Privacy policy
In short: no analytics, no advertising, a cookie only after you sign in. For the free check we keep only what it needs, and delete it after 30 days.
Controller
VEONIO OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. Privacy requests: e-mail address is shown with JavaScript
Hosting and server logs
This website runs on Cloudflare Pages (Cloudflare, Inc., USA, with data centres in the EU). When you visit, Cloudflare processes technically necessary data such as your IP address, the requested address, time and browser identifier to deliver the page and protect it from attacks. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply as well. Legal basis: Art. 6(1)(f) GDPR (secure operation of the website).
We use no analytics and no advertising. We use cookies only when you sign in to your customer account (see “Customer account”). Fonts and scripts load from our own server.
Free check
When you start the free check, we store in our database (Cloudflare D1, located in the EU): the website address you entered, the language, the time, the result and a hash of your IP address that changes every day. We do not store the IP address itself; the hash only serves to limit the number of checks per visitor. If you enter an e-mail address, we store it and use it once to send you the link to your result (through Cloudflare Email Service, see “Sending e-mail”).
For the check our scanner opens the home page at the given address with Cloudflare Browser Rendering, a browser running in Cloudflare’s environment. It does not click anything, submit forms or log in. Screenshots and measurements are stored in Cloudflare R2 (located in the EU).
After 30 days we delete the entry, result, screenshots and e-mail address. If you move the result into your customer account before then, we keep it there. Legal basis: Art. 6(1)(b) GDPR (your request) and Art. 6(1)(f) GDPR (preventing abuse).
Spam protection with Cloudflare Turnstile
We protect the forms for the free check, sign-in and contact with Cloudflare Turnstile. The script loads only when you click or type into the form. Turnstile then checks technical characteristics of your browser (including IP address and browser data) to tell whether a person is using the form, and sets no advertising cookies. The provider is Cloudflare, Inc.; its privacy policy applies. Legal basis: Art. 6(1)(f) GDPR (protecting our service from automated requests).
Customer account
A customer account needs only your e-mail address. You sign in without a password: we send you a link that works once and for 20 minutes. For this we store the e-mail address, a hash of the link, the language and a daily-changing hash of your IP address (to limit requests); links are deleted after one day. The first sign-in creates your account and a company entry.
After signing in we set a strictly necessary session cookie (“__Host-ac_s”, 30 days, HTTPS only, not readable by scripts). It holds a random identifier; our database stores only its hash. Signing out deletes the session. In the account we store your websites, the proof of ownership (meta tag or DNS record) and your scans with results and screenshots for as long as the account exists. Legal basis: Art. 6(1)(b) GDPR (contract); for the cookie also Art. 5(3) of the ePrivacy Directive (strictly necessary).
In the report we show the images of your website with their alt texts. Your browser loads these previews directly from your website.
Contact form
If you use the contact form, we send your details (name, e-mail address, optionally company and website, topic, message) by e-mail to our support mailbox. We do not store the message in our database, only hashes of IP and e-mail address with the time, to limit abuse; these are deleted after 30 days. Legal basis: Art. 6(1)(b) GDPR (your request) and (f) (preventing abuse).
Sending e-mail
We send sign-in links, notices about finished scans, result links and messages from the contact form with Cloudflare Email Service (Cloudflare, Inc.). Cloudflare processes the recipient address and the content of the e-mail to deliver it. The information on Cloudflare above applies.
Contact by e-mail
If you write to us, we process your details to answer your request. Our mailboxes are hosted by Google Workspace (Google Ireland Limited, Dublin). Legal basis: Art. 6(1)(b) GDPR, otherwise (f).
Payments through Stripe
We process orders and monitoring subscriptions through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter payment details such as a card number or IBAN directly on Stripe’s payment page; we do not see them. Stripe passes on what we need for the contract, invoicing and accounting: business name, billing address, VAT ID, e-mail address, amount, tax, payment status, invoice number and invoice links. We also store your orders, subscriptions and the websites assigned to them.
The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legal duty to keep accounting records (Art. 6(1)(c) GDPR); we keep invoice data for as long as accounting law requires. Stripe also processes data as a controller in its own right, for example to prevent fraud and to meet its own legal obligations. See Stripe’s privacy policy.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. Just write to us. You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
Last updated
10 November 2026