Privacy Policy

This Privacy Policy describes how Safairah Technologies Private Limited (“Cited,” “we,” “us,” or “our”) collects, uses, shares, and protects personal data when you use our website (getcited.in), the Cited dashboard, our APIs, free audit tools, documentation, and related services (collectively, the “Services”).

This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and applicable international laws (including the EU/UK General Data Protection Regulation where relevant).

Data Fiduciary / Controller:

• Legal name: Safairah Technologies Private Limited
• CIN: U62011MH2026PTC471673
• Registered Office: Flat No. 22, Building LT 31, Vijay Nagar, Marol Maroshi Road, Opp Palloti Church, Andheri East, Mumbai — 400059, Maharashtra, India
• Contact: [email protected]

1. Information We Collect

1.1 Information you provide directly

1.2 Information collected automatically

• Usage data: pages visited, features used, queries run, dashboard interactions, time spent
• Device and log data: IP address, browser type, operating system, referrer URLs, timestamps, crash logs
• Cookies and similar technologies: see Section 9, including 9.2 for product analytics in the Cited dashboard

1.3 Information from third parties

• Authentication providers: if you sign in via Google or other SSO, we receive basic profile information you authorize them to share
• Integrations you connect: if you connect Google Analytics 4, Google Search Console, Shopify, or similar tools, we receive the data you authorize. See 1.5 for exactly what we read from Google and what we do with it
• Analytics services: Google Analytics and Vercel Analytics share aggregated usage data with us. In the Cited dashboard, PostHog records how the product is used on our behalf (see 9.2)

1.4 Publicly available content we process

To deliver the Services, we collect and analyze content that is publicly available, including:

• Your public website and competitor public websites
• Public responses from AI search systems (ChatGPT, Perplexity, Gemini, Google AI Overviews, Google AI Mode, Claude, Grok) for queries you configure
• Public citations and references appearing in those responses

This processing operates on public content. It does not require, and we do not seek to obtain, personal data of individuals through this collection.

1.5 Google user data and Limited Use

If you choose to connect a Google account, we request read-only access and we read only the single property you select. We never write to, modify, or delete anything in your Google account.

• Google Analytics (scope analytics.readonly): session and engagement counts for the property you choose, by day, landing page, and traffic channel, including Google's own “AI Assistant” channel. We use this to show how much traffic AI assistants send you and which pages they land on.
• Google Search Console (scope webmasters.readonly): clicks, impressions, click-through rate, average position, and the queries and pages they belong to, for the property you choose. We use this to show how the same pages perform in Google Search beside their performance in AI answers.

We do not sell this data, use it for advertising, use it to train generalized artificial intelligence or machine learning models, or transfer it to anyone beyond the sub-processors listed in 5.1 who run our infrastructure on our behalf. Humans do not read it except where you ask us to for support, or where the law requires it. You can disconnect at any time from the Connection menu on the Content Performance page, or revoke access directly in your Google account, and we stop reading immediately.

Cited's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How We Use Information

We process information to:

• Provide, secure, and maintain the Services
• Run GEO audits and generate dashboards, scores, recommendations, and reports
• Authenticate users and prevent fraud or abuse
• Communicate with you about your account, support requests, transactional updates, and product changes
• Send marketing communications where permitted (you may opt out at any time)
• Process payments, issue invoices, and meet tax and accounting obligations
• Conduct research, improve algorithms and methodologies, and develop new features
• Publish de-identified, aggregated benchmarks (such as the Cited Index)
• Comply with legal obligations and respond to lawful requests

3. Legal Bases for Processing

We rely on the following lawful bases under the DPDP Act and GDPR:

• Consent — for marketing communications, optional cookies, and discretionary integrations
• Contract performance — to deliver the Services you subscribe to
• Legitimate interests — to improve and secure the Services, develop benchmarks, and prevent fraud, balanced against your rights
• Legal obligation — to comply with tax, accounting, and regulatory requirements

4. How AI Providers Process Your Data

To deliver the Services, we send queries you configure (and, in some cases, brand-related text) to third-party AI providers, including OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), Perplexity, and xAI (Grok). We do this through their commercial APIs, where each provider's data handling is governed by their enterprise/API terms.

We do not send your personal data to AI providers beyond what is required to execute the relevant query (typically, no personal data — queries are about brand visibility, not individuals).

The AI providers' processing is governed by their own terms and privacy policies, which you can review on their respective websites.

5. Sharing of Information

We do not sell personal data. We share information only as described below.

