1. Who we are
CiteMagnet (“CiteMagnet”, “we”, “us”) provides AI-assisted search and AI-search optimization software for small businesses. CiteMagnet runs several niche products on the same platform, and this policy applies to all of them. It explains what personal data we collect when you visit our website or use our service, why we collect it, and the choices you have.
For account and billing data, we act as the data controller. For content we process on your behalf — such as pages from your website — we act as a processor acting on your instructions.
2. Information we collect
Account information. Your name, email address and a securely hashed password. We never store your password in plain text.
Business and site information. The website addresses you add, the business profile you provide (such as address, opening hours, cuisines, menu and reservation links) and the public pages we crawl to audit your site. Audit results, issues, suggested fixes and blog drafts are stored in your account.
Integration credentials. When you connect a site builder, we store the access token, application password or API key it issues. These are encrypted at rest, are never sent to your browser and are used only to perform the actions described in section 5.
Billing information. Payments are handled by Stripe. We receive limited details from Stripe — such as your customer ID, subscription status, plan and billing period — but we never receive or store your full card number.
Usage and device information. Pages you view on our site and product events (for example “audit completed” or “post published”), along with your browser user agent, IP address used for security and session management, the referring page and campaign parameters (such as utm_source) when you arrive from a link.
Free tool data. When you use the free SEO check or AI visibility checker, we fetch the public page (and robots.txt) at the address you enter and may keep the address and result for abuse prevention and to improve the checks. The schema and llms.txt generators run entirely in your browser — nothing you type into them is sent to us.
AI visibility reports. When you create a free AI visibility report, we store the website address, the optional business name, town and kind of business you enter, and the result of the check, so the report can be opened by anyone with its link. Report links are random and not listed or indexed by search engines. If you ask us to email you a report, we keep your email address with the website and the kind of business, send the report once, and don't add you to a mailing list. If you used a partner's embedded widget, we record that partner's ID with the report.
AI-traffic measurement on your site. If you add our snippet to your website, it reports visits that arrive from AI assistants, search engines and other sources: the page path, the referring site and utm_source, a broad device type and an approximate country. It sets no cookies. The browser's user agent is used only to tell people from AI agents and crawlers. These records are stored against your site so you can see your own traffic; we never store visitors' IP addresses with them or use them to identify individual visitors. If you install our WordPress connector, it can also report requests from AI crawlers and assistants to your site (page path, user agent, referring site, response status and time — never IP addresses or cookies). As the site owner, you are responsible for describing this measurement in your own privacy notice where required.
Email. We send account emails and, on plans that include them, scheduled scan reports. You can change which emails you receive in your account settings.
3. How we use your information
- To provide the service: crawl and audit your site, draft fixes and posts, apply them when you approve, and monitor for regressions.
- To create and secure your account, including session management, fraud prevention and rate limiting.
- To process payments and manage your subscription through Stripe.
- To understand how the product is used in aggregate so we can improve it, using first-party analytics only.
- To send essential service messages, such as billing receipts, security notices and changes to these terms.
- To comply with legal obligations and enforce our Terms of Service.
4. AI processing
CiteMagnet uses large language models provided by Anthropic to generate audit summaries, suggested fixes and blog posts. To do this, we send Anthropic the relevant content — for example text and metadata from your public pages, your business profile and the instructions needed to produce a draft.
Anthropic processes this data as our service provider under its commercial terms, which do not permit it to use inputs submitted through its API to train its models by default. We do not send your integration credentials, password or payment details to any AI provider.
AI output can be inaccurate. Drafts are presented for your review, and nothing is published to your site without your approval unless you turn on autopilot features.
5. Site permissions
We only use the permissions you grant when connecting a site builder, and only to do what you've asked: read your content to audit it, apply fixes you approve (or that you've allowed autopilot to apply), and publish posts you approve or schedule. The specific permissions requested are shown on your builder's own consent screen and on our integrations page before you connect.
You can disconnect an integration from CiteMagnet at any time, or revoke access directly in your site builder. When you disconnect, we delete the stored credentials for that integration.
8. Data retention
- Account, site and content data are kept while your account is active.
- When you delete your account, we delete your personal data and site data within 30 days, except where we must keep it longer by law.
- Integration credentials are deleted as soon as you disconnect the integration or delete the site.
- Billing records are kept for as long as required for tax and accounting purposes.
- Analytics events are kept for up to 24 months and then deleted or aggregated so they no longer identify anyone.
- Encrypted backups are overwritten on a rolling basis within 90 days.
9. Security
We use industry-standard measures to protect your data, including encryption in transit (HTTPS), encryption of integration credentials at rest, hashed passwords, httpOnly session cookies and access controls that limit each account to its own sites. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you as required by law.
10. Your rights
Depending on where you live (including under the GDPR, UK GDPR and California law), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can update most information in your account settings, or contact us at hello@citemagnet.com. We will respond within the time required by applicable law.
If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.
11. International transfers
Our service providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.
12. Children
CiteMagnet is a business tool and is not directed to children under 16. We do not knowingly collect their personal data.
13. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new “last updated” date and, for material changes, notify you by email or in the app before they take effect.
14. Contact us
For privacy questions or requests, email hello@citemagnet.com.