Privacy Policy

Citelytics (citelytics.co) Last updated: 27 July 2026

1. Who Controls Your Data

Citelytics (citelytics.co) is operated by an individual operating in Lithuania (not a registered company). For the purposes of the General Data Protection Regulation (GDPR), this individual business is the data controller.

Contact for privacy questions: reports@citelytics.co

2. What Data We Collect

When you run a free scan: the business name, website, city, and category you provide (or that we retrieve from Google Places), and your IP address (used only for rate-limiting abuse of free scans, kept for a short period, then deleted or aggregated).

When you unlock a full report: your email address, used to send the report and to identify you if you return.

When you create a mini-site: the business details you enter (services, prices, hours, and a phone number, which is required), and, if you request AI-assisted text improvement, the text of your answers is sent to our AI provider for rewriting only — no new facts are invented or added.

When you sign in: we do not use passwords. We send a one-time login link to your email; we store a token needed to verify that link, which expires shortly after use.

When you pay for anything: payment card details are collected and processed directly by Paddle, our payment provider. We do not receive or store your full card number.

Automatically: basic technical data needed to operate the site (such as request logs for security and abuse prevention).

3. Why We Process This Data (Legal Basis)

• To provide the Service you requested (performance of a contract, or steps prior to entering

one, e.g., running the scan you asked for).

• To prevent abuse of free features and protect the Service from automated attacks (legitimate

interest).

• To process payments and comply with tax and accounting obligations (legal obligation, and

performance of a contract).

• To send you a report you unlocked, or a login link you requested (performance of a contract).

4. Who We Share Data With

We share the minimum data necessary with the following processors to operate the Service:

• OpenAI, Google (Gemini), Anthropic, Perplexity — to run the AI queries your scan requires.

We send business name, category, city, and relevant scan questions; we do not send your email or payment details to these providers.

• Google (Places API) — to look up public business information.
• Paddle — to process payments. Paddle acts as an independent data controller for your

payment information; see paddle.com/legal/privacy for their policy.

• Resend — to deliver transactional emails (magic links, reports, notifications) on our

behalf.

• Cloudflare and Hetzner — infrastructure providers hosting the Service and protecting

it from abuse.

We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.

5. International Data Transfers

Some providers listed above (including OpenAI and Anthropic) may process data outside the European Economic Area. Where this happens, we rely on the safeguards those providers offer for international transfers (such as Standard Contractual Clauses) under GDPR.

6. How Long We Keep Data

• Free scan inputs and IP addresses used for rate-limiting: kept only as long as needed to

prevent abuse, then deleted or aggregated so they no longer identify you.

• Report unlock emails: kept while your account or report history is active, or until you ask

us to delete them.

• Raw AI responses from scans (the underlying questions and answers used to build your report)

are retained to support the report's audit trail and to track changes over time. These are not linked to your payment details.

• You can request deletion at any time (see Section 7).

7. Your Rights

Under GDPR, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; request that we restrict or stop certain processing; receive your data in a portable format; and object to processing based on legitimate interest. To exercise any of these rights, email reports@citelytics.co. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or your local supervisory authority.

8. Cookies and Local Storage

We do not use cookies for tracking or advertising. The Service stores one small piece of data in your browser's local storage — your light/dark theme preference — which is never sent to us and contains no personal information. We do not currently use any analytics or tracking tool. If this changes in the future, this section will be updated to describe it before it is turned on.

9. Children

The Service is intended for business owners and is not directed at children. We do not knowingly collect personal data from children.

10. Security

We use reasonable technical measures to protect data, including restricting access to production systems and keys, and encrypting connections to the Service (HTTPS). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above.

12. Contact

Questions or requests regarding your data: reports@citelytics.co