Privacy policy

Who we are

Cited is run by Cited LLC, a California limited liability company (“Cited”, “we”, “us”). This policy covers cited.io, the Cited app at app.cited.io and the services we provide through them (the “Service”).

What we collect

• Account details: your name, email address and password, and your organization and workspaces, such as business names, websites, locations and the people you invite.
• What you add: the prompts, competitors, keywords and settings you track, and what you send us when you contact us or book a call.
• Connected Google accounts: the data you allow us to see and change, described below.
• Usage data: technical details such as IP address and browser, recorded to run and secure the Service, and on cited.io, the pages you visit and where you came from (see Cookies).

We use this information to provide and improve the Service, keep it secure, support you, and meet our legal obligations.

Google user data

If you connect a Google account, you sign in on Google’s own screen. Google lists each permission Cited asks for, and you choose which to allow. We ask for the narrowest permission Google offers for each product. Depending on what you allow, we can:

• Google Search Console (view only): see your sites’ search performance, such as searches, clicks, impressions and positions. Cited can’t change anything in Search Console.
• Google Analytics (view only): see the Analytics properties you can open, so you can pick your website’s, and its reports: visits by where they came from, such as Google search or AI assistants like ChatGPT, engaged visits, key events, and the pages search visitors land on. Cited can’t change anything in Analytics.
• Google Business Profile: see your listing’s details and performance, such as calls, direction requests and website clicks. Google grants this as one permission that also allows edits, so with it we can update your business details, publish posts and reply to reviews.
• Your Google account’s email address: so you can see which account is connected.

We change something in your Business Profile only when you allow it on Google’s screen and you ask us to, or your order with us includes that work, such as a post we’ve agreed with you. Any other work our team does in your Google accounts, such as fixing a Search Console setting, uses access you give our team in Google itself, not your Cited connection. We never delete your Search Console sites, Analytics properties or Business Profile listings, and we never change who has access to them.

We use this data only for the features you see in Cited: the Google page, your reports, and the changes you ask for. To write the plain-language summary in your reports, we send figures from them to our AI provider, which processes them for us and doesn’t use them to train its models.

If you hire our team, the strategists and copywriters working for you can see this data to do that work. Otherwise, no one at Cited reads it unless you ask us to, it’s needed for security, or the law requires it.

We store your access token encrypted, and delete it when you disconnect or delete your account. You can disconnect in Cited at any time, or remove access on Google’s account permissions page.

We don’t sell Google user data, use it for advertising, or use it to train AI models.

How we protect your data

We protect your personal information and the Google user data you connect, which we treat as sensitive, in these ways:

• Encryption in transit: cited.io and the Cited app work only over HTTPS (TLS), and browsers are told never to connect without it. Our connections to Google, our database and our other service providers are encrypted too.
• Encryption at rest: we keep your Google access as a refresh token encrypted with AES-256-GCM, under a key stored apart from the database. The short-lived tokens that read your data stay in memory and are never written down. Our database and file storage encrypt everything they hold with AES-256.
• Keeping less: Cited reads your Search Console and Analytics numbers from Google when you open the Google page or a report, and doesn’t keep a copy of them in our database. It keeps only which site and property you picked.
• Access controls: each customer’s data is kept apart from every other customer’s, and every request is checked against the signed-in person’s organization and role. Passwords are stored only as salted hashes.
• Staff access: our team opens your account only to support you or do the work you hire us for, through a staff login with limited permissions, and what it changes is recorded in your account’s activity log.
• Logs without your data: our error logs leave out your data and the values in database queries.
• Incidents: if a security incident affects your information, we’ll tell you and the authorities as the law requires.

Sharing

We don’t sell personal information. We share it only with service providers that run the Service for us under confidentiality, when you ask us to, when the law requires it, or as part of a sale or merger of our business.

Cookies

The Cited app uses only the cookies it needs, such as to keep you signed in. On cited.io, we also use Google Analytics to count visits and see where they come from, such as Google search or AI assistants. It sets its own cookies, except for visitors in the European Economic Area, the UK and Switzerland, whose visits are counted without cookies. We turn off Google’s advertising features and signals, and we don’t use advertising cookies.

Google processes this visit data for us under its privacy policy. You can block it with your browser’s settings or Google’s opt-out add-on.

Keeping information

We keep information while your account is open or as needed to provide the Service, and delete it when you ask, except what the law requires us to keep. Cited is based in the United States, and information may be processed there and in other countries.

Your rights

You can ask us to access, correct, delete or export your personal information, and we’ll answer within 30 days. Depending on where you live, such as California or Europe, you may have more rights under local law. The Service isn’t meant for anyone under 16.

Changes

We’ll update the date at the top when this policy changes, and tell you before a significant change takes effect.