Privacy Policy

• Account data — your email address and authentication credentials (passwords are handled by our auth provider; we never see them in plain text).
• Scan data — the URLs you submit and the publicly available page content we crawl to analyze them, plus the analysis results and reports we generate.
• Payment data — processed by our Merchant of Record (Paddle or Lemon Squeezy). We do not collect or store your full card details; we receive limited transaction and status information to fulfill your purchase.
• Usage & product analytics — first-party events about how the site and product are used (e.g. page views, scan starts, unlock steps), tied to a random identifier — used to improve the funnel and product.
• Communications — emails we send you (e.g. report links, account and billing notices) and any messages you send us.
• Security signals — data used to prevent abuse (e.g. anti-bot verification and rate-limiting).

• To provide the Service — run scans and AI-citation probes, generate reports and pages, and deliver results;
• To process purchases and manage subscriptions (via our Merchant of Record);
• To send transactional and account emails;
• To secure the Service, prevent abuse, and enforce our Terms;
• To understand and improve the product through aggregate analytics.

We share data with the following providers only as needed to run the Service:

• Supabase — authentication and database hosting.
• Railway and Vercel — application and website hosting.
• OpenRouter and the underlying AI providers (e.g. Perplexity, OpenAI, Anthropic, Google) — to analyze pages and probe whether AI engines cite a site. Submitted URLs, crawled public page content, and query text may be sent to these providers.
• Paddle / Lemon Squeezy — payment processing as Merchant of Record.
• Resend — sending transactional email.
• Cloudflare Turnstile — bot / abuse prevention.

We do not sell your personal data. We may disclose data if required by law or to protect our rights, users, or the Service.

Our providers may process data in countries outside your own, including the United States and the European Union. We rely on those providers’ safeguards for such transfers.

We use browser local storage to keep you signed in and first-party storage for essential and analytics purposes. We do not use third-party advertising trackers.

We keep account, scan, and report data for as long as your account is active or as needed to provide the Service and meet legal obligations. You can ask us to delete your data (see below).

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, email founder@citepack.com and we will respond within a reasonable time.

We use reasonable technical and organizational measures to protect your data. No method of transmission or storage is perfectly secure, but we work to safeguard your information.

The Service is not directed to children under 16, and we do not knowingly collect their data.

We may update this Privacy Policy; the “Last updated” date above reflects the latest version. See also our Terms of Service.