Privacy Policy

Welcome to Citable ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website getcitable.com and use our services.

By using our service, you agree to the collection and use of information in accordance with this policy.

2.1 Personal Information

When you register for an account, we may collect:

• Name and email address
• Company name and website URL
• Payment information (processed securely through Stripe)
• Account credentials (passwords are encrypted)

If you sign up for our newsletter on getcitable.com, we collect your email address. We keep it on our newsletter list, which Resend holds for us (see 4.1), and use it to send you the newsletter. You can unsubscribe at any time.

2.2 Google Sign-In Data

If you choose to sign in or register using Google Sign-In ("Continue with Google"), we receive the following information from your Google account:

• Name - Your display name from your Google profile
• Email address - Your primary Google email address
• Google account identifier - A unique ID used to link your Google account to your Citable account

Sign-In requests only the minimum scopes necessary (profile and email). Signing in does not grant Citable access to any other Google service — connecting Google Analytics, Search Console, or Google Ads is a separate, optional step you authorize individually (see 2.3). Your Google account password is never shared with or stored by Citable. Google Sign-In data is used solely for account authentication and creating your Citable account.

2.3 Google Connector Data (Analytics, Search Console, Ads)

Citable can connect to your Google properties so it can measure how AI search engines affect your traffic and rankings. Each connection is optional, initiated by you, and authorized separately from Sign-In. We request these scopes:

• analytics.readonly (Google Analytics 4) — read-only. We list the GA4 properties you can access so you can choose one, then read traffic and conversion reports for the property you select, in order to attribute sessions and orders to AI-assistant referrals. We cannot modify or delete anything in your Analytics account.
• webmasters (Google Search Console) — read and write. We read Search Console performance data (queries, impressions, clicks, position) and URL inspection results to report how your pages are indexed and found. The write half of this scope is used for one purpose only: submitting a sitemap for pages you publish through Citable, so they are indexed faster. We do not remove properties, users, or existing sitemaps.
• adwords (Google Ads) — used only if you connect Google Ads, to read campaign and spend data so paid traffic can be separated from organic and AI-referred traffic.

We store the OAuth access and refresh tokens for these connections so scheduled reports can run without you re-authorizing each time, along with the reporting data we import. You can disconnect any connector at any time from the Connectors page. Disconnecting stops all further access and data collection immediately; for Google Analytics the stored connection is deleted outright, and for Search Console and Ads it is marked revoked and retained for audit, subject to the retention periods in section 7. To withdraw the grant on Google's side as well, use your Google Account permissions page.

2.4 Usage Data

We automatically collect certain information when you visit our service:

• IP address and browser type
• Pages visited and time spent on pages
• Operating system and device information
• Referral source and exit pages

2.5 Cookies and Tracking

Our websites, getcitable.com and app.getcitable.com, use cookies, browser storage, pixels and similar technologies. Some are our own. Others belong to the analytics and advertising companies named below, which collect information directly from your browser when you visit. Some cookies are first-party cookies, set on our own domain (such as the Google Analytics cookie). Others are third-party cookies, set on another company's domain (such as Google's advertising cookies).

Running the service

• A sign-in cookie that keeps you logged in and protects your account. Citable does not work without it.
• Browser storage that remembers your settings, such as the workspace you last opened.

Our own measurement

• A page-view log in our own database: the page and its title, the page that referred you, your browser, your screen width, how long you stayed and, if you are signed in, your account ID.
• Cookies that record how you first reached us, so that when you sign up we can record which campaign brought you: the campaign tags in the link you followed, the referring website and your first page (citable_attrib, 30 days); a ChatGPT ad click identifier (citable_oppref, 30 days); the free AI-readiness report you viewed (citable_free_analysis, 30 days); and a referral partner's code (citable_ref, 90 days). When you follow a referral link, we also record that visit's IP address, browser and referring page.

