Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("CiteFlo," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the CiteFlo AI search visibility tracking service available at citeflo.app and related applications (the "Service").

By creating an account or using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, do not use the Service.

CiteFlo is operated by [LEGAL ENTITY NAME], a [STATE] [limited liability company / corporation], located at [BUSINESS ADDRESS]. For privacy questions, contact us at [PRIVACY EMAIL].

1. Summary

We collect the information you provide when you create an account and set up projects (such as your email, the websites and brands you choose to track, and your keywords), information generated when the Service runs scans on your behalf, and standard technical and usage data. We use this to provide and improve the Service, process payments, and communicate with you. We share data only with the service providers that make the Service work (listed in Section 6), and we do not sell your personal information. Depending on where you live, you may have rights to access, correct, or delete your data (Sections 9 and 10).

2. Information We Collect

2.1 Information you provide

Account information: your name (if provided), email address, password (stored hashed, never in plain text), and whether you identify as a brand or an agency.
Project and tracking data: the website domains, brand names, page URLs, keywords, prompts, and competitors you enter or upload in order to track your AI search visibility. This may include business information about your own company or, if you are an agency, about your clients' businesses.
Billing information: when you subscribe to a paid plan, our payment processor collects your payment details. We do not store full payment card numbers on our servers (see Section 6, Stripe).
Communications: information you provide when you contact us for support or sales inquiries.

2.2 Information generated by the Service

Scan results: when the Service scans AI engines on your behalf, we collect and store the results, including how AI engines respond to your tracked queries, the brands and competitors mentioned, placement and recommendation data, sentiment, cited sources, and the text of AI responses. We also collect search volume, cost-per-click, and intent data associated with your keywords.
Derived analytics: visibility scores, share-of-voice metrics, per-engine performance, trend data, and reports generated from your scan results.

2.3 Information collected automatically

Usage data: how you interact with the Service, such as pages viewed, features used, and actions taken.
Device and technical data: IP address, browser type, device type, operating system, and similar technical identifiers.
Cookies and similar technologies: we use cookies and similar technologies for authentication, security, preferences, and analytics. See Section 8.

We do not intentionally collect sensitive personal information (such as government identifiers, health, or biometric data) and ask that you not submit it through the Service.

3. How We Use Information

We use the information we collect to:

Provide, operate, and maintain the Service, including running scans, generating analytics, and producing reports;
Create and manage your account and authenticate you;
Process transactions and manage subscriptions;
Communicate with you about your account, the Service, updates, security notices, and support requests;
Send you reports and, where you have opted in or where permitted, other communications about the Service;
Monitor, analyze, and improve the Service, including debugging, performance, and developing new features;
Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms of Service;
Comply with legal obligations and enforce our agreements.

Legal bases (for EEA/UK users)

Where the EU or UK General Data Protection Regulation applies, we process personal data on the following legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to operate, secure, and improve the Service), balanced against your rights; your consent (where required, such as for certain cookies or marketing); and compliance with legal obligations.

4. AI Engines and Scan Activity

A core function of the Service is submitting queries you configure to third-party AI engines (such as those operated by OpenAI, Anthropic, Google, and Perplexity) and to search-data providers, then recording and analyzing the responses. When the Service runs a scan:

The queries submitted are derived from the keywords and prompts you configure. They are generally about businesses and services (for example, "who is the best pest control in [city]"), not about individuals.
The responses returned by those engines are stored in your account as scan results and used to generate your analytics and reports.
These third-party engines and data providers process the queries under their own terms and privacy policies. We do not control how those third parties handle the queries we submit.

You are responsible for ensuring that the keywords, prompts, URLs, and other data you submit do not violate the rights of others or any applicable law.

We do not sell your personal information. We share information only as described below:

Service providers (subprocessors): with the third-party vendors that host, power, and support the Service, listed in Section 6. They may process your information only to provide services to us and are bound by contractual confidentiality and data-protection obligations.
Payment processing: with our payment processor to handle subscriptions and billing.
Legal and safety: when we believe disclosure is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, property, or safety of CiteFlo, our users, or others.
Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.
With your direction: where you ask us to share information, or where you use features (such as exporting or sharing reports) that make information available to others.
Agency and client relationships: if you use the Service as an agency to manage projects on behalf of clients, you are responsible for your handling of any client data you enter, and for having the necessary rights and permissions to do so.

6. Subprocessors

We rely on the following third-party service providers ("subprocessors") to operate the Service. Each processes data only as needed to provide its function:

Supabase — database hosting, authentication, and storage of your account and application data.
Vercel — application hosting and delivery of the Service.
Stripe — payment processing and subscription management. Stripe collects and processes your payment information under its own privacy policy; we do not store full card details.
DataForSEO — search data provider, used to obtain search volume, cost-per-click, and search-results data for your keywords.
AI engine and model providers — including OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini and Google AI Overviews), and Perplexity, to which the Service submits your configured queries and from which it records responses.

We may update this list as our providers change. Material changes will be reflected in an updated version of this Policy.

7. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. Scan results, analytics, and trend data are retained to maintain your historical trends and reporting. After you close your account, we will delete or de-identify your personal information within a reasonable period, except where we are required or permitted to retain it (for example, for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes) or where it exists in routine backups that are deleted on a rolling schedule.

You may request deletion of your data as described in Sections 9 and 10.

8. Cookies and Similar Technologies

We use cookies and similar technologies to:

Keep you signed in and secure (strictly necessary cookies for authentication and session management);
Remember your preferences;
Understand usage and improve the Service (analytics).

Strictly necessary cookies are required for the Service to function. For non-essential cookies, where required by law we will obtain your consent. You can control cookies through your browser settings, though disabling some cookies may affect how the Service works.

9. Your Rights (EEA, UK, and Similar Jurisdictions)

If you are located in the European Economic Area, the United Kingdom, or a jurisdiction with similar laws, you have the right to:

Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten"), subject to certain exceptions;
Restrict or object to certain processing;
Data portability — receive your data in a structured, commonly used, machine-readable format;
Withdraw consent at any time, where processing is based on consent;
Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at [PRIVACY EMAIL]. We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on a request.

International data transfers

We are based in the United States, and your information will be processed in the United States and in other countries where our subprocessors operate. These countries may have data-protection laws different from those in your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers of personal data.

10. Your Rights (California and Other US States)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to:

Know what personal information we collect, use, and disclose;
Access and delete your personal information, subject to exceptions;
Correct inaccurate personal information;
Opt out of the "sale" or "sharing" of personal information — note that we do not sell or share personal information as those terms are defined under California law;
Non-discrimination for exercising your rights.

Residents of other US states with comprehensive privacy laws may have similar rights. To exercise any of these rights, contact us at [PRIVACY EMAIL]. We will not discriminate against you for exercising your rights. We may need to verify your identity before responding.

11. Security

We implement technical and organizational measures designed to protect your information, including encryption in transit, row-level security controls on our database, hashed password storage, and access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

12. Children's Privacy

The Service is intended for businesses and is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13. Third-Party Links

The Service and its outputs may contain links to third-party websites (for example, source URLs cited by AI engines). We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Service or by email. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

[LEGAL ENTITY NAME]
[BUSINESS ADDRESS]
[PRIVACY EMAIL]

This document is a template and does not constitute legal advice. You should have it reviewed by qualified legal counsel before relying on it, particularly regarding your specific jurisdiction, entity structure, and data practices.