Privacy Policy

1. Who We Are

This Privacy Policy explains what information GetCited.me ("we", "our", or "us") collects, how we use it, and the choices you have. GetCited.me is a Generative Engine Optimization (GEO) platform that helps businesses monitor and improve their brand's visibility in AI-generated answers.

The controller of your personal data is the individual entrepreneur (FOP) Zidu Linda Petrivna, taxpayer number 3394504883, Unified State Register entry No. 2000640010002049835 dated 29.10.2020, registered at apt. 46, bldg. 1, 23 1st Tank Brigade St., Chernihiv, 14032, Ukraine, email support@getcited.me.

We process personal data under the Law of Ukraine "On Personal Data Protection" and, where it applies to you, the EU General Data Protection Regulation (GDPR).

By using our website and product (the "Service"), you agree to the collection and use of information as described in this policy.

If you have any questions or requests regarding your data, contact us at support@getcited.me.

2. What Data We Collect

2.1. Account data

• Email address: used for sign-in, password recovery, and transactional emails.
• Password: stored only as a salted bcrypt hash; we never store or see your plain-text password.
• Name and avatar: if you provide them in your profile settings.
• Google account data: if you use Sign in with Google, we receive and store your Google account ID, name, and email, and copy your Google profile picture to our own storage. We do not receive your Google password. You can disconnect Google sign-in at any time in Settings.
• Team members: if you invite a colleague, we store their email address and any job title and article byline (title and short bio) you enter for them, and email them an invitation link that stays valid for 7 days. Only a one-way hash of the invitation token is stored. By inviting a colleague, you confirm that you may share their details with us and that you have told them about this policy.

2.2. Website and brand data you submit

When you connect a website or run a scan, we collect and process:

• The URLs you submit and publicly available content from those pages (page text, headings, meta descriptions) for brand-profile analysis and GEO audits.
• Brand names, competitor names and URLs, topic clusters, and the questions you track (created or approved by you).

Our crawler only accesses publicly available pages. It does not crawl private or authenticated areas of your website. If you install the WordPress plugin, it reports an inventory of your published pages from inside WordPress - see section 2.10 for exactly what it sends.

2.3. Tracking and analysis data

• AI platform responses to the questions we track on your behalf, including mention detection, brand rankings, sentiment, and citation sources.
• Search-demand and keyword data for your topics obtained from third-party SEO data providers.
• Publicly available community discussions (for example Reddit, Hacker News and Stack Overflow threads) relevant to your brand, when you use community-reply features.
• If you add the public Reddit profile you reply from (Settings → Integrations), we store its address and username and read that profile's public activity once a night to estimate how likely your replies are to survive moderation. We never ask for your Reddit password and never post on your behalf.

2.4. Generated content

Content briefs, article drafts, community reply drafts, recommendations, and audit reports created by our AI pipelines for your use. This content belongs to you (see our Terms of Service).

• The in-app assistant. Your conversations with the visibility assistant are stored with the project so the thread can continue, and are processed by an AI model through OpenRouter (section 5).
• Share links. When you share an audit checklist or a client report, anyone with the link can open it until you revoke it. The shared page contains no email addresses; we count how often it was opened and its buttons were pressed, without recording who did it.

2.5. Usage and billing data

• Feature-usage counters used to enforce plan limits (number of tracked questions, AI answer credits, content drafts, audits, and similar metered actions). Usage events are retained for up to 365 days.
• Payment and subscription records. Card payments are processed by JSC "Universal Bank" (monobank) on its own secure page: your card number, expiry date and CVV are entered there and we never receive or store them. We store: the masked card number (for example 4444 **** **** 1234), the card's issuing country and payment system, amounts and statuses of charges and refunds, invoice and transaction identifiers, and the card token and wallet identifier issued by the bank (needed for auto-renewal and mid-period website additions). If you provide them, we also store the optional "buying for a business" flag and your VAT ID.
• Consent records. When you agree to automatic monthly charges, we store the version of the consent text, a hash of its wording, the date and time, the plan, amount and number of websites shown to you, and your account identifier.

2.6. Communication data

A delivery log of emails we send you (recipient address, subject, delivery status), and your notification preferences.