Analytics

• Google Analytics records the pages you view and how you use them, such as scrolling, following links to other sites, downloading files, filling in forms, searching and playing videos, along with your device, browser and approximate location. It uses first-party cookies such as _ga.
• PostHog records the pages you view and leave, your clicks, clicks that get no response, and errors in the page, and records your sessions so we can replay how you used our pages. Recordings can include information shown on screen in your Citable account. Text you type into form fields is masked. When you are signed in, we send PostHog your account ID, name and email address, and your workspace's name, status and plan, and whether a partner manages its billing. PostHog stores an identifier in your browser, including in a cookie that getcitable.com and app.getcitable.com share, so it can recognize a visitor to our marketing site who later signs up.
• Microsoft Clarity makes session recordings and heatmaps: your mouse movements, clicks and scrolling, and the pages as they appear to you, along with device and browser information. It uses first-party cookies (_clck, _clsk). Microsoft may also set its own third-party cookies, such as MUID, which Microsoft uses for advertising, site analytics and other purposes. Microsoft processes Clarity data under the Microsoft Privacy Statement.
• Cloudflare Web Analytics counts page views and measures how quickly pages load. It stores nothing on your device.

Both recording tools, PostHog and Microsoft Clarity, are set to mask the API keys we show you.

Advertising and conversion measurement

• Google Ads records your visits to measure how our Google ads perform and to add you to remarketing lists, so Google can show you Citable ads on other websites and on Google services. It records whether a visit followed a Citable ad you saw but did not click (a view-through conversion), and it records a conversion when you start a plan, with the price, currency and a transaction ID. It uses a first-party cookie (_gcl_au) and Google advertising cookies set on Google's own domains.
• Google Analytics Advertising Features. We use Google signals, remarketing with Google Analytics, and demographics and interests reporting. With Google signals, Google associates data from your visits with your Google account if you are signed in to Google and have turned on ads personalization. Google Analytics then reports activity across your devices and estimated age, gender and interests, which we see only as aggregated reports. Google Analytics is linked to Google Ads, so groups of visitors can be used for remarketing.
• User-provided data. Our Google tags are set to detect email addresses, phone numbers and postal addresses that you enter on our pages, or that appear on them, such as in the signup form. They send these to Google in hashed form (an irreversible code) so Google can match visits and conversions to Google accounts. Google calls this user-provided data collection and enhanced conversions.
• Meta Pixel records each page you view, with its address, title and descriptive information, and the buttons you click, along with browser and device information and, if you arrived from a Meta ad, the ad's click identifier. Meta uses this to measure Citable's ads on Facebook, Instagram and other Meta services, and to show Citable ads to people who have visited our websites. It uses first-party cookies (_fbp, and _fbc after you click a Meta ad).
• OpenAI ChatGPT Ads Measurement Pixel measures Citable's ads in ChatGPT. It notifies OpenAI each time it loads, and records when you complete signup, submit your email to receive a report, or start a trial or a paid plan (with the plan and, for a paid plan, its price and currency). Signup and plan events carry an ID derived from your Citable account or subscription. The pixel stores the ChatGPT ad click identifier from the link you followed (__oppref, 30 days) and a random browser identifier (__obref, 365 days). OpenAI's automatic advanced matching is turned on for our pixel: it detects email addresses and other contact details on the page, hashes them in your browser and sends the hashes with these events. Our servers may also report signups and plan starts to OpenAI's Conversions API, with the ad click identifier, the event's ID and time, the page, and the plan, price and currency. Our servers do not send OpenAI your email address.

How these cookies work together

We and these companies use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google's advertising cookies) together to:

• report how our websites are used;
• measure which ads lead to visits, signups and purchases, including visits after you saw an ad without clicking it;
• build audiences of past visitors and show them Citable ads on other websites and apps; and
• with Google signals, connect activity across devices for people signed in to Google.

Our Google tags are delivered by Google Tag Manager through our own domain, using Cloudflare's tag gateway, so some information sent to Google passes through our domain first.

Your choices

• Google: control the ads Google shows you in Google's Ads Settings, and stop Google Analytics from collecting data in your browser with the Google Analytics Opt-out Browser Add-on. Google explains its practices in How Google uses information from sites or apps that use our services.
• Interest-based advertising: opt out of interest-based ads from participating companies with the Digital Advertising Alliance's WebChoices tool or, in Europe, Your Online Choices. Meta describes its own controls in its Cookies Policy.
• Microsoft Clarity: Microsoft lets you opt out of Clarity by selecting Microsoft in the Digital Advertising Alliance tool above, and says Clarity supports Global Privacy Control.
• OpenAI: see OpenAI's Privacy Policy.
• Your browser: you can block or delete cookies in your browser settings, and most browsers can block third-party cookies. If you block the sign-in cookie, you will not be able to log in.

