Website Legal Risk Audit — Terms of Service

Effective Date: May 3, 2026

These terms cover the Website Legal Risk Audit product sold by Vitki Data LLC. They are written in plain English on purpose. If anything is unclear, email [email protected] before you purchase — we’d rather answer questions than enforce technicalities.

1. What you’re buying

When you purchase a Website Legal Risk Audit ($149, $299, or $499 depending on tier), Vitki Data LLC delivers an automated scan of the website URL you specify. The scan covers four lenses:

  • Accessibility — WCAG 2.1 AA compliance via vendored axe-core
  • Trackers — third-party script detection (CIPA, VPPA scope)
  • Privacy notices — CalOPPA / CCPA element compliance
  • Cookie consent — pre-consent firing, GDPR Article 7 conformance

You receive a PDF report by email plus a private URL where the report is accessible from your account.

The Single tier scans 1 page. Multi scans up to 5 pages. Pro scans up to 25 pages. Each tier includes a number of re-scan coupons (1, 2, and 5 respectively) that expire 90 days after purchase.

2. What you’re explicitly NOT buying

You are not buying legal advice. Vitki Data LLC is not a law firm and does not employ attorneys. The report cites statutes, but cannot interpret them for your specific situation.

You are not buying a compliance certification. No automated scan can certify WCAG, ADA, CIPA, VPPA, GDPR, or any other compliance. The report tells you what an automated scan would catch — same as a plaintiff’s scanner would catch — and provides remediation suggestions. It does not certify that your site is or will be lawsuit-proof.

You are not buying ongoing monitoring. The audit is a snapshot at a single point in time. Websites change. The report’s findings are accurate as of the scan date. Re-scans (included with each tier) verify state at later points but do not extend the original certification.

You are not buying remediation. The audit identifies issues. Fixing them is your responsibility — or you can engage Vitki Forge (our sister team) at additional cost.

3. Refund policy

We offer refunds in one circumstance: if we deliver a technically broken audit. That includes:

  • The scan didn’t actually run (timeout, server error, malformed report)
  • The PDF is corrupted or unreadable
  • We delivered another customer’s report to you

If any of those happen, reply to the delivery email within 14 days and we’ll either re-run the audit at no charge or refund your purchase, your choice.

We do not refund based on the number or severity of findings. By definition, a scan that finds nothing is a successful scan and a useful artifact (it’s documentation that you’re clean as of that date).

4. Data we store

For each audit you purchase, we store:

  • The URL(s) you scanned
  • The scan output: rendered HTML, network log, screenshots, and findings JSON
  • The PDF report
  • Your account email and Stripe customer ID for billing

These are stored on our scraper server (encrypted at rest) for 12 months from the scan date. After 12 months, scan artifacts are purged unless you’ve requested longer retention in writing.

We do not store visitors’ personal data. The scanner crawls publicly accessible pages only and does not log in, extract user data, or interact with forms.

We do not sell, share, or provide your scan results to third parties. Findings remain in your account; you control who you share them with.

5. Intellectual property

You own the report. You can:

  • Share it with your developer, attorney, insurer, board, or anyone else you choose
  • Quote from it in litigation, regulatory filings, or business communications
  • Use it as the basis for engineering work or remediation contracts

You cannot:

  • Resell the report as your own product or rebrand it
  • Aggregate audit reports into a competing service
  • Use the report’s structure, finding-language, or format to create derivative reports for resale

We retain the underlying scan data (per Section 4) for diagnostic and product-improvement purposes. We may use anonymized, aggregated data (e.g., “X% of audited sites had a CIPA-detectable Meta Pixel issue”) in marketing or research; we will never identify your specific site or findings.

6. Discoverability of the report in litigation

A Website Legal Risk Audit you purchase becomes a record. If you are later sued for an issue identified in the report, opposing counsel may request the report through discovery. The report’s documented existence could be cited as evidence of your awareness of the issue.

This is the same dynamic that applies to any internal audit, security assessment, or vulnerability scan. We mention it here so you can make an informed choice about whether to act on the findings (recommended), share with counsel under privilege (also recommended for sensitive cases), or both.

7. Limitation of liability

Vitki Data LLC’s total liability to you for any claim arising from your use of the audit is capped at the amount you paid for the audit ($149, $299, or $499 — whichever tier you purchased). We are not liable for:

  • Lawsuits, demand letters, settlements, or judgments brought against you by third parties
  • Costs of remediation, attorneys’ fees, or business interruption
  • Indirect, consequential, or punitive damages

We do our best to be accurate. The product is sold as-is.

8. Acceptable use

You may purchase audits only for websites you own, operate, or have written authorization to scan. You may not use the audit to scan competitors’ sites with the intent to harm, harass, or build litigation against them.

If we detect that an audit purchase appears to be targeting a site the buyer doesn’t own (e.g., the buyer’s email domain doesn’t match the scanned domain and there are no plausible business-relationship indicators), we may decline the audit and refund the purchase.

9. Changes to these terms

If we materially change these terms, we will email everyone with an audit purchased in the prior 12 months at least 30 days before the new terms take effect. Continued use of re-scan coupons after the effective date constitutes acceptance.

10. Governing law and contact

These terms are governed by the laws of the United States. For disputes, the parties agree to first attempt resolution by direct negotiation; if that fails, by binding arbitration under the rules of the American Arbitration Association.

For questions, corrections, or concerns: [email protected].

For data deletion requests (Section 4): include “Data deletion request” in the subject line. We will purge your data within 30 days of receipt.

Vitki Data LLC [Mailing address — fill in from Mercury before publishing]