Privacy Policy

The short version: we collect the minimum needed to run the service, we never see your card number, we never store passwords, and we don't sell data to anyone. The longer version follows.

1. What we collect

• When you buy something: Stripe collects your name, email, phone number, company, and (for the AI Page Check) the URL to check, and passes those details to us. Your card number goes to Stripe only: it is never sent to, seen by, or stored on our systems.
• When you book a call: cal.com collects your name, email, and whatever you enter in the booking questions, and shares the booking with us.
• When you use chat or email: Crisp (our chat widget) and our mailbox hold what you send us.
• When we run a scan or report: we fetch and analyze what publicly reachable pages say, and what public AI assistants answer. We only read public pages, never anything behind a login.
• When accounts launch: your email address and short-lived login tokens. Login is passwordless by design, so there is no password to collect, store, or leak.

2. How we use it

To deliver what you bought (reