Data Privacy & Security
Zero-PII Architecture
AccessiLens is built with privacy as a core principle. The widget operates entirely client-side — meaning all DOM analysis and remediation happens within the visitor's own browser. No PII (Personally Identifiable Information) such as names, emails, or behavioural tracking data is ever collected, stored, or transmitted to AccessiLens servers.
Privacy and data compliance
GDPR & CCPA compliant — AccessiLens does not set any tracking cookies and does not require a cookie consent banner. GDPR (EU) and CCPA (California) both regulate the collection of personal data, and since AccessiLens collects none, no consent mechanism is required for the widget itself.
SDAIA PDPL compliant — Saudi Arabia's Personal Data Protection Law has strict data localisation and consent requirements. AccessiLens's zero-collection architecture is fully compliant.
TLS 1.3 encrypted transport — all communication between the AccessiLens widget and our APIs uses TLS 1.3 (Transport Layer Security), the most current encryption protocol. This is the same standard used by banks and financial institutions.
User preferences stored in localStorage only
When a visitor saves accessibility settings — such as enabling Dyslexia Mode or a colour filter — those preferences are stored in localStorage, which is a storage area built into the visitor's own browser. The data never leaves their device and is never uploaded to our servers.
AI image processing and public URLs
When Gemini Vision generates alt text for images, it accesses them via their public URL — the same web address that any browser would use to load the image. Images protected by authentication or behind a private intranet are inaccessible to the AI and are automatically skipped.
Content Security Policy (CSP) Headers
A CSP (Content Security Policy) is a browser security mechanism that tells your website which external scripts, connections, and styles are permitted to run. It is defined as an HTTP response header or a <meta> tag in your HTML. Enterprise and government websites often use strict CSPs — and without adding AccessiLens to your approved allowlist, the widget will be blocked by the browser before it can load.
How to update your CSP allowlist
Add 'https://accessilens-ai.com' to your script-src directive (permits the widget script to load) and to connect-src (permits the widget to communicate with our API).
If you are using the Gemini Vision AI alt text feature, also add 'https://generativelanguage.googleapis.com' to connect-src — this is the Google AI endpoint that generates image descriptions.
If your CSP restricts inline styles (style-src), add 'unsafe-inline' — required for the widget to apply real-time CSS adjustments like contrast filters and font overrides.
add_header Content-Security-Policy "
default-src 'self';
script-src 'self' 'unsafe-inline' https://accessilens-ai.com;
connect-src 'self' https://accessilens-ai.com https://generativelanguage.googleapis.com;
style-src 'self' 'unsafe-inline';
";