Privacy Policy

citeproduct is a GEO (AI search readiness) audit tool at citeproduct.com: you give it a URL, it scores how well AI engines can read and cite the page, asks named AI engines the questions your buyers actually ask, and returns copy-paste fixes.

citeproduct is operated by an individual based in Australia. In this policy, "we", "us", and "citeproduct" refer to that operator. This policy covers the citeproduct.com website and the citeproduct service (together, the "Service").

citeproduct is currently a free, invite-only beta. For any privacy or legal request, contact us at [email protected].

We collect only what we need to run the Service. Specifically:

• Account data. Your email address; your password, stored only as a salted hash (never in plain text); your account creation date; your email notification preferences (such as a weekly digest and alerts) together with an unsubscribe token; your email-verification status; and a credit balance.
• Authentication tokens and session cookie. Single-use, expiring tokens for password reset and email verification, and an essential session cookie (set via NextAuth) that keeps you signed in.
• Scan data. The website URLs you submit; the publicly available page content we fetch from those URLs in order to analyze them; and the scores, reports, and recommendations we generate. Please submit only URLs you own or are otherwise permitted to analyze.
• Technical and IP data. Your IP address (used for rate limiting and abuse prevention, processed via Cloudflare) and standard request metadata.
• Analytics (when enabled). When a Google Analytics 4 measurement ID is configured, Google Analytics collects usage and page-view data and sets analytics cookies. When no measurement ID is configured, this does not run.
• Waitlist and demo leads. If you join the waitlist or request a demo, the email address and any details you provide.

We use the information above to:

• provide, operate, and secure the Service;
• authenticate you and keep your session active;
• send transactional emails (such as password resets and verification) and opt-in emails (such as a weekly digest or alerts) you have asked to receive;
• prevent abuse and apply rate limits, so the Service stays available and fair;
• improve the product by understanding how it is used and where it can work better.

Legal bases (GDPR). For visitors in the EU and EEA, we rely on: performance of a contract (providing the Service you sign up for); legitimate interests (keeping the Service secure, preventing abuse, and improving the product); and consent (for marketing emails and for analytics cookies, where consent is required). You can withdraw consent at any time.

• Essential session cookie. We set a single sign-in and session cookie (via NextAuth) so you stay logged in. The Service cannot function without it.
• Google Analytics cookies (when enabled). When a Google Analytics measurement ID is configured, Google Analytics sets analytics cookies to measure usage and page views.

We do not use third-party advertising cookies, and we do not run advertising trackers.

We use a small set of service providers to run citeproduct. Each processes data only for the purpose described, and all may process data outside Australia (primarily in the United States):

• Railway. Application hosting and database storage.
• Cloudflare. CDN and security (WAF); processes your IP address and traffic.
• OpenRouter. Routes AI model requests for AI visibility scans and the visibility snapshot; receives the analyzed page content or URL and the generated prompts.
• OpenAI, Perplexity, and Google (Gemini). Queried (directly or via OpenRouter) to assess AI visibility and citations; they receive generated buyer questions and brand names, not your account credentials.
• Zoho ZeptoMail. Sends transactional and notification emails; receives the recipient email address and the message content.
• Google Analytics (Google LLC). Usage analytics, when enabled.

We do not sell personal data, and we do not share it for third-party advertising. We may disclose information if required by law or to protect the rights, safety, and security of our users and the Service.

Because our providers operate globally, your personal data may be processed in the United States and elsewhere outside your home country. Where applicable, we rely on our processors' safeguards (for example, standard contractual clauses) to protect data transferred internationally.

We keep your account data, scan data, and reports until you delete your account or ask us to delete them. Security logs and IP records are kept for a limited period for abuse prevention and troubleshooting, then discarded.

To delete your account and the data associated with it, email [email protected] and we will action your request.

Australia (Privacy Act 1988 and the Australian Privacy Principles), our primary framework. You have the right to access and correct your personal information, to ask how it is handled, and to opt out of direct marketing. You may also complain to the Office of the Australian Information Commissioner (OAIC).

EU and EEA (GDPR). You have the rights of access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent at any time. You may complain to your local supervisory authority.

Japan (APPI). Requests from users based in Japan are handled in accordance with applicable law.

To exercise any of these rights, or to delete your account, email us at [email protected]. We will respond within the time required by applicable law.

We protect your data with encryption in transit (HTTPS), passwords stored only as salted hashes, and access controls that limit who can reach your information. No method of transmission or storage is 100 percent secure, so we cannot guarantee absolute security, but we work to keep your data safe and to address issues promptly.

The Service is not directed to children. We do not knowingly collect personal information from anyone under 16 (or the age of majority in your jurisdiction, if higher). If you believe a child has provided us personal information, contact [email protected] and we will delete it.

We may update this policy as the Service evolves. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

Paid plans (when available). citeproduct is currently free and invite-only. Paid plans (such as a Pro plan, around USD $19.90 per month) are planned but not yet available. When payment launches, the applicable pricing, billing, and refund terms will be presented to you at the point of purchase and reflected here.

For any privacy question or request, email [email protected]. This policy is governed by the laws of [State or Territory], Australia, and any disputes will be brought before the courts of [State or Territory].