2.7. Feedback and waitlist submissions

When you send feedback or join the waitlist for paid plans, we collect what you enter together with context about the request itself:

• Feedback: your rating, message and category, plus the page URL, locale, timezone, screen and viewport size, app build, referrer, IP address, browser user-agent and country code, so we can reproduce what you saw. Your account is linked if you are signed in. The feedback form lists every one of these fields before you submit.
• Waitlist: your email address, the record of your consent and the time you gave it, which page or button you joined from, the plan you were viewing, and the same request context (locale, page URL, referrer, IP address, user-agent, country code). Your account is linked if you are signed in.

The waitlist is the only place we ask for permission to send you a marketing email - see sections 4, 8 and 9.

2.8. Advertising click measurement

When you arrive from one of our Google Ads adverts, the link carries a Google click identifier (gclid, or its gbraid / wbraid variants). If you then start a free scan, we store that identifier on the guest-scan record so we can count how many people who clicked an advert went on to finish onboarding.

Two things this deliberately is not:

• It is not stored on your device. The identifier is held in the page's memory for that visit only and is never written to a cookie or to local storage.
• It is not sent back to Google. We use it solely to count our own funnel. It is not used to build a profile of you, to target advertising, or to report conversions to any advertising platform.

It is deleted together with the guest-scan record under the retention rules in section 8.

2.9. Google Search Console connection

Connecting Google Search Console is optional. Nothing else in the product depends on it, and a website that never connects it works exactly as it did before.

• What we ask for. Read-only access to Search Console performance data - the webmasters.readonly scope and nothing else. It cannot change a setting, submit a sitemap, or write anything at all to your property. You choose which property is connected, and we never see your Google password.
• Why. So the questions we track are grounded in the searches your site already receives, rather than only in what a model inferred from your pages. The real queries sit next to your AI-visibility numbers, and the Pages screen shows which of your own pages Google already sends traffic to.
• What we store. Daily aggregates for the connected property - clicks, impressions and average position, by page and by search query - together with the authorisation token that lets us read them, and, for your site's pages, whether Google reports each one as indexed (Search Console's URL Inspection result). The token is stored encrypted at rest. We do not read anything else in your Google account.
• Who sees it. Search Console data belongs to the project, so every member of the project's team - the owner and every invited collaborator - sees the same Google figures in the product, and so do WordPress administrators on a site paired with the GetCited.me plugin (section 2.10). Only the project owner connects, changes or disconnects Search Console.
• How long. For as long as the connection exists. When you disconnect, we delete the stored daily clicks, impressions, positions and search queries together with the token, and ask Google to revoke the authorisation. The per-page index status already checked stays with the project until you delete the website or your account.
• Limited use. This data is used only to provide the visibility features you see in the product. We do not sell it, we do not share it with data brokers or advertisers, we do not use it for advertising or personalisation, and we do not use it to train AI models - ours or anyone else's.

You can also revoke our access at any time from your own Google Account, under third-party access (myaccount.google.com/permissions), independently of anything you do here.

A plain-language description of the connection is published at /features/search-console.

2.10. WordPress plugin

The GetCited.me WordPress plugin is optional and is downloaded from /wordpress (it is not listed in the WordPress plugin directory). It makes no outbound call until you connect it to your account with a one-time code.

