1. Information we collect
When you request a scan, we collect the submitted website, market, business category, and email address. We also collect public business facts and public page content from the submitted website and related business-profile sources.
When you subscribe, Stripe processes payment and billing information. We receive identifiers, subscription status, plan, customer email, and limited billing metadata, but not complete card numbers.
We may collect basic technical records such as IP-derived abuse signals, request time, browser or device information, authentication events, and product events. Rate-limit identifiers are stored as one-way hashes.
2. How we use information
- run, store, and email the requested report;
- create and manage accounts, subscriptions, and customer support;
- prepare requested fixes and managed fulfillment work;
- prevent abuse, fraud, unsafe URL access, and provider-cost overruns;
- debug, secure, and improve the service;
- comply with law and enforce our terms.
3. Service providers
Cited uses service providers that process data on our behalf: Vercel for application hosting and workflows; Supabase for database, authentication, and storage; DataForSEO for search and AI-surface data; Stripe for billing; Resend for transactional email; and Cloudflare for DNS, network services, and Turnstile abuse prevention. Their own privacy terms apply to their processing.
4. Sharing
We share information with the providers above only as needed to operate Cited. We may also disclose information to comply with legal obligations, protect users or the service, investigate fraud, or complete a business transaction subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioral advertising.
5. Report links and accounts
Free reports use long, unguessable links and are marked not to be indexed. Anyone you share a report link with may be able to view that report. Paid dashboard access uses email-based authentication. Do not share sign-in links.
6. Cookies and local storage
Cited uses necessary authentication cookies and may use short-lived browser storage for form or interface state. Cloudflare Turnstile may set or read data needed to distinguish legitimate requests from abuse. Cited does not currently use third-party advertising cookies.
7. Retention
We keep scans, reports, and account records while they are needed to provide the service, maintain history, resolve disputes, and meet legal obligations. Security and rate-limit records may be retained for a shorter operational period. Billing records may be retained as required for tax, accounting, fraud, and legal purposes.
8. Security
We use access controls, row-level database policies, encrypted transport, secret-managed credentials, signed payment webhooks, URL safety checks, and abuse controls. No service can guarantee absolute security. Do not submit passwords, private keys, health data, or other sensitive personal information to a scan form.
9. Your choices
You may request access, correction, deletion, or a copy of personal information, subject to applicable law and legitimate retention needs. You may cancel a subscription through the Stripe billing portal. Cited sends operational email needed to deliver requested scans and manage the service; we do not require marketing consent to receive a requested report.
10. Children and international use
Cited is a business service and is not directed to children under 13. If you use Cited outside the United States, information may be processed in the United States and other locations where our providers operate.
11. Contact
For privacy requests or questions, email morais.aaron@gmail.com. We may ask you to verify control of the relevant email or business before completing a request.