Privacy Policy

We collect the following categories of information:

• Account & contact data: name, work email, company name, company size, and password (hashed) when you sign up, book a demo, or submit a form.
• Billing data: billing address and payment details, processed by our payment processor (Razorpay for India, and Stripe/equivalent for other regions) — we do not store full card numbers on our servers.
• Client & domain data: the website domains, content, and brand/competitor information you connect to the Service for audits, monitoring, and content generation.
• Usage data: log data, device/browser type, IP address, pages visited, and interactions with the Service, collected via cookies and analytics tools.
• Third-party integration data: data from services you connect (e.g. Google Search Console, CMS platforms, social accounts) limited to what is needed to deliver the Service.

• To provide, operate, and maintain the Service, including audits, monitoring, and reports.
• To process payments and manage subscriptions.
• To communicate with you about your account, updates, and support requests.
• To send marketing communications, where permitted, with an option to opt out at any time.
• To monitor, improve, and secure the Service, including fraud and abuse prevention.
• To comply with legal obligations.

Where GDPR applies, we process personal data on the basis of: performance of a contract (to deliver the Service you signed up for), your consent (e.g. marketing emails, non-essential cookies), legitimate interests (e.g. product security and improvement), and compliance with legal obligations.

Where the DPDP Act applies, we collect and process personal data only for the specified, lawful purposes described in this policy, based on your free, informed, and specific consent (or another legal ground recognized under the DPDP Act, such as performance of a contract). You may withdraw consent at any time, as easily as it was given, by contacting us using the details in Section 11 — withdrawal does not affect processing carried out before withdrawal.

We do not sell your personal data. We may share information with:

• Service providers: hosting (Vercel), database (Supabase), payments (Razorpay/Stripe), analytics, and email delivery providers, bound by confidentiality and data-processing obligations.
• AI/LLM providers: third-party AI models used to generate content, audits, or citation-tracking results, limited to the data necessary to perform that task.
• Legal & safety: where required by law, regulation, legal process, or to protect the rights, property, or safety of GetCited, our users, or the public.
• Business transfers:in connection with a merger, acquisition, or sale of assets, subject to this policy’s protections continuing to apply.

Your data may be processed and stored in countries other than your own, including the United States and India, where our infrastructure and service providers operate. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers out of the EEA/UK, and comply with cross-border transfer requirements under the DPDP Act.

We retain personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed for these purposes, we delete or anonymize it.

Depending on your location, you may have the right to: access the personal data we hold about you; correct or update it; request erasure; withdraw consent; object to or restrict certain processing; request a copy of your data in a portable format; and file a grievance or complaint with a supervisory authority (in India, the Data Protection Board; in the EU/UK, your local data protection authority; in California, the California Privacy Protection Agency).

To exercise any of these rights, contact us at the email address in Section 11. We will respond within the timeframe required by applicable law.

We use cookies and similar technologies to operate the Service, remember your preferences, and understand usage through analytics. You can control cookies through your browser settings; disabling some cookies may affect the functionality of the Service.

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and row-level security on our database — to protect your data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email, and the “Last updated” date above will reflect the latest revision. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

For any questions, requests, or grievances regarding this Privacy Policy or your personal data, contact us at hello@getcited.marketing.