Privacy Policy
What we collect when you visit or book a call, why, and the choices you have. The product itself never sends us your data.
Last updated
The short version
- The product does not send us your data. xRazor runs on your own hardware. Scan results, credentials, findings and logs stay inside your network — we never receive them.
- The website collects very little. We measure site usage with cookieless analytics. No cookies, no advertising pixels, no cross-site profiles.
- When you book a call we receive what you type into the booking form, so we can prepare and hold the meeting.
- We never sell personal data, and we never use it to train AI models.
This policy explains the details. "xRazor", "we" and "us" mean xRazor Security. "You" means anyone who visits xrazor.io, books a call, or emails us.
What this policy covers
It covers personal data we handle through xrazor.io, booking a call, and emailing us. It does not cover data processed by the xRazor platform inside a customer's environment: that data stays under the customer's control, and our signed customer agreement governs any access we are given to it (for example, during a managed engagement on site).
What we collect
When you visit the site. Our hosting provider processes technical request data — IP address, browser user agent, the page requested and the time — to deliver pages and protect the service from abuse. It is kept in short-lived server logs.
Usage statistics. We use Umami, a cookieless analytics service, to understand how our site is used: pages visited, how visitors arrive (referrer and campaign tags), general browser, device and country information, page performance, and interaction with site features such as links, buttons and the booking calendar. It stores nothing on your device and does not identify you, and we never record what you type. Browsers that send a Do Not Track signal are excluded.
When you book a call. Through our scheduling provider we receive your name, work email, company, role, the time you chose, and anything you add in the notes (including an ROI estimate if you sent one from our calculator). The provider also creates a video-meeting link and calendar invitation.
When you email us. Your email address, the message, and anything you attach.
When you report a vulnerability. Your contact details and the technical information you send, handled under our Vulnerability Disclosure Policy.
We do not knowingly collect special-category data, and the site is not directed at children.
Why we use it
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Serve and secure the website | Request data | Legitimate interests — running a secure site |
| Understand how the site is used and improve it | Usage statistics | Legitimate interests — improving our site, with no cookies or profiling |
| Schedule and hold your call | Booking details | Steps at your request before a contract |
| Answer your email | Email and message | Legitimate interests — replying to you |
| Follow up about the call you booked | Booking details | Legitimate interests — you asked to talk to us |
| Meet legal obligations | As required | Legal obligation |
We do not add you to marketing lists. If we ever send marketing email, it will only be with your consent where the law requires it, and every message will have a one-click opt-out.
Who we share it with
Only with the service providers that help us run the items above — listed with their purpose and location on our Subprocessors page — and with authorities when the law requires it. Providers act on our instructions and may not use your data for their own purposes. If xRazor is ever reorganised or acquired, personal data may transfer to the successor under this same policy.
International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an equivalent safeguard offered by the provider.
How long we keep it
- Server request logs: as long as our hosting provider retains them (short-lived).
- Usage statistics: for the retention period of our analytics plan (currently 6 months), in aggregated, non-identifying form.
- Booking details and related email: up to 24 months after our last contact, unless we enter a customer relationship, in which case the customer agreement applies.
- Vulnerability reports: as long as needed to fix and record the issue.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. California residents have the right to know, delete and correct, and to not be discriminated against for using these rights — we do not sell or share personal information as the CCPA defines it.
Email security@xrazor.io with the subject "Privacy request". We reply within 30 days and may need to confirm your identity first. You may also complain to your local data-protection authority.
Security
We protect personal data with access control, encryption in transit, and by keeping as little of it as we can. Our wider practices are described in the Trust Center.
Changes
When this policy changes, we update the date at the top of the page. If a change is significant, we will say so on this page before it takes effect.
Contact
xRazor Security · security@xrazor.io