Privacy Policy
Last updated: October 2, 2026
1. Data Controller
LEISSON OÜ (registry code 16952932), registered in Tallinn, Estonia, is the data controller for personal data processed through ProUXAudit. Contact: privacy@prouxaudit.com.
2. Data We Collect
Account data: email address and, for sign-in, one-time codes stored only as keyed hashes for at most 10 minutes. Usage data: audit history, feature usage, IP address, browser type. Billing data: processed by Stripe; we store only Stripe customer and subscription IDs, not payment card details. Website data: fetched page content, structural (DOM) analysis, measurements taken in a browser, and screenshots of the public websites you submit for auditing.
3. How We Use Your Data
We use your data to provide the audit service, process payments, send transactional emails (account, billing, audit notifications), improve the product, and comply with legal obligations. We do not sell your personal data.
4. Legal Basis (GDPR)
We process data based on: contract performance (providing the Service), legitimate interest (product improvement, security, cookieless page-view counts), consent (marketing emails, analytics), and legal obligation (tax and financial records).
5. Data Sharing
We use service providers for payments, email, hosting, data storage, error monitoring and, with your consent on public pages, Google Analytics and PostHog. Vercel Web Analytics and Speed Insights count page views and page-load timings on public pages without cookies and without identifying you. Their processing terms and transfer safeguards apply. We do not sell personal data to advertisers.
6. Data Retention
Account data is retained while your account is active and for 30 days after deletion. Audit data (screenshots, reports) is retained for 90 days after the audit, or until you delete it. Billing records are retained for 7 years per Estonian tax law.
7. Your Rights
Under GDPR, you have the right to access, correct, delete, export, and restrict processing of your personal data. You can exercise these rights by emailing privacy@prouxaudit.com. We will respond within 30 days.
8. Cookies
Essential authentication cookies work independently of analytics. On public pages, Google Analytics and PostHog activate only after you choose “Accept analytics”. You can decline or change your choice using the analytics control on a public page. Vercel Web Analytics sets no cookie and stores nothing on your device, so it counts visits regardless of that choice; it receives only the page path, never the query string. We do not send email addresses, audit URLs, report tokens or form text as analytics events.
9. Security
We use encryption in transit (TLS), encryption at rest for database backups, bcrypt password hashing, and strict access controls. We monitor for security incidents via Sentry and conduct regular security reviews.
10. International Transfers
Data may be processed in the EU and US (Vercel, Cloudflare). US transfers are covered by the EU-US Data Privacy Framework. All processors maintain appropriate safeguards.
11. Changes
We may update this policy at any time. Material changes will be communicated via email. Continued use after changes constitutes acceptance of the updated policy.