Privacy policy
1. Controller
Moving Targets Consulting GmbH, Arndtstraße 34, 10965 Berlin, Germany, email: hey@xcheck.dev. Data protection officer: ds-beauftragter@streit-online.de. Supervisory authority: Berlin Commissioner for Data Protection and Freedom of Information.
2. Hosting and server logs
xcheck runs on Hetzner Online GmbH in Germany; processing and storage take place in the EU. When you visit, we process technically necessary server logs (IP address, time, requested page, browser identifier) to operate the service and defend against attacks (Art. 6(1)(f) GDPR). Logs are deleted after a short period.
3. Accounts and organizations
For customer accounts we process email address, name, password (hashed), and session data (Art. 6(1)(b) GDPR). Accounts are created by invitation only. You can delete your account yourself in the account area at any time; we then remove the account data.
4. Free scan (leads)
For the free scan we process your email address with a confirmation timestamp (double opt-in) and the requested URL (Art. 6(1)(b) GDPR). We send product updates only with your explicit, separate consent (Art. 6(1)(a) GDPR); we store the consent timestamp as proof. You can withdraw consent and request deletion of your lead data at any time: hey@xcheck.dev.
5. Scan and report data
During a scan we process the submitted URL and publicly accessible content of the checked page and store the results as a report (Art. 6(1)(b) and (f) GDPR). Reports belong to the respective organization and can be deleted there; shared report links can be revoked at any time.
6. AI services and external checks
For parts of the audit we transmit content of the CHECKED page to Anthropic (AI assessment) and OpenAI (content moderation only), both USA, safeguarded by EU standard contractual clauses. For speed measurement we transmit the checked URL to Google PageSpeed Insights. None of this requires personal data about you.
7. Transactional email
We send confirmation and sign-in emails via Resend (USA, EU standard contractual clauses). The recipient address and email content are transmitted.
8. Web analytics, cookies, no payment data
For reach measurement we use Plausible Analytics (Plausible Insights OÜ, Estonia, EU): no cookies, no personal profiles, IP addresses are not stored (Art. 6(1)(f) GDPR). We use no advertising trackers and process no payment data. We use cookies only where technically necessary (session, language choice, lead access to your own report).
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. Contact hey@xcheck.dev. You may also lodge a complaint with the competent supervisory authority.
10. Retention
Account data is stored until account deletion, lead data until withdrawal or deletion, reports until deleted by the organization. Server logs are deleted after a short period. Last updated: July 2026.