Privacy Policy

1. Information we collect

We collect only what we need to operate the Service:

• Account data: your email address, a hashed version of your password (we never store or see the password itself), and your interface preferences such as language and theme.
• Project data: the website addresses (domains and pages) you add to the Service, competitor addresses you choose to track, and your monitoring settings.
• Content you submit: business descriptions, answers to our questions, feedback, and any other text or materials you provide so the Service can produce better results for you.
• Audit data: the reports, checks, generated recommendations and text suggestions the Service produces for your projects.
• Diagnostic run logs: each time the Service runs a check, it writes a technical log of that run — the questions we sent to the AI providers, their raw answers, and the intermediate steps, including excerpts of the website content being analysed. AI answers are not reproducible, so without such a log we could not tell you afterwards what a particular run actually asked and received. We use these logs only to support you and to fix the Service; they are stored on our own servers in the European Union, and they are never used for advertising or given to anyone outside the recipients listed under "When we share information".
• Payment data: payments are processed by our payment provider. We receive and store transaction records, subscription status and billing history, but we never receive or store your full card number.
• Technical data: IP address, browser and device information, and timestamps recorded in server logs. We use these for security, rate limiting and abuse prevention — including a record of which website domain a free audit was granted for, so a single free check cannot be claimed repeatedly.
• Audience measurement: we count visits to our public pages so we can tell which channels people arrive from. The analytics we use is cookieless — it stores nothing on your device and nothing in your browser, it does not identify you, it does not build a profile of you, and it does not follow you to other websites. Your IP address and browser details are used only to derive a short-lived, one-way hash that lets a repeat page view be counted as the same visit that day; the hash cannot be reversed, and the analytics does not retain your IP address. The measurement script is served from our own domain, it never receives your email address or any account identifier, and browsers sending a "Do Not Track" signal are not counted at all.
• How you found us: when you create an account, we record where you arrived from — the campaign parameters in the link you followed, if any, and the domain (not the full address) of the referring website. This tells us which channels bring us customers, which is how a small service decides where to spend its effort. It is stored with your account, it is never combined with data obtained from other companies, and it never leaves us.
• Cookies and local storage: we use only strictly necessary storage — session tokens that keep you signed in, and two small cookies that remember the interface settings you choose yourself (language, and light or dark theme). We set no advertising cookies, no cross-site tracking cookies and no analytics cookies of any kind, and nothing we store follows you to other websites. That is why you see no cookie consent banner here: there is nothing to consent to. This is a standing commitment rather than a description of today’s configuration — see "What we will never do". If we ever needed storage that is not strictly necessary, we would ask for your consent before setting anything and update this Policy first.

2. Publicly available website content

To produce an audit, the Service fetches publicly available pages of the websites you add — your own or your competitors’ — and may store extracted text snapshots of those pages to detect changes over time. This is public business information, and we process it on the basis of our legitimate interest in providing the analysis you requested. If you believe we have processed content we should not have, contact us and we will review it.

3. How we use your information

• To provide and operate the Service: run audits, generate reports, recommendations and text suggestions, and monitor changes you asked us to monitor, at the frequency your plan and your settings provide.
• To send transactional email: verification codes, password resets, receipts, and audit reports (delivered via our email providers).
• To send occasional product updates and marketing email, which you can opt out of at any time using the unsubscribe link in every such message.
• To prevent fraud and abuse of the Service, including enforcement of usage limits.
• To comply with legal obligations, including tax and accounting rules.
• To improve the Service: we analyse audit results, model answers and usage across accounts to calibrate our scoring, test whether a recommendation actually works, and decide what to build next.
• To measure our own reach: aggregate visit counts for our public pages, and the channel a new account came from, so we know which of our publications and links actually work.
• To produce research and industry statistics: we compile aggregated, anonymised statistics from audits and AI answers — for example, which kinds of sources AI assistants cite in a given industry — and we may publish them in articles, reports and marketing materials. Published figures are always aggregated and never identify you, your company, your website or your competitors.

We use only aggregated, anonymised data when we publish anything. If you would rather your data was not included even in that form, email support@tobecited.com and we will exclude your account. This does not affect the Service you receive.

4. Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we process personal data on the following bases:

• Performance of a contract: creating and running your account, producing the audits and monitoring you asked for, billing, and the transactional email that goes with them.
• Legal obligation: keeping payment and invoicing records for tax and accounting purposes.
• Legitimate interests: keeping the Service secure and free of abuse and enforcing usage limits; measuring how many people visit our pages and which channel they came from; fetching publicly available website content in order to analyse it; improving and calibrating the Service; and publishing aggregated, anonymised research. In each case we have weighed these interests against your rights, which is why the measurement described in this Policy is cookieless, storage-free and never used to profile you.
• Consent: where consent is required for marketing email or for anything else, we ask for it separately, and you can withdraw it at any time without affecting the Service you receive.

You can object to any processing based on our legitimate interests at any time by emailing support@tobecited.com. If you object to audience measurement or to us recording which channel brought you, we will exclude your account from both, and nothing about your use of the Service changes.

5. What we will never do

The commitments below do not depend on which tools or providers we happen to use at any moment. They are the reason this Policy can stay stable while the Service evolves, and we will not weaken any of them without telling you in advance:

• We will never sell personal data, and we will never share it for cross-context behavioural advertising.
• We will never place advertising, ad networks or cross-site tracking technology on the Service.
• Any audience measurement we use will be cookieless and storage-free: it will store nothing on your device, it will not identify you personally, and it will not track you across other websites. If that ever became impossible, we would ask for your consent before switching and update this Policy first.
• We will never publish, or hand to anyone for their own purposes, data that identifies you, your company, your website or the competitors you track. Anything we publish is aggregated and anonymised.
• We will never give your content to anyone for the purpose of training their AI models, and we will never send your account credentials or payment card details to an AI provider.
• Every company that processes personal data on our behalf does so under a written data processing agreement, only on our documented instructions, and either within the European Economic Area or under recognised transfer safeguards.
• We will never ask you for more data than the Service needs to do the job you are paying it for.

