Privacy notice

How we handle the details you send us

Last updated: November 3, 2026

To prepare a website check we need two things: the address of your website and an e-mail address to send the report to. This notice explains what we do with them, and with anything else you choose to tell us.

Who is responsible

Smartunex OÜ is the controller of your personal data. XRayWebsite is a website audit service of Smartunex OÜ.

What we collect

• When you order: the website address you enter before checkout, and from Paddle the e-mail address you pay with and the order details.
• When you write to us or reply to a report: your e-mail address, your message and our correspondence.
• When you open this website: our hosting provider keeps standard server logs (IP address, time, page requested and browser type) for 30 days, to keep the site secure and running. Legal basis: our legitimate interest in a secure website (Art. 6(1)(f)).
• About your website: what any visitor can see on its public pages. We don’t log in, submit forms or access anything that isn’t public.

This website sets no cookies and uses no analytics, advertising or tracking tools. On the home page your browser may keep one small entry that never leaves your device: "view-mode" (local storage) remembers whether you chose the Simple or Detailed view. It is strictly necessary for that choice, so it needs no consent. Fonts are served from our own server, so opening the page doesn't send your data to font or analytics providers.

Why we use it, and on what legal basis

• To prepare and send the check you asked for, and to answer your questions about it. Legal basis: steps taken at your request before entering into a contract, and performing that contract (GDPR Art. 6(1)(b)).
• To keep a record of what we sent and agreed, and to handle any follow-up. Legal basis: our legitimate interest in running and documenting our service (Art. 6(1)(f)).
• To meet accounting and tax duties for paid orders. Legal basis: legal obligation (Art. 6(1)(c)).
• To show your report as an anonymous example, only if you agree in writing. We remove your website address, business name, screenshots that could identify you and any personal details before showing it. Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time by writing to us; we then stop showing it.
• To handle your privacy or data request, and to keep a record of how we answered it. Legal basis: legal obligation (Art. 6(1)(c), with GDPR Articles 12–22).

Without your website address and e-mail we can't prepare the check.

We don't send newsletters, sell or rent your data, or use it for automated decisions or profiling.

Who else sees it

Only the processors we need to run the service: website hosting, e-mail and, for paid checks, accounting. They process data only on our behalf, under data-processing agreements (GDPR Art. 28), and only for the purposes above. Payments are handled by Paddle.com, our reseller and Merchant of Record, under its own privacy notice; we never see your card details. The current list of processors is available on request: write to support@xraywebsite.com. Data is transferred outside the European Economic Area only on the basis of an adequacy decision or standard contractual clauses.

We never contact whoever looks after your site, or anyone else, about the check. The report goes only to the e-mail address you give us.

How long we keep it

Requests, reports and correspondence are kept for 12 months after our last contact (for a privacy request, 12 months after our reply), then deleted. Server logs are kept for 30 days. If you order a paid check, invoices and the records accounting law requires are kept for as long as that law says (in Estonia, 7 years).

Your rights

• See the data we hold about you and get a copy of it.
• Have it corrected, or deleted before the end of the retention period.
• Restrict how we use it, or object to use based on our legitimate interest.
• Receive the data you gave us in a common, machine-readable format.
• Complain to a data-protection authority. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); you can also contact the authority where you live or work.

How to use your rights

Write to support@xraywebsite.com and describe what you want, or write to Smartunex OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. We reply within one month. We may ask you to confirm that the e-mail address is yours before we act on the request.

Changes

If we change how we handle data, we update this page and the date at the top.