Privacy Policy

CiteMy (citemy.ai) is a done-for-you AI visibility service for home-services businesses in the United States. This policy covers our website, the free tools and free audit, the client portal, and the work we do for clients. We are based in the United States, and the service is meant for US businesses.

CiteMy is a business-to-business service. Most of what we handle is about businesses: their websites, listings, and public facts. Where it is about a person (an owner's name and email, say), this policy says so.

From forms you fill in:

• Get started (/start): your name, email, phone if you give it, business name, website, trade, city, and any referral code.
• Free audit (/audit): your website, email, business name if you give it, area, and trade.
• Territory waitlist and report share pages: your email, business name, and anything else the form asks for (a phone number or a message).
• For rate limiting, each form stores a keyed hash (HMAC-SHA256) of your IP address. We never store the IP address itself, and the hash cannot be turned back into it.

From clients, to do the work: business facts (prices, specs, service areas, warranties, licenses, hours), answers to our intake questions, notes from our calls, photos and other files you send us, and the people on your team who sign in to the portal or are named as authors.

Account access you grant us: a WordPress application password or other site login, Google Business Profile access through Google sign-in (below), and Google Analytics access, which you grant to our admin email inside Google Analytics. We never ask for your Google password.

Sign-in: the portal signs you in with a one-time link sent to your email (Supabase Auth). We store your email and the account it belongs to.

Payments: Stripe handles checkout and billing. We store the Stripe customer and subscription ids and the subscription status. Card numbers go to Stripe and never touch our servers.

Public information about businesses: business names, websites, addresses, phones, and categories from the Google Places API and from businesses' own websites, the pages our crawlers read, and the answers AI engines give to our questions. When we contact a business, we use the email address it publishes on its own website.

A client can connect its Google Business Profile so we can run it as part of the service. You sign in with Google and grant the business.manage permission. With it, CiteMy:

• Reads the Business Profile accounts and locations the Google account manages (name, address, place id, primary category, and service items), so you can pick your location.
• Reads your location's reviews (the reviewer's display name, star rating, review text, and any existing reply), once a day, so we can draft a reply to each new one.
• Posts review replies only after you approve them, or after our team approves one at your direction. You can edit a draft before approving it, or skip it.
• Creates Business Profile posts, uploads photos, and adds missing service items. Each is drafted from facts and photos you gave us or published on your site, and none goes to Google until our team reviews and approves it. We never remove a service item.

To draft a reply, we send the review's star rating, text, and the reviewer's first name to Anthropic's Claude API. To draft a post, we send the fact or project page it features. Nothing else from your Business Profile goes to an AI provider.

We use Google user data only to provide and improve the features you asked for in your Business Profile. We do not sell it, use it for advertising, use it to build or train generalized AI or machine-learning models, or give it to anyone except the service providers listed below who process it to provide those features. Our team reads reviews and drafts only to review and approve them for you, for security, or when the law requires it.

Storage and protection: Google's refresh token is encrypted with AES-256-GCM before it is stored, and only our background workers can decrypt it. Reviews, drafts, and a log of every write to your profile are stored in our database with access limited to our servers and our admins.

Disconnecting: you can disconnect at any time by removing CiteMy from your Google account's permissions at myaccount.google.com/permissions, or by asking us. When we disconnect, we revoke the grant at Google and delete the stored token, and nothing more is read or posted. Ask us and we also delete the stored copies of your reviews, drafts, and posting log (see Retention).

CiteMy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To run the free audit and email you the results, and to reply to a get-started or waitlist request.
• To provide the service: audit and edit your website after you approve each change, publish content and datasets, run your Business Profile, and report results.
• To sign you in, bill you, and send service email: sign-in links, reports, receipts, and notices.
• To measure AI visibility: every week we ask ChatGPT, Claude, Perplexity, and Gemini the questions homeowners ask, through each provider's API. These questions hold no personal data. We record which businesses the answers name, cite, and recommend.
• To publish neutral research: our public index and studies name businesses as the engines named them, counted the same way for every business, client or not. They use public business information and the engines' answers, never a client's private data.
• To keep the site safe: rate limits and abuse prevention.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

The free audit and our research read public web pages. They identify themselves (CiteMyAuditor, CiteMyBot, and our study crawler, each with a link back to citemy.ai), follow robots.txt, and fetch a small number of pages one at a time. To test whether a site lets the AI crawlers in, the audit also requests the home page once with each AI crawler's published user agent. The free tools fetch only the page you enter.

We share data only with the service providers that run CiteMy, each for the purpose listed:

• Vercel: hosts the website and portal.
• Supabase: our database, sign-in, and file storage (United States).
• Stripe: payments and billing.
• Resend: sends our email.
• Anthropic, OpenAI, Google, and Perplexity: the AI models we measure every week, and the models that help draft content, review replies, and posts. Drafts are sent through their APIs.
• Google: the Business Profile APIs you connect, and the Places API for public business listings.
• DataForSEO: Google search results for the search terms we track. No personal data is sent.

We may also disclose information when the law requires it, to protect our rights or someone's safety, or to a buyer if CiteMy is sold, under the same promises as this policy.

citemy.ai runs no analytics, advertising, or tracking scripts. We set only these cookies:

• Sign-in cookies (Supabase) on the portal, to keep you signed in.
• A single-use cookie during Google sign-in, to check that the response from Google belongs to the request you started. It is deleted as soon as it is used.
• ai_src: when you arrive from an AI assistant, the assistant's name (for example "chatgpt") for 30 minutes, so the home page can greet you by where you came from. Nothing else is in it.

Our hosting provider keeps standard server logs (IP address, browser, the page requested) for security and debugging.

• Form submissions and free-audit requests: kept so we can reply and follow up, until you ask us to delete them.
• Client data: kept while you are a client, and afterwards until you ask us to delete it. The content we publish lives on your own website and stays yours.
• Google Business Profile token: deleted when you disconnect. Stored reviews, drafts, and the posting log: deleted on request, and with your client record.
• Website and other account credentials: kept encrypted while we need them, and deleted on request or when you leave.
• Billing records: kept as long as tax and accounting law requires.

To delete your data, email us from the address on your account. We confirm it is you, then delete it within 30 days, except what the law requires us to keep.

Every secret you give us (a site password, an application password, a Google token) is encrypted with AES-256-GCM before it is stored. Our database blocks browser access to business and personal tables; only our servers read them. Connections are encrypted in transit. No system is perfectly secure, and we will tell affected clients promptly if a breach touches their data.

You can ask us to show you, correct, or delete the personal information we hold about you, and we will answer within 30 days. Our emails carry our mailing address and say why you got them. To stop reports, updates, or outreach, reply "unsubscribe" and we stop.

California residents have the right to know what personal information we collect and why, to correct it, to delete it, and to opt out of its sale or sharing. We do not sell or share it, so there is nothing to opt out of. We will not treat you differently for using these rights. You can make a request yourself or through an authorized agent, by email.

CiteMy is a service for businesses. It is not directed to children under 16, and we do not knowingly collect information from them. If you believe we have, tell us and we will delete it.

If we change this policy, we post the new version here with a new effective date. If a change matters to how we use your data, clients hear about it by email before it takes effect.