Our websites do not respond to browser Do Not Track signals. To ask about the data these tools hold about you, or to exercise the rights in section 6, contact us at [email protected].

We use the collected information for various purposes:

• To provide and maintain our service
• To process your transactions and manage your account
• To send you notifications about your account and service updates
• To provide customer support
• To analyze usage and improve our service
• To detect, prevent, and address technical issues
• To send marketing communications (you can opt-out anytime)

3.1 Use of Company Logos and Brand Assets

By using our platform, you grant Citable permission to display your company name and logo on our website, marketing materials, case studies, and promotional content to showcase our client relationships and demonstrate our service offerings. This includes but is not limited to:

• Displaying your company logo on our website's client showcase or customer page
• Mentioning your company name as a client or user of our service
• Using your logo in marketing materials, presentations, and promotional content
• Featuring your company in case studies or success stories (with your approval for detailed information)

If you do not wish for your company logo or name to be used in this manner, please contact us at [email protected] to opt out. We will remove your branding from public-facing materials within 30 days of your request.

We do not sell your personal information. We may share your information with:

4.1 Service Providers

These companies process information on our behalf to provide Citable:

• Stripe - Payment processing
• Neon Database - Data storage
• Amazon Web Services - Application hosting
• Cloudflare - Website hosting, delivery and security, Cloudflare Web Analytics, and delivery of our Google tags
• Resend - Email delivery, including our newsletter list
• PostHog - Product analytics and session recording
• OpenAI, Anthropic, Google, Perplexity, xAI - AI analysis services

These analytics and advertising companies collect information through the tools described in section 2.5. They provide measurement and advertising services to us, and may also use the information for their own purposes, such as personalizing ads, under their own privacy policies:

• Google - Google Analytics (including Google signals), Google Ads and Google Tag Manager: usage analytics, ad measurement and remarketing
• Meta - Meta Pixel: ad measurement and remarketing
• OpenAI - ChatGPT Ads Measurement Pixel and Conversions API: ad measurement
• Microsoft - Microsoft Clarity: session recordings and heatmaps

4.2 Google API Services - Limited Use Disclosure

Citable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide and improve user-facing features within Citable: sign-in data (name, email, account ID) for account authentication and identification, and connector data (Google Analytics, Search Console, and Ads) to produce the reporting and recommendations you see in your Citable dashboard.
• We do not use Google user data to train generalized artificial intelligence or machine learning models. Where your data is sent to an AI provider to generate your own report, it is used only to produce that output for you.
• We do not transfer Google user data to third parties except as necessary to provide our service, for security purposes, or to comply with applicable laws.
• We do not use Google user data for serving advertisements, retargeting, or interest-based advertising.
• We do not allow humans to read Google user data unless the user has given affirmative consent, it is necessary for security purposes, or required by law.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court order or government agency).

We implement appropriate technical and organizational security measures to protect your personal information:

• Data encryption in transit (HTTPS/TLS)
• Encrypted password storage (bcrypt)
• Secure authentication with JWT tokens
• Regular security audits and updates
• Access controls and monitoring

However, no method of transmission over the Internet is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

You have the following rights regarding your personal data:

• Access - Request copies of your personal data
• Rectification - Request correction of inaccurate data
• Erasure - Request deletion of your personal data
• Data Portability - Request transfer of your data
• Withdraw Consent - Opt-out of marketing communications

To exercise these rights, please contact us at [email protected]

We retain your personal information only for as long as necessary to provide our services and comply with legal obligations. When you close your account, we will delete or anonymize your personal information within 90 days, unless we are required to retain it for legal purposes.

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

Our service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to say no to the sale of personal information
• Right to access your personal information
• Right to equal service and price

If you are in the European Economic Area (EEA), we process your personal data under the following lawful bases:

• Contract performance - to provide our services
• Legitimate interests - to improve and secure our service
• Consent - for marketing communications
• Legal obligations - to comply with laws

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

If you have any questions about this Privacy Policy, please contact us:

Email: [email protected]

Website: getcitable.com