Privacy Policy

1. Introduction

CiteReach ("we," "us," "our") operates the AI visibility monitoring platform at citereach.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account information: Email address, full name, and company name — provided through Google OAuth sign-in.
• Brand profile: Brand name, brand name variations, brand description, website URL, industry, product categories, primary and secondary keywords, target audiences, differentiators, use cases, and geographic focus.
• Competitor information: Names and priority levels of competitors you choose to track.
• Free audit submissions: Domain URL and email address submitted for the free visibility audit.
• Custom prompts: Any monitoring prompts you create manually.

2.2 Information Generated by the Service

• Monitoring prompts: AI-generated prompts created from your brand profile to monitor your visibility.
• Check results: Responses received from AI engines when prompts are submitted, including the full response text, token counts, response duration, sources cited, and our analysis (brand mention detection, position, sentiment, competitor mentions, citation tracking).
• Analytics data: Aggregated metrics derived from check results — visibility scores, mention rates, citation rates, trend data, competitor comparisons, and coverage analysis.
• Scoring data: Priority scores assigned to each prompt based on insight value, volatility, coverage contribution, and relevance.

2.3 Information Collected Automatically

• Authentication tokens: Session tokens managed by Supabase Auth for maintaining your logged-in state.
• Billing identifiers: Subscription IDs and customer IDs from our billing provider (Polar.sh) to manage your subscription. We do not store credit card numbers or payment details directly.

3. How We Use Your Information

We use your information to:

• Deliver the Service: Generate monitoring prompts, query AI engines, analyze responses, calculate analytics, and display your dashboard.
• Manage your account: Authenticate you, manage your subscription, and process tier changes.
• Send communications: Deliver free audit results, weekly visibility reports, and important service notifications (e.g., subscription changes, Terms updates).
• Improve the Service: Analyze usage patterns in aggregate to improve our algorithms, scoring models, and user experience.
• Lead conversion: Follow up with free audit users who have not yet subscribed. You may opt out of marketing emails at any time.

4. Third-Party Services

We use third-party services to operate the platform. We do not sell your personal information. The services we rely on include:

• Supabase (database and authentication)
• OpenAI, Anthropic, Google, and Perplexity (AI engine providers)
• Polar.sh (billing and payment processing)
• Resend (email delivery)
• Upstash (caching)

Each provider operates under its own privacy policy. When we query AI engines, prompts may reference your brand name, competitors, or industry as part of the monitoring question, but we do not send your personal information (email, name, etc.) to AI providers.

5. Data Storage and Security

Your data is stored in a Supabase-hosted PostgreSQL database. We use TLS encryption for all data in transit and rely on Supabase's infrastructure security for data at rest.

Access to production data is limited to authorized personnel. Authentication is handled by Supabase Auth with Google OAuth — we never see or store your Google password.

Payment information is processed entirely by Polar.sh. We do not store credit card numbers, bank account details, or other payment credentials on our servers.

6. Data Retention

• Account data: Retained for the duration of your account. Upon account deletion, we will remove your personal data within 30 days.
• Check results and analytics: Retained for the duration of your subscription to provide historical trend data. Deleted within 30 days of account closure.
• Free audit data: Lead information (email, domain, audit results) is retained for up to 12 months, or until you request deletion.
• Billing records: Retained as required by applicable tax and financial regulations.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data for marketing purposes.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, reach out on X (@sambamdamnn). We will respond within 30 days.

8. Cookies and Local Storage

CiteReach uses minimal browser storage:

• Authentication cookies: Set by Supabase Auth to maintain your logged-in session. These are essential for the Service to function.
• Local storage: Used to persist UI preferences (e.g., analytics time range selection, dismissed banners). No personal data is stored in local storage.

We do not use third-party tracking cookies, advertising pixels, or analytics services that track you across other websites.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

10. International Data Transfers

Your data may be processed in countries other than your own, as our infrastructure providers (Supabase, AI engine providers, Polar.sh) operate globally. By using the Service, you consent to the transfer of your data to these jurisdictions. We ensure that our providers maintain appropriate security measures.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a prominent notice on the Service. The "Effective date" at the top of this page indicates when the policy was last revised.

12. Contact

For privacy-related questions or to exercise your data rights, reach out on X (@sambamdamnn).