• Pairing. The plugin sends the code, your site URL, the address of its own verification route and your wp-admin address. We then fetch that verification route over the public internet and require the random value the plugin is serving there, which proves the site is yours. Only then do we issue the plugin a credential bound to that one project.
• What the plugin sends to us. With every request: your site URL, the environment type WordPress reports (production, staging, development or local), and your WordPress, PHP and plugin versions. Shortly after pairing, then once a day and whenever an administrator asks for a sync: an inventory of your published posts and pages - for each one its ID, URL, slug, post type, title, publication and last-modified dates, the editor or page builder that produced it, its heading outline, its first paragraph, its word count, how many lists and tables it contains, whether it has an FAQ block, which structured-data types it declares, the SEO title and meta description your SEO plugin holds for it (and which plugin that is), whether it is marked noindex, a one-way hash of its text used only to tell whether the page changed, and whether the plugin could read the page at all. Post bodies are never sent beyond that first paragraph, and drafts, private and password-protected content are never sent.
• Article status reports. For a post created from a GetCited.me article, the plugin reports its ID and edit-screen address when the draft is created or goes back to draft, the date WordPress will publish it when you schedule it, its permalink and publication date once you publish it, and the word "trashed" or "deleted" when it is removed - never its content. On the plugin's screens it also sends what you ask for: the status tab, page number and search text of the article list, an audit checklist item you tick, or the audit you re-check.
• What we send to your site. Your visibility figures, per-page citation counts, your GEO audits, suggested page fixes, the generated site files, and the briefs and articles prepared for that project - for an article, its text, SEO fields, FAQ, poster link and photographer credit, and the author byline (name, job title and short bio) if you set one. A poster you uploaded to GetCited.me is downloaded once by your server into your Media Library; images inside an article keep their original addresses, so visitors' browsers load them from GetCited.me, Unsplash or the website they came from.
• Who in WordPress sees what. The plugin's screens require the WordPress capability to manage options (administrators). Google figures from Search Console - on the Overview, the Pages screen and the clicks shown in the Posts list - are shown to administrators only; authors and editors see AI citation counts, never your Google numbers. Listing articles requires the capability to edit others' posts, and creating a draft requires the capability to edit posts.
• No visitor data. The plugin sends no data about your site's visitors or readers, no IP addresses, and no WordPress user accounts or passwords.
• Where the credential lives. On our side, only a one-way hash of the plugin's credential is stored; it expires after 365 days and is revoked when you disconnect. On your side, the plugin stores the credential in your WordPress database (the getcited_me_auth option), where - like any WordPress option - it is readable by site administrators and by other plugins on that site.
• Free answer credits. On the free plan, a site whose plugin stays connected and has reported within the last 30 days receives 40 answer credits on the 1st of each month, while that month's budget for the grant lasts; this requires the plugin to keep reporting. Disconnecting, revoking the credential or removing the plugin stops the next month's grant.
• Disconnecting and uninstalling. Disconnecting - from the plugin or from your account - revokes the credential and stops all reporting; the page inventory and article statuses already received stay with your project until you delete the website or your account. Uninstalling the plugin removes everything it stored in WordPress, including the credential, its settings and the post metadata it wrote; it does not delete posts you created from GetCited.me articles.

When the plugin is downloaded from our site, we log the plugin version, the country derived from network headers, the referring page and the browser user-agent to count downloads. The IP address is not logged; it is used only in hashed form to rate-limit downloads.

2.11. Prismic publishing and article translation

Connecting a Prismic repository is optional, and only the project owner can connect, change or disconnect it; team members can send articles to it once it is set up.

• What we store. The repository name, the Prismic write token you paste (and, for a repository with a private API, a Content API access token), the field mapping you choose, the repository's locales and an optional public URL pattern. Both tokens are encrypted at rest (AES-256-GCM) and are never shown again - the product displays only the last four characters.
• What we send to Prismic. When you send an article, we create draft documents in your repository through Prismic's Write APIs: the article's title, slug, body, and - where you mapped them - meta title, meta description and cover image. A cover you uploaded to GetCited.me and the images inside the article text are uploaded to your repository's media library, with their alt text; Unsplash photos are never copied. We also read your repository's custom types and locales to build the mapping, and, if you ask us to, add a "Blog post" type to the repository. We never publish: every document lands as a draft in the repository's Migration release, and you publish it in Prismic.
• Machine translation. If you choose extra locales, the article - its title, meta fields, excerpt, body, image alt text and captions, and FAQ - is translated by an AI model (currently a Google Gemini model) reached through OpenRouter (section 5), with your brand and site names passed along as terms to keep untranslated. The translated article is stored with the source article, keyed by a hash of the source text, so an unchanged article is never translated twice.
• Disconnecting. Disconnecting deletes the stored repository connection, both tokens and the mapping. Our record of which documents were created in Prismic and the stored translations stay with the article until you delete the article, the website or your account. Documents and images already created in Prismic stay in your repository, and disconnecting cannot revoke the write token in Prismic - revoke it there if you no longer need it.

