics and security logs; legal obligation (Section 24(6)) for traffic data under the Computer Crime Act.
Your choices and rights
You decide which pages to audit and which sites to allow. You can remove a site's access in Chrome's extension settings, sign out, or uninstall the extension. Signing out removes your account and token from Chrome and asks Google to revoke the token; it does not delete reports or statistics already sent to the service.
You can ask us to access, correct or delete your data, to restrict or object to its processing, or to withdraw consent you gave. We can find and delete your reports and statistics using your Google account ID. Traffic data that the law requires us to keep is deleted when its legal retention period ends, and data in backups is deleted when the backup expires. You may also complain to the Office of the Personal Data Protection Committee.
Contact and data requests
Email privacy@webcheck.in.th from the address of the Google account you used, so we can verify the request. We respond within 30 days.
Changes to this policy
When we change how we use information, we will update the effective date above and announce the change on this page. We will ask for your consent before using data already collected in a materially different way.