6. Processing by AI providers

The core of the Service is querying third-party AI models. To produce results, we send queries and excerpts of website content — and, where you use content-generation features, the descriptions and answers you submit — to third-party AI providers, which currently include OpenAI, Anthropic, Google, Perplexity and DeepSeek. Which models we use changes as models change; the purpose and the categories of data we send do not. This data is processed under those providers’ API terms. We do not include your account credentials or payment details in anything sent to AI providers.

7. When we share information

We do not sell personal data. We share it only with the service providers we need in order to run the Service, and only for the purpose each of them is engaged for. The categories of recipients, and the providers we currently use in each, are:

• Hosting and infrastructure: our servers and our database are located in the European Union (currently in France), and the Service runs on our own machines there.
• Network, DNS and protection against attacks: traffic to the Service passes through Cloudflare, which also routes email sent to our domain.
• Payments: our payment provider (currently Stripe) processes all payments.
• Email delivery: our transactional and notification email provider (currently Resend), plus a backup delivery channel used only for sign-in codes.
• Bot protection: Cloudflare Turnstile checks that sign-up, log-in and password-reset requests come from a person and not an automated script. It runs invisibly on those forms and receives technical signals from your browser, including your IP address. See the Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-addendum/
• Audience measurement: a privacy-focused, cookieless analytics provider that receives only the technical signals described under "Information we collect" and never receives your identity.
• AI providers: as described under "Processing by AI providers".
• Professional advisers: our accountant and, where necessary, legal advisers, bound by professional confidentiality.
• Legal reasons: we may disclose information if required by law or to protect our rights, users or the public.
• Business transfer: if the Service is acquired or reorganized, data may be transferred to the successor under the same protections; we will notify you of any such change.

Providers inside a category may change as the Service evolves. Any replacement is engaged for the same purpose, receives the same categories of data, and is bound by the same protections described in "What we will never do". Because that changes nothing about what we collect or why, we do not reissue this Policy for it — instead, you can ask us for the current list of providers at any time by emailing support@tobecited.com, and we will send it.

8. International data transfers

Our own servers and database are in the European Union. Some of our providers are located outside the European Economic Area, primarily in the United States. Where personal data is transferred internationally, we rely on safeguards such as the EU Standard Contractual Clauses or the provider’s certification under recognized adequacy frameworks, and we assess those safeguards before engaging a provider and when replacing one.

9. Data retention

We keep data only as long as it is useful to you or required of us. Concretely:

• Account and project data — while your account exists.
• Audit reports, monitoring history and snapshots of publicly available website content — 24 months from the date each one was produced, then deleted automatically. This is what lets the Service show you a year-over-year comparison; older points are not needed for that.
• Inactive accounts — if you do not sign in for 36 months, we delete the account and everything in it. We email you 30 days before that happens, and simply signing in stops the deletion.
• If you delete your account yourself, we delete or anonymize your personal data within 30 days.
• Payment and invoicing records — kept for as long as tax and accounting law requires, regardless of the above.
• Diagnostic run logs — 90 days from the run they describe, then deleted automatically. Individual logs may be deleted sooner when the storage set aside for them fills up.
• Server logs — a short period for security and abuse prevention, then deleted.
• Audience measurement — aggregated visit statistics only, kept for a limited period by our analytics provider. They contain no identifier that could be traced back to you, so there is nothing in them to delete on request.
• The channel your account came from — for as long as your account exists, and deleted together with it.

Queries and website excerpts we send to AI providers are retained by those providers under their own terms, which we do not control. You can ask us to delete your data earlier at any time — see "Your rights" below.

10. Automated decisions

The Service produces automated scores, comparisons and recommendations about websites. Those are statements about a website, not decisions about a person: we do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you for advertising, credit or employment purposes.

Automated rules do apply to abuse prevention — for example, declining an additional free audit for a domain that already used one, or blocking a sign-up that trips our limits. If such a rule affects you and you believe it is wrong, email support@tobecited.com and a person will review it.

11. Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority (in Spain, the AEPD).

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not process it for cross-context behavioural advertising. If you are in Canada, you have comparable rights under PIPEDA.

To exercise any of these rights, email support@tobecited.com. We may need to verify your identity before acting on a request, and we respond within the timelines required by applicable law.

12. Security

All traffic to the Service is encrypted in transit (TLS). Passwords are stored only as strong one-way hashes. Access to production systems is restricted. No method of transmission or storage is completely secure, but we work to protect your data using industry-standard measures appropriate to the size of the Service.

13. Children

The Service is intended for businesses and professionals and is not directed to children under 16. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy as the Service evolves. A change is material if it introduces a new purpose for your data, a new category of data we collect, a new category of recipient, or any weakening of the commitments in "What we will never do". For material changes we will post the updated version on this page with a new "Last updated" date and notify you by email or an in-product notice before they take effect.

Some changes are deliberately not material and do not require a new version of this Policy, because they alter nothing about what we collect, why, or how it is protected: replacing one provider with another inside a category and purpose already described here; changes to which AI models we query; and changes to how often monitoring runs or which checks each plan includes, which are described in your account and in our Terms.

15. Contact

For any privacy question or request, email support@tobecited.com. The Service is operated from Spain (European Union); the operator’s legal identification details are available on request.