5.1 Sub-processors

We use trusted vendors (“sub-processors”) to operate the Services. Categories include:

• Cloud infrastructure and hosting (e.g., DigitalOcean, Vercel, Cloudflare, Neon)
• AI providers (e.g., OpenAI, Anthropic, Google, Perplexity, xAI)
• Data collection infrastructure (e.g., Bright Data)
• Authentication (e.g., Clerk)
• Payments (e.g., Razorpay, Stripe)
• Communications (e.g., Resend for email)
• Analytics (e.g., Google Analytics, Vercel Analytics, and PostHog, which stores Cited dashboard product analytics in its EU cloud in Frankfurt, Germany)
• Documentation hosting (e.g., Mintlify)

We contractually require sub-processors to handle personal data only as needed to perform their services and in a manner consistent with this Policy. An updated sub-processor list is available on request from [email protected]. We will provide it in a current public page when our enterprise customer base or applicable contracts require it.

5.2 Legal disclosures

We may disclose information if required by law, court order, regulator request, or to protect our rights, safety, or property, or those of our users or the public.

5.3 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

6. International Data Transfers

We operate from India and use vendors in the United States, European Union, Singapore, and other jurisdictions. By using the Services, you acknowledge that your information may be transferred to and processed in countries with data protection laws different from your own.

For personal data transferred from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards including Standard Contractual Clauses where applicable.

7. Data Retention

We retain information for as long as needed to:

• Provide the Services (active accounts: retained while active, plus 90 days after closure)
• Meet legal, tax, and accounting obligations (typically 7 years for financial records under Indian law)
• Resolve disputes and enforce agreements

You may request deletion at any time (see Section 8). Some data may be retained in aggregated, de-identified form for analytical and benchmarking purposes.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your data (subject to legal retention obligations)
• Withdraw consent where processing is based on consent
• Object to processing based on legitimate interests
• Restrict processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Nominate an individual to exercise your rights in the event of death or incapacity (under DPDP Act)
• Complain to the Data Protection Board of India or your local supervisory authority

To exercise these rights, email [email protected]. We will respond within the timeframes required by applicable law (typically 30 days).

9. Cookies and Similar Technologies

We use cookies and similar technologies for:

• Essential cookies — required for Services functionality (authentication, session, security)
• Analytics cookies — to understand how the Services are used
• Preference cookies — to remember your settings

We are working on implementing a cookie consent banner for visitors in the EU/UK and other jurisdictions requiring it. Until then, you can control cookies through your browser settings. Disabling essential cookies will limit functionality.

9.1 The Cited tag on this website

This website runs our own measurement tag — the same one we provide to customers. It records the page path, the hostname of the site that referred you (never the full referring URL), any utm_ parameters in the link you followed, and a coarse device class of mobile, tablet or desktop. It exists to tell us which visits arrived from an AI answer engine.

It sets no cookies. It stores a single random session identifier in your browser’s sessionStorage, which your browser discards when you close the tab, and it cannot be used to follow you to another website. It does not read page content, form values, or keystrokes.

The script is unminified and readable, and what it collects is documented in full at tag.getcited.in.

9.2 Product analytics in the Cited dashboard

The Cited dashboard (dashboard.getcited.in) uses PostHog to record how the product is used, so we can see which features help customers and improve the ones that do not. It records the pages you view and the features you use. Each event is tied to your Cited user ID and to the brand, role and plan you are using. It does not record your screen or your sessions, and it does not capture what you type.

Where it is kept: PostHog’s EU cloud in Frankfurt, Germany. PostHog discards your IP address, so it is not stored. Events are kept for 12 months.

Your choice: if you use the dashboard from the EU, the EEA, the UK or Switzerland, we ask for your consent first and send nothing to PostHog until you allow it. If we cannot tell where you are connecting from, we ask too. You can change your answer at any time with the Analytics switch in your account menu. We work out which of these applies from the country your connection comes from, and we do not store that country. If you use the dashboard from anywhere else, we do not ask, and you can object as described in Section 8.

It sets no cookies. PostHog keeps a random identifier in your browser’s localStorage, which is cleared when you sign out. Your consent choice is stored there too.

10. Security

We implement administrative, technical, and physical safeguards including encryption in transit (TLS), access controls, audit logging, and secure cloud infrastructure. No system is fully secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach affecting your information, we will notify you and applicable regulators as required by law.

11. Children's Privacy

The Services are not directed to individuals under 18, and we do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact [email protected] for prompt deletion.

12. Third-Party Links

The Services may contain links to third-party websites or services we do not operate. We are not responsible for their privacy practices. Review their privacy policies before submitting information.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified by email or in-product notice. The “Last updated” date at the top of this Policy indicates when it was last revised.

14. Grievance Officer (IT Act and DPDP Act)

• Name: Salman Shaikh
• Designation: Data Protection / Grievance Officer
• Email: [email protected]
• Address: Safairah Technologies Private Limited, Flat No. 22, Building LT 31, Vijay Nagar, Marol Maroshi Road, Opp Palloti Church, Andheri East, Mumbai — 400059, Maharashtra, India

The Grievance Officer will acknowledge receipt of complaints within 48 hours and resolve them within the time period prescribed by law.

15. Contact

Questions about this Policy or our data practices: [email protected]

See also our Terms of Service and Refund Policy.