Privacy Policy

SXO is operated by RocketOpp LLC. You can reach us about anything on this page at hello@sxowebsite.com. For privacy questions we are the data controller.

Three kinds of data, and nothing else:

• What you type in. The website address you ask us to scan, and your email address when you ask for a report, buy something or create an account. You can run your first scan without giving us an email at all.
• What a scan produces. The public information our scanner reads from the site you entered — its page markup, headers, robots and sitemap files, and public DNS records — plus the scores and the fix list we generate from them. We store this so you can come back to a report you already ran.
• How the site is used. Standard analytics: pages viewed, approximate location from your IP address, device and browser type, and which links you clicked. This is measurement, not profiling, and we do not sell it.

We do not ask for, and have no use for, special category data: no health, biometric, political or financial detail beyond what Stripe needs to take a payment.

Payments are taken by Stripe. Your card number is entered on Stripe’s infrastructure and is never sent to, seen by or stored on our servers. We receive only what Stripe tells us: that a payment succeeded, the last four digits, and an identifier we use to match the payment to your account.

• To run the scan you asked for and show you the result — the core of the service, and the reason a website address is required.
• To email you the report, your receipt, and messages about something you bought. These are transactional; you cannot opt out of a receipt while remaining a customer.
• To take payment, apply credits and prevent one free scan becoming unlimited free scans.
• To understand which pages and tools people actually use, so we build the right things.
• To meet our legal and accounting obligations.

Where the law requires a lawful basis, ours is performance of a contract for the first three, legitimate interests for the fourth, and legal obligation for the last. Analytics and marketing cookies run only where you have consented.

We keep this list short on purpose, and it is the complete list of processors that touch your data:

• Supabase — our database and file storage, where scan records and accounts live.
• Vercel — hosting. It processes request logs, including IP addresses, to serve the site.
• Stripe — payments and subscriptions.
• Google Analytics 4 — usage measurement, loaded only after you accept analytics cookies.
• CRO9 — our own conversion analytics, operated by RocketOpp LLC, under the same consent gate.
• Our CRM — sends the transactional email and holds your contact record if you become a customer or subscribe.
• AI model providers — when you buy a written fix or report, the page content being rewritten is sent to the model that generates it. We do not send your personal details, and the providers we use do not train their models on it.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Our prospecting scans read publicly available information from a website — exactly what a browser or a search engine crawler would see. We do not log in, bypass anything, or access anything a member of the public could not. If you scan a site, the report is stored against your account; the owner of the scanned site is not contacted by us and gets no notification.

If you are the owner of a site and want any stored scan of it removed, email us and we will remove it.

Cookies that keep you signed in, remember your credit balance and secure the site are necessary and always on. Analytics cookies (Google Analytics and CRO9) load only if you accept them in the banner, and you can change that choice at any time.

• Scan reports: kept while your account is open, so you can return to them. Delete a report at any time and it is gone.
• Account and contact data: kept while the account exists, then removed within 30 days of a deletion request.
• Payment and invoice records: kept for seven years, because tax law requires it. These survive account deletion.
• Analytics: retained by Google for 14 months on the standard setting.

Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, or send you a copy in a portable format. If you are in the UK, EU or EEA you also have the right to object to processing and to complain to your data protection authority. If you are in California you have the rights granted by the CCPA, including the right to know and to delete, and we will not discriminate against you for exercising them.

Email hello@sxowebsite.com and we will respond within 30 days. We do not charge for this.

Traffic is encrypted in transit, data is encrypted at rest by our database and hosting providers, and access is limited to the people who need it. No service can promise perfect security, and we will not pretend otherwise; if a breach affects you we will tell you and the relevant authority within the time the law allows.

Our providers are largely United States based, so your data may be processed there. Where data moves out of the UK or EEA it does so under the providers’ standard contractual clauses.

SXO is a business tool and is not directed at children under 16. We do not knowingly collect their data, and will delete it if we learn we have.

When this policy changes we update the date at the top. If a change materially affects how we treat data we already hold, we will email account holders before it takes effect rather than change it quietly. This version is dated 12 September 2026.

Using SXO is also subject to our Terms of Service.