Privacy Policy

From you directly: your name, email address, business name and website, billing details (held by Stripe; we never see card numbers), and anything you type into the dashboard (prompts, competitor names, brand-kit edits).

From your website: we scrape your public pages to extract your brand voice, services, and on-page SEO state. We only fetch pages reachable from a browser. We don’t bypass logins, paywalls, or robots.txt blocks.

From AI engines: the verbatim text of AI responses to your tracked prompts, plus any source URLs the engine cited. We store these so we can show you where you were named and prove the work.

Automatically: normal server logs (IP, user agent, timestamps) for security and debugging. No advertising cookies. No cross-site tracking.

We use your data to run the product you’re paying for: write and publish your articles, track your AI visibility, audit your site and draft fixes, publish them when you’ve connected an integration, and email you weekly reports. We do not sell your data, ever. We do not share your prompts, brand kit, or audit results with anyone outside Citeca except the AI providers that write your content and answer the questions we track for you.

When you connect an integration (WordPress, Webflow, Google Business Profile, etc.), the access tokens are AES-256-GCM encrypted at rest and only decrypted in-process at publish time. They never leave our servers.

To run the product we use a small set of trusted infrastructure providers. Each one only sees the data they need:

• Stripe: payment processing. Sees your billing email and card details only.
• Supabase: auth and database hosting. Holds your account record and all dashboard data, encrypted at rest.
• Google Cloud Run and Vercel: application hosting. Sees request data in transit.
• Resend: transactional email (sign-in links, weekly reports). Sees your email address.
• OpenAI, Anthropic, Google Gemini: research and writing. They see the brand kit, site content and topics needed to draft your articles.
• OpenAI, Anthropic, Google Gemini, Perplexity, SerpAPI: AI visibility tracking. They see only the questions we ask on your behalf.
• Firecrawl: used as a fallback site scraper when sites block standard requests. Sees only the URL we ask it to fetch.

You can edit or delete anything you’ve put into the dashboard from Settings. To delete your entire account and all associated data, email contact@citeca.ai from your account address. We confirm by email once your account is deleted. Backups that contain your data are purged within 30 days.

If you’re in the EU, UK, or California you have additional rights (access, portability, objection). Same email address.

We use first-party cookies strictly for auth (your sign-in session). No analytics cookies, no advertising cookies, no third-party trackers. If we ever add product analytics, this page will be updated and you’ll be told upfront.

Citeca is a B2B service. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we’ll delete the account immediately.

When we change this policy in a way that affects you, we’ll email every active customer at least 14 days before the change takes effect. The effective date at the top of this page always shows the current version.

Email contact@citeca.ai or read our Terms of Service.