CiteSitePrivacy policy
Last updated 31 August 2026
CiteSite measures how visible a website is in Google and in AI assistants. To do that it stores the domains you ask it to track, what it finds, and an email address to sign you in. This page says exactly what that means, and who else your data reaches.
1.Who is responsible
CiteSite operates this service and is responsible for the data described below. For anything in this policy, including a request to see a copy of your data or to have it deleted, contact contact@citetech.site.
Where this policy uses the words “controller” and “processor”, we are the controller of your account and of the measurements taken for the sites you track.
2.What we collect
Your email address — Held so you can sign in and so we can send the reports you ask for. We use magic links and Google sign-in, so we never receive or store a password.
Billing details — Your plan, subscription status, trial dates and renewal date, plus identifiers issued by Stripe. Card numbers are entered on Stripe’s systems and never reach ours.
The websites you track — The domains you enter, publicly reachable pages we crawl from them, and any competitor domains you add.
What we measure — Search queries and AI prompts associated with your site, the answers engines gave, which brands and sources those answers named, position data, on-page audit findings, the actions we derive, drafts generated for you, and a history of your scores over time.
Product analytics — Only if you agree. See section 6.
We do not ask for, and have no use for, special category data. Please do not put personal information into a prompt or a content draft.
3.Why we are allowed to hold it
Most of it is performance of a contract: you asked for a measurement service and it cannot run without the domain, the prompts and the results. Billing records are held to meet a legal obligation. Product analytics rest on your consent, and nothing analytics-related loads until you give it.
4.Who else sees your data
These are our processors. Each receives only what its job needs, and none of them is permitted to use your data for their own purposes.
| Processor | Purpose | What it receives |
|---|---|---|
| Supabase | Database and sign-in | Your email address and everything measured for your projects |
| Vercel | Hosting | Request metadata, including IP address, in the ordinary course of serving the site |
| Stripe | Payments and subscriptions | Your email address and payment details, which you give it directly |
| Resend | Sending email | Your email address and the contents of the report |
| OpenAI | Asking ChatGPT what it says about your market | The prompt text, which names your brand and category |
| Google (Gemini) | Asking Gemini the same | The prompt text |
| Perplexity | Asking Perplexity the same | The prompt text |
| Anthropic | Drafting content and summarising findings | Your site content and the findings being written up |
| A search-results provider | Google positions for tracked queries | The query and your domain |
| Google Analytics | Product analytics, only with consent | Usage events, after you agree |
One thing worth being plain about: to measure whether an AI assistant mentions you, we have to ask it. The prompts we send name your brand and your market. They do not contain your email address, your billing details or anything else about you personally.
We do not sell your data, and we do not share it for advertising.
5.Where it is held
Our database and our email sender are hosted in the United States. The AI and search providers above operate internationally. Where data leaves the UK or EEA, it does so under the transfer safeguards those providers offer, typically Standard Contractual Clauses.
6.Cookies and browser storage
We set a small number of cookies to keep you signed in. Those are strictly necessary and cannot be turned off without breaking sign-in.
Analytics is different. Google Analytics does not load at all until you choose “Allow” on the banner. Choose “No thanks” and the script is never requested, so no analytics cookie is ever set.
The rest is kept in your browser and never sent to us:
citesite-analytics-consentyour answer to the analytics bannercitesite-themelight, dark or systemcitesite-sunset-graina display preferencecitesite:tips-dismissedwhich first-visit tips you closedcitesite:tours-seenwhich guided tours you have seencitesite-fired-*milestones already counted, so they are not counted twice
7.How long we keep it
Measurements are kept while the project exists, because the product is a record of change over time and a history you cannot see is not worth taking.
Deleting a website in Settings removes that project and everything measured for it, and it cannot be undone. Billing records are kept for as long as tax and accounting rules require, which is longer than your account may last.
To close your account entirely, use the danger zone in Settings. It deletes your account, every website on it and everything measured for them, and it cancels any subscription so you are not billed again. You do not need to ask us, and we cannot undo it afterwards.
8.Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or withdraw consent for analytics at any time. Pro accounts can export everything measured for a project from Settings without asking us at all.
Every report we email carries a one-click unsubscribe that needs no sign-in, and you can switch the weekly report off on its own page. Sign-in emails are not marketing and cannot be unsubscribed from while your account is open.
If we get something wrong you can complain to your data protection authority. In the UK that is the Information Commissioner’s Office.
9.Security
Traffic is encrypted in transit. Access to your rows is enforced by the database itself through row-level security, so a project can only be read by the account that owns it rather than relying on the application to remember to check.
No system is perfect. If you find a vulnerability, please report it to contact@citetech.site before disclosing it publicly.
10.Changes
If this policy changes in a way that affects you, we will say so by email rather than quietly changing the date at the top. The terms of service cover the rest of the relationship.