Privacy policy

Last updated: 8 October 2026

This policy explains what personal data XCOTA collects, why, and what your rights are. The controller is XCOTA, Romania. Contact: hello@xcota.eu.

1. What we collect

• Account data: name, email, company, country, VAT number and your password, stored only as a secure hash.
• Brand data: the brands, websites, competitors, facts and questions you enter, and the AI answers, scores and fixes we create for them.
• Payment data: plan, amount, date, PayPal transaction references and the payer’s PayPal email. PayPal processes your card or account details; we never see card numbers.
• Free check data: your email, brand, website, what you sell, your market and the result.
• Chat assistant: the messages you write to the assistant on our website and its answers.
• Technical data: IP address and browser data in server logs, used for security and to limit abuse (for example, failed logins and free check limits).

2. Why we use it, and on what legal basis

• To provide XCOTA, take payments and send service emails such as activation, reports and renewal reminders: performance of the contract.
• To run the free check and send you its result, and to answer your questions in the chat: your request (steps before a contract) and our legitimate interest in answering you.
• To keep the service secure and prevent abuse: legitimate interest.
• To keep accounting records: legal obligation.

We do not sell your data, we do not use advertising or tracking tools, and we do not make automated decisions that have legal or similar effects on you.

3. Who processes data for us

• Our hosting provider, which stores the website, the database and our emails.
• PayPal, for payments. PayPal acts as an independent controller under its own privacy policy.
• OpenAI, Anthropic, Google and Perplexity: we send them your buyer questions and brand details so their assistants can answer, and OpenAI analyzes the answers. Chat messages are sent to OpenAI so the assistant can reply. We do not send them your account data.

Some of these providers are located outside the European Economic Area. Transfers are covered by the EU Data Privacy Framework, standard contractual clauses or equivalent safeguards.

4. How long we keep it

• Account, brand data, scores and fixes: while your account exists. When you ask us to delete it, we delete it within 30 days.
• Full texts of AI answers: up to 12 months.
• Free check data: 12 months.
• Chat messages: 90 days.
• Security logs: up to 30 days.
• Payment and invoicing records: as long as accounting law requires (in Romania, up to 10 years).

5. Your rights

You can ask to access, correct, delete or export your data, to restrict its use, or object to it, by writing to hello@xcota.eu. We reply within one month. You can also complain to a data protection authority; in Romania this is ANSPDCP (dataprotection.ro).

6. Cookies and fonts

We use only the cookies needed for the site to work. See the cookie policy. Our fonts are hosted on our own server, so pages do not contact Google or other third parties, except PayPal on the payment page.

7. Age

XCOTA is a business service and is not meant for children.

8. Changes

We may update this policy. The date at the top shows the latest version; important changes are announced by email.