Copy-and-paste publishing destinations (Dev.to, Medium, Substack, your own site and plain Markdown) send nothing from our servers: the article is copied to your clipboard and, where there is one, the destination's editor opens in a new tab. What you paste there is between you and that platform.

2.12. Voice dictation

On paid plans you can dictate the description of a custom article brief instead of typing it. The recording is sent to OpenRouter, which passes it to a speech-to-text model (currently OpenAI's gpt-4o-mini-transcribe), and the text is returned to you as spoken - it is not translated or rewritten. The audio is held in memory only for the duration of that request and is never stored by us; for usage metering we record only the clip's length.

2.13. API access tokens and the MCP server

You can issue access tokens so your own AI assistant or coding tool can read your project's data through our MCP server. For each token we store only a one-way hash, a short prefix for recognition, its scopes, the websites it may access, its expiry (365 days at most) and when it was last used. Data requested with a token goes to whichever client you configured it in; that client and the AI provider behind it are your choice and operate under their own terms. A revoked token stops working at once and is deleted 30 days later. The WordPress plugin's credential (section 2.10) is a token of this kind, limited to one project.

3. Cookies

We keep cookies to a minimum. We do not set advertising or cross-site tracking cookies on this site, and we do not run remarketing or ad-personalisation tags: our advertising measurement works by importing conversion counts from Google Analytics 4 (see section 5), not by tagging you for ads.

• Authentication cookies: keep you signed in to your account (strictly necessary).
• getcited-cookie-consent: stores your cookie category choices for up to 12 months (strictly necessary for consent records).
• getcited-theme: remembers your light/dark theme preference for up to 1 year (functional).
• getcited-app-sidebar-collapsed: remembers whether the app sidebar is collapsed or expanded for up to 1 year (functional).
• Payment page cookies. Card payment happens on the monobank payment page (pay.monobank.ua or its successor domain). That page may set its own cookies needed to process the payment securely; they are governed by the bank's policy. The "Payment cookies" preference in our consent UI is informational for our consent log and does not block cookies set on the bank's page.
• Analytics cookies (optional): Google Analytics 4 and Google Tag Manager, loaded only after you accept analytics cookies in our cookie consent banner. You can change your choice at any time via Cookie settings (/cookie-settings) or the preference center.

We operate our own cookie consent banner and preference center on GetCited.me. Non-essential analytics scripts are not loaded until you grant analytics consent. A public cookie inventory is available at /cookie-settings.

3.1. Consent audit records

When you accept, reject, or save cookie preferences, we store a consent audit record on our servers for compliance evidence. Each record may include:

• The action you took and the category choices (essential, functional, analytics, payment), including previous choices when you change them
• Consent and privacy-policy version identifiers
• Locale, page URL, and HTTP referrer at the time of the choice
• Approximate time recorded on your device and on our server
• IP address, browser user-agent, and country code derived from edge/network headers when available
• An optional visitor fingerprint stored in your browser’s localStorage (key fingerprint) after your first consent action (accept, reject, or save preferences) - used to rate-limit audit submissions, to link anonymous consent rows to your account after you sign in, and optionally for short-lived abuse-protection counters; it is not generated on every page load before you interact with the banner
• Your account id when you are signed in

Consent audit records are retained for up to 36 months, then deleted automatically. If you delete your account, the account id is cleared from remaining rows; the rows themselves are kept until the retention period ends.

3.2. Infrastructure analytics

Our hosting edge (for example Cloudflare) may inject a performance/Web Analytics beacon that is not controlled by our cookie preference center. We do not use that beacon for advertising. If enabled on our zone, it is treated as infrastructure measurement; see also our CSP allowlist for static.cloudflareinsights.com.

We also use Sentry for application error monitoring and performance diagnostics (client and server). Sentry is treated as reliability/security infrastructure and is not gated by the analytics cookie category. Session Replay, if enabled, captures limited UI context around errors; we configure it to avoid collecting passwords and other sensitive form fields where possible.

3.3. Abuse protection counters

To protect the Service from automated abuse, we temporarily count requests by a hashed or otherwise anonymized network address and, after you make a cookie-consent choice (accept, reject, or save preferences), optionally by the visitor fingerprint described above. These short-lived rate counters are kept in Redis for no more than 24 hours and are not used for advertising, marketing, or profiling.

