See the value using just a URL first. When authorization is needed, grant only the minimum permissions, and revoke them at any time. Each item below describes what the system actually does.
Enable each level progressively from left to right. You may leave any level disabled.
Website availability monitoring, SSL and domain expiry reminders, 404 checks, comprehensive website diagnosis, competitor sitemap updates, new page notifications and brand observation in AI answers.
We access only public pages that any visitor can open, just as a search engine crawler does.
Send alerts, website updates and new inquiries to your work group.
A group bot's webhook can only send messages to that group; it cannot read the group chat. Removing the bot in group settings invalidates it immediately.
Used for features that change website content, such as SEO title changes, bulk TAG / ALT updates and internal links.
An application password is not your login password. We recommend creating a dedicated account with the “Editor” role for us (it cannot install plugins, change settings or manage users). Revoke the password in one click under WordPress administration → Users → Profile → Application Passwords.
Used for AI spam inquiry filtering and assignment to salespeople by country and weight.
We recommend a dedicated inquiry email account (such as sales@ or inquiry@), using the email provider's “app-specific password / authorization code” instead of the login password. You can invalidate it in your email administration settings at any time.
Server monitoring and website self-healing do not need an SSH password. Install a Shell script (Agent) with directly readable source code on your server. Its allowed actions are defined only in /etc/xunl-agent/actions.conf on your own server, with none allowed by default. The platform can request actions only by name; unknown names are rejected, and executions of the same action must be at least 5 minutes apart.
| Data | Purpose | How we handle it | How to revoke access |
|---|---|---|---|
| Website URL | Monitoring, diagnosis, 404 checks and competitor updates | Only public pages are accessed; we do not log into your administration area | Delete it under “Websites” |
| WordPress application password | Title changes, bulk TAG / ALT updates and internal links | Stored encrypted; restricted to HTTPS websites; after a URL or username change, the old password is not sent to the new address; bulk changes are previewed and written only after you confirm by entering the domain, and can be rolled back | Revoke the application password in WordPress administration, or clear the username under “Websites” |
| Business email password / authorization code | Receive inquiries; send emails when you enable automatic acknowledgments, nurture emails or email notifications | Stored encrypted; inbox opened read-only; only new emails received after connection are processed; pages display only masked values | Invalidate the authorization code in your email administration settings, or delete the account under “Business Email”; encrypted credentials are deleted with it |
| Inquiry email content | AI identifies spam inquiries and customer needs, and assigns salespeople | Stored in your company account with access controlled by user group; salespeople see only their own inquiries; contact details such as phone numbers and addresses in signature blocks are removed before content is sent for AI analysis | Permanently delete an inquiry in its details, or use “Filtering and Assignment” to delete in bulk by date or configure automatic deletion when retention expires |
| Feishu / DingTalk application secret | Direct message notifications and employee sign-in with verification codes | Stored encrypted; pages display only masked values | Reset the secret on the Feishu / DingTalk open platform, or delete it under “Feishu / DingTalk Applications” |
| Payment information | Activate plans and purchase credits | Stripe processes payments; we cannot see or store card numbers | — |
Inquiry bodies are sent to the Google Gemini model for identification (determining whether they are spam, extracting needs and customer leads). Contact details such as phone numbers and addresses in signature blocks are removed before sending. No email content is sent when the AI inquiry feature is not enabled.
Content you enter is sent to the model for processing only when you click submit on the tool page. Each tool page states where processing takes place. Tools marked “Local processing” calculate in your browser without uploading inputs.
First revoke the WordPress application password, invalidate the email authorization code, and remove the group bot; authorization becomes invalid immediately. Then delete the corresponding website, email account and application in the console; the encrypted credentials are deleted with them. You can delete inquiries yourself in the console or configure automatic deletion after a retention period. Contact us to delete an entire company account.
No. Plans are paid in a single payment for a month or a year and remain active until the expiry date. There is no automatic charge on expiry. Configuration and data are retained after the account returns to the free plan.
Stripe processes online payments and supports payment cards and other methods. Companies in China that require a corporate bank transfer or invoice should contact us.
You can try the service for 14 days using just a URL, then provide authorization once you find it useful. Please also report security issues directly to us; we will address them promptly.
