Privacy Policy

Who is responsible

Citeify is run by WHP Creative (WEHAVEPOWERS (WHP) CREATIVE LTD., company number 06776349, registered office Suite 5 Manor Farm Court, Old Wolverton Road, Old Wolverton, Milton Keynes, MK12 5NN), which is the data controller for what this page describes. Questions and requests about your data go to hello@citeify.ai.

What we collect

• Your email address, to sign you in and send you reports. If you sign in with Google we also receive the name on that account; we ask Google for nothing beyond your email and basic profile.
• The domains you enter and the public pages of those sites, which we read to write the buyer questions and to score readiness. We keep the text we read with the run it belongs to.
• Run results: the questions asked, the engines' answers, the scores, findings and fix briefs, and the reports built from them.
• Billing references. Stripe takes and holds your card details; we never see the card number. We keep your Stripe customer id and the invoice and subscription references we need to run your plan.
• Technical records: the IP address and browser of each request, kept briefly for rate limiting, bot protection and fixing faults.
• Anything you email us.

Why, and on what basis

To provide the service you asked for (performing our contract with you); to keep the service secure, stop abuse and understand how it is used (our legitimate interests); to keep accounting records (legal obligation); and, only if you accept it, to measure the marketing site with analytics (your consent).

Cookies

Signing in sets geo_session, a signed cookie that keeps you signed in for 30 days, and geo_signed_in, which only tells the site to show your account menu. Google sign-in sets geo_oauth for a few minutes while the handshake completes. The dashboard remembers your sidebar and last domain in sidebar_state and last_domain. None of these track you. Google Analytics runs on the marketing pages only after you accept it in the cookie notice, and its cookies are not set before then; your choice is remembered in your browser.

Who else handles it

We use these providers to run the service, each only for the purpose named: Vercel (hosting the site, United States), Supabase (the database, United States), Fly.io (the server that runs audits, London), Stripe (payments), Twilio SendGrid (email), Inngest (scheduling runs) and Google (sign-in and, with your consent, analytics). To measure your domain we send the buyer questions and your domain name, never your personal details, to the AI engines we test: OpenAI, Anthropic, Google, Perplexity and xAI, and to SerpApi for Google AI Overviews. Where a provider is outside the UK, the transfer is covered by the UK's international data transfer rules, and we do not sell your data to anyone.

How long we keep it

For as long as you have an account. You can delete a domain and all of its runs from its settings, revoke any share link, and delete your whole account from Settings, which cancels any live plan first and removes your domains, runs, reports and share links. Invoices are kept for six years because tax law says so. Provider backups are cleared on their own schedules.

Your rights

Under UK data protection law you can ask for a copy of what we hold about you, have it corrected or deleted, take it elsewhere, or object to how we use it. Email hello@citeify.ai and we will answer within a month. If you are not happy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Everything travels over HTTPS. Sign-in cookies are signed and cannot be read by scripts. Our providers encrypt data at rest. Reports are private to your account unless you share a link.

Children

The service is for businesses and is not aimed at anyone under 18.

Changes

When this policy changes the date at the top changes with it, and for anything material we will email account holders first.