4. How We Use Your Data

Your data is used exclusively to provide and improve the Service:

• To analyze your brand's visibility across AI platforms and generate visibility reports
• To create the questions we track and ask them on AI platforms on your behalf
• To generate content recommendations, briefs, article drafts, and audit findings
• To deliver what you connect: your data in the WordPress plugin, article drafts in your WordPress site or Prismic repository, machine translations of articles you send to Prismic, and Search Console figures beside your AI visibility
• To monitor competitor presence and market positioning
• To enforce subscription plan limits and process payments. Legal bases for payment data: performance of the contract (charging, auto-renewal, prorated changes, refunds); legal obligation (accounting and tax reporting); legitimate interest (fraud prevention, handling disputes and chargebacks)
• To send transactional and product emails: account and password emails, visibility alerts, weekly digests, and billing notices (alert and digest emails can be managed in Settings)
• To email people who joined the paid-plans waitlist when those plans launch. We ask for explicit consent before adding you, we use the address only for that purpose, and every such email carries an unsubscribe link. The lawful basis is your consent, which you can withdraw at any time (section 9)
• To secure the Service and prevent fraud and abuse

5. Third-Party Services

We use the following third-party processors to operate the Service. Each receives only the data needed to perform its function:

• JSC "Universal Bank" (monobank), Ukraine: internet acquiring and card tokenization for auto-renewal. Receives the payment amount, order description, your email for the payment receipt, and the card details you enter on its page.
• Brevo (SMTP): email delivery. Receives your email address and the content of emails we send you: transactional account email, visibility alerts and digests, team invitations (the invited colleague's address and the inviter's name), payment and refund notices, and, if you joined the waitlist, the notice that paid plans have launched.
• Google Analytics 4 / Google Tag Manager: site analytics and optional third-party tags, only after you accept analytics cookies in our consent banner. Product usage events (for example onboarding steps, hub actions, and checkout) are sent to GA4 via direct measurement after consent. The GTM container must not duplicate GA4 configuration tags when direct measurement is enabled.
• Google Ads: we advertise GetCited.me on Google Search. Campaign performance is measured by importing conversion counts from Google Analytics 4, so what Google Ads receives is derived from the analytics data you consented to. We do not place a Google Ads remarketing tag on the site, and ad personalisation and Google Signals are disabled on our properties. If you reject analytics cookies, none of your activity reaches this measurement.
• Sentry: error monitoring and diagnostics for the Service (not an advertising or marketing analytics tool).
• AI platforms - OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), Perplexity: we ask their models the questions you track to measure brand visibility. Gemini is called through Google's own API; ChatGPT, Claude and Perplexity are reached through OpenRouter by default, or through their own APIs as a fallback. For tracking, only the question text is sent - no account data, no personal data, and no private content from your website. Google's Gemini API and Perplexity also run some research steps (brand and competitor analysis), for which they receive your brand name, website address, industry, brand description and the paths of your site's pages.
• OpenRouter: AI model routing: for the tracked questions above, and for content generation and analysis (briefs, article drafts, audits, response analysis, the in-app assistant), translation of articles you send to Prismic (section 2.11) and speech-to-text for voice dictation (section 2.12). Receives the working context needed for the task, such as publicly available content from your website, your brand description, cited source URLs, article text, your messages to the assistant and dictation audio. It forwards each request to the model provider that serves it (for example OpenAI, Anthropic, Google or Perplexity). It does not receive your account credentials or billing data.
• DataForSEO: keyword volume, search-demand, Google AI Overview (SERP) and backlink data for the topics and domains you track.
• Reddit and PullPush: public community threads are retrieved via Reddit's public APIs and the PullPush Reddit archive when you use community discovery features.
• Hacker News (Algolia search) and Stack Exchange: public threads are searched with terms related to your topics when you use community discovery features.
• Other public data sources: the YouTube Data API (details of videos that AI answers cite, looked up by video ID), Wikidata (brand-name lookups), WordPress.org (public statistics of competitors' plugins) and, where enabled, Proxycurl (follower counts of competitors' LinkedIn company pages). They receive only search terms, IDs or public addresses - never your account data.
• Unsplash: stock photos for article covers. Receives search terms derived from the article's title or keywords. Photos stay hosted by Unsplash, so a browser displaying one requests it from Unsplash.
• Cloudflare: DNS and the network edge in front of our site and API, which handles your IP address and request headers, and, where enabled, a Turnstile bot check on guest scans and free tools, which receives your IP address and browser signals.
• Prismic (optional, your repository): receives the articles and images you choose to send, as described in section 2.11. What happens to them there is governed by your own agreement with Prismic.
• Google Search Console (optional): a source rather than a recipient: with the read-only access you grant, we read search performance for the property you connected. Nothing about you is sent to Google beyond the read request itself. See section 2.9.
• Google (Sign in with Google): optional authentication; see section 2.1.

