Live - tracking ChatGPT, Gemini & ClaudeNew - Google AI Overviews & DeepSeek on the roadmapFree audit - see how AI sees youEvery metric ships a 95% confidence range
Start free
Legal

Privacy Policy

What we collect, why we collect it, who processes it, and the rights you have over it.

CitedOSLast updated: July 4, 2026

This policy explains how [LEGAL ENTITY NAME] (“CitedOS”, “we”, “us”), registered at [REGISTERED ADDRESS], handles personal data when you use citedos.com and the CitedOS platform. We are the data controller for account data; for the brand data inside your workspace we act on your instructions. Short version: we collect the minimum needed to run an AI-visibility measurement service, we use no advertising trackers, and we never sell personal data.

1. Data we collect

  • Account data — your email address, display name (optional) and a bcrypt-hashed password. We never store passwords in plain text.
  • Workspace configuration — the brands, competitors, topics and prompts you set up for tracking. This is business data about companies, though names or URLs you enter may incidentally contain personal data.
  • Measurement data — answers and citations collected from the ChatGPT, Gemini and Claude APIs for your prompts, and copies of the publicly available web pages those answers cite. This is content about the public web, not about you.
  • Usage data — server logs (IP address, user agent, timestamps, requested routes) and in-product events, used for security, debugging and capacity planning.
  • Billing data — handled by LemonSqueezy as merchant of record. We receive order metadata (plan, status, order ID, billing email) but never your full card number.

2. Why we process it (purposes and legal bases)

  • Providing the service (contract) — running your measurement cycles, storing results, showing dashboards and reports.
  • Billing and account management (contract, legal obligation).
  • Security and abuse prevention (legitimate interest) — protecting accounts, rate-limiting, fraud prevention.
  • Service improvement (legitimate interest) — aggregated, de-identified statistics about how the product is used.
  • Transactional email (contract) — receipts, security notices, service messages. Marketing email only with your consent, with a working unsubscribe.

3. Processors and subprocessors

We use a small set of infrastructure providers to run CitedOS. Each processes data only to provide its function to us:

  • Vercel — application hosting and content delivery.
  • Supabase — managed Postgres database where account and workspace data live.
  • LemonSqueezy — payments, tax and receipts as merchant of record (it is an independent controller for the checkout it operates).
  • OpenAI, Google and Anthropic — we send your configured prompts (buyer-intent queries, not your personal data) to their APIs to measure engine answers.
  • ScrapingBee — fetches the public web pages cited in engine answers for source analysis.
  • Trigger.dev — background job infrastructure that orchestrates collection and analysis pipelines.

Some providers process data in the United States and the EU; where transfers out of the EEA/UK occur, they rely on recognized safeguards such as Standard Contractual Clauses or an adequacy framework. We will update this list before adding a subprocessor that handles personal data.

4. Cookies and local storage

We use session cookies only — the first-party authentication cookies set by our sign-in system (a JWT session cookie plus its CSRF companion). They are essential, so no cookie banner consent is required for them. Your light/dark theme choice is stored in your browser’s localStorage and never leaves your device. We set no third-party advertising or analytics cookies.

5. Retention

  • Account and workspace data — kept while your account is active, and deleted or de-identified within 90 days of account deletion, except where law requires longer (e.g. billing records).
  • Measurement history — kept while the workspace exists, because trends over time are the product; deleted with the workspace.
  • Server logs — retained for a short rolling window, typically 30–90 days.

6. Your rights

If you are in the EEA, UK or another jurisdiction with similar law, you have the right to access your personal data, rectify inaccuracies, request erasure, receive a portable copy, object to or restrict certain processing, and withdraw consent where processing is based on consent. Email support@citedos.com and we will respond within 30 days. You also have the right to complain to your local supervisory authority.

7. What we do not do

  • We do not sell or rent personal data. Ever.
  • We do not run advertising or share data with ad networks.
  • We do not use the content of your workspace to train foundation models, and our measurement prompts contain your market queries, not your personal data.

8. Security

Data is encrypted in transit (TLS) and at rest by our database provider; passwords are bcrypt-hashed; access to production is restricted and authenticated; API keys are shown once and stored hashed. No system is perfectly secure — if we learn of a breach affecting your data we will notify you without undue delay.

9. Children

CitedOS is a business tool and is not directed at children under 16. We do not knowingly collect their data.

10. Changes and contact

We will post updates here and, for material changes, notify you by email or in-product notice; the “Last updated” date above reflects the current version. Contact: support@citedos.com · [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. See also our Terms of Service and Refund Policy.