Compliance

Found at https://moi-basics.com/policies/privacy-policy.

Sites are increasingly expected to publish an accessibility statement. Required by EU Web Accessibility Directive 2016/2102 for public-sector bodies; recommended best practice elsewhere. Common URLs: /accessibility, /accessibility-statement, /a11y.

Tracking pixels are 1x1 / 2x2 cross-origin <img> tags that fire a GET request when the browser renders them -- no JavaScript, no cookies needed. They're how trackers survive when users disable JS or block third-party cookies, and they bypass most ad-blocker rules that target script src. Each one needs explicit disclosure under GDPR Art 7 / CCPA / ePrivacy because the request itself transmits the page URL + IP + user-agent + referrer to the tracker. Audit each surfaced domain: is it disclosed in your privacy policy? Is it conditional on the cookie banner? Affected domains: instafeed.nfcube.com.

navigator.sendBeacon() fires fire-and-forget POSTs in the background after page-unload -- typically used for last-second analytics (read-time, scroll depth, exit-intent). Ad-blockers' XHR/fetch interception often misses them (different API path); DevTools shows beacon requests typed as "ping" instead of "fetch", which is easy to overlook in privacy reviews. Audit each call site: what data is being sent? Is the recipient disclosed in the privacy policy? Is the call gated behind cookie-banner consent? Does the user have a way to opt out of the page-unload tracking specifically (separate from in-session analytics)? Detection is limited to inline scripts -- beacons in external SDKs aren't visible to this static scan.

No recognized compliance certification badges or seals were found. This is common — many sites do not display compliance badges.

Inventory of trackers loaded by the page (matched against a curated SDK URL registry): analytics: Google Analytics 4 Each entry maps a script URL pattern to a known vendor SDK. This is purely informational -- consent posture / pre-consent firing is graded by the consent analyzer.

Scanned the homepage body text AND the linked /privacy page for GDPR Article 13 disclosures. Matched 7 of 8 categories: Data retention period, Data subject rights (access, erasure, rectification, etc.), Identity / contact details of the data controller, International data transfers, Legal basis for processing, Recipients of personal data, Right to lodge a complaint with a supervisory authority. Missing: Data Protection Officer contact (where applicable). Note: only the FIRST same-origin privacy-policy link is followed; deeper sub-pages (e.g. /legal/data-subject-rights) are not fetched.

Found 3 analytics, 0 advertising, 0 marketing, 1 tag manager, 0 session-replay, 0 heatmap trackers.

Copyright notice is up to date: © 2026 moi-basics

BeaverCheck detects technical indicators that may suggest regulatory relevance. This is not a compliance audit and should not be relied upon for legal decisions. Consult qualified legal counsel for compliance assessments.

This inventory identifies third-party services that receive data from your site visitors. Under regulations like GDPR (Article 30), maintaining records of data processing activities is commonly considered a best practice. This automated scan provides a starting point — it may not capture all data flows.