Requests we route through OpenRouter go only to endpoints whose providers' policy is not to train on request data: our OpenRouter account excludes every endpoint, paid or free, that may train on request data or publish it. This is an account setting rather than something our code enforces on each request, and we do not require Zero Data Retention, so a provider may still keep request data for a limited time under its own policy - for example to monitor abuse. Requests we send directly to a provider's own API are governed by that provider's commercial API terms.

Some of these processors operate outside Ukraine (for example in the EU and the United States), so the data they receive is transferred abroad. Each receives only the data its function needs, as listed above.

The Service contains links to third-party websites, including the sources cited in AI answers. This policy does not apply to those websites; read their own privacy policies before sharing personal data with them.

6. What We Do Not Do

• We do not load analytics or advertising cookies before you consent
• We do not ask for or knowingly collect special categories of personal data (racial or ethnic origin, political, religious or philosophical beliefs, trade union membership, criminal convictions, health, sex life, biometric or genetic data). Please do not enter such data into the Service
• We do not sell or rent your data, and we do not share it with data brokers or with other companies for their own advertising
• We do not add you to any mailing list without an explicit opt-in, and we do not use the waitlist address for anything other than the launch notice
• We do not use your private data to train AI models
• Our crawler does not access private or authenticated pages on your website. The WordPress plugin, which you install yourself, reports only published posts and pages that are not password-protected, and never their full text
• We do not send your account or contact details to AI platforms - tracking requests contain only the text of the question being tracked. What you yourself type to the assistant or dictate is sent to the model that processes it (sections 2.4 and 2.12)
• We do not publish anything on your WordPress site or in your Prismic repository: we create drafts, and you decide whether to publish them
• We do not ask for more than read-only access to Search Console, and we never write anything to your property
• We do not keep your Search Console clicks, impressions, positions or search queries after you disconnect, and we never use Search Console data for advertising or model training

7. Data Storage & Security

Your data is stored in a PostgreSQL database with encryption in transit (TLS). Files you upload (avatars, article images) are stored on our own servers; we do not use a third-party file-storage service. Security measures include:

• Passwords hashed with bcrypt (12 rounds); refresh tokens, MCP access tokens, the WordPress plugin's credential, WordPress pairing codes and team invitation tokens stored only as one-way hashes
• Integration secrets - the Google Search Console authorisation and your Prismic tokens - encrypted at rest with AES-256-GCM
• Short-lived access tokens with rotating refresh tokens; password reset links expire after 1 hour
• Access controls, input validation, and hardened HTTP security headers on our API
• Access to production systems restricted to authorized personnel only

No method of transmission or storage is 100% secure, but we work to protect your data with measures appropriate to the risk.

Payment data is processed in Ukraine by the bank. If you are in the EU/EEA, the transfer of payment data to Ukraine is necessary to perform the contract you requested (Art. 49(1)(b) GDPR).

8. Data Retention & Deletion

• Active accounts: we retain your data for as long as your account is active.
• Website deletion: when you delete a website from your dashboard, all associated data (tracked questions, tracking runs, topic clusters, competitors, drafts, reports, Search Console data, the WordPress page inventory and publishing records) is permanently removed.
• Account deletion: you can request deletion of your entire account. We cancel any active subscription immediately (no further charges are made; payment and consent records described below are kept as required by law) and permanently delete your account, all connected websites, uploaded files, and associated data. Deletion is available from within the product or by contacting support@getcited.me.
• Guest scans: websites analyzed during onboarding without an account are automatically deleted within approximately 24 hours if not claimed.
• WordPress plugin: the page inventory and article statuses the plugin reported are kept until you delete the website or your account; disconnecting revokes the plugin's credential and stops new reports (see section 2.10).
• Prismic: disconnecting deletes the stored connection, tokens and mapping at once; records of the documents created and stored translations are kept until you delete the article, the website or your account (see section 2.11).
• Voice recordings: never stored (see section 2.12).
• Access tokens: a revoked token's record is deleted 30 days after revocation (see section 2.13).
• Team members: an invitation link expires after 7 days. A member's record - email, job title and byline, including for an invitation you revoked - is kept with your account until you delete the account; write to us if you need one removed sooner.
• Search Console data: kept while the connection exists. Disconnecting deletes the stored daily rows (clicks, impressions, positions and search queries) and the authorisation token, and we ask Google to revoke the authorisation. Per-page index status is kept until the website or account is deleted (see section 2.9).
• Usage events: metering records are retained for up to 365 days for plan-limit enforcement and dispute resolution.
• Payment, refund and invoice records: retained for the period required by Ukrainian tax and accounting law (3 years; the Tax Code of Ukraine sets at least 1,095 days for primary documents), even after account deletion.
• Card token: kept while auto-renewal is on or a card is saved. When you remove the card, turn off auto-renewal and the paid period ends, or delete your account, we ask the bank to delete the token.
• Consent records for automatic charges: retained for the term of the subscription plus the statutory limitation period (3 years) to evidence consent in case of a dispute.
• Cookie consent audit logs: retained for up to 36 months, then purged automatically (see section 3.1).
• Advertising click identifiers: the Google click identifier described in section 2.8 is erased 90 days after the visit. What remains is only a flag recording that the visit came from an advert - it contains no identifier and is kept with the funnel statistics.
• Waitlist entries: retained for up to 24 months from the day you joined, or until you unsubscribe or withdraw consent - whichever comes first - then deleted.
• Feedback: retained while it is useful for product decisions and support history, and deleted on request (section 9).

9. Your Rights

Under Article 8 of the Law of Ukraine "On Personal Data Protection" and, depending on your jurisdiction, other laws (including the GDPR if you are in the EU/EEA), you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent for optional processing - analytics cookies, email digests, and the paid-plans waitlist - at any time
• Lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, your local supervisory authority, or a court

To leave the waitlist, use the unsubscribe link in the email or write to support@getcited.me; withdrawing does not affect the lawfulness of anything sent before you withdrew. Analytics consent can be changed at any time via Cookie settings (/cookie-settings).

Deletion requests do not cover records we are legally required to keep, such as payment, refund and invoice records.

To exercise any of these rights, contact us at support@getcited.me. To protect your data, we act on requests sent from your account email or may first ask you to confirm that you are the account holder. We will respond within 30 days.

10. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may change this Privacy Policy by publishing a new version on this page with the date it takes effect. For every substantive change (a provision added, removed or changed in meaning), we email account holders a link to the new version and the date it takes effect at least 14 days before that date. Corrections that do not change the meaning (typos, formatting, updated contact or registration details) take effect on publication without an email. Continued use of the Service after the effective date means you accept the new version; if you disagree, you can delete your account before that date (section 8).

• 21 October 2026: controller registration details added; the Ukrainian personal data law and complaint authority named; transfers outside Ukraine, third-party links, special categories of data and team members' data clarified; changes are now announced by email 14 days ahead.
• 16 October 2026: payment processor changed to JSC "Universal Bank" (monobank); controller details added.

12. Contact Us

Questions about this policy or your data: support@getcited.me.

Controller:

• Individual entrepreneur (FOP) Zidu Linda Petrivna
• Taxpayer number (RNOKPP): 3394504883
• State registration: Unified State Register entry No. 2000640010002049835 dated 29.10.2020
• Single tax payer, group 3, not a VAT payer
• Registered address: apt. 46, bldg. 1, 23 1st Tank Brigade St., Chernihiv, 14032, Ukraine
• Email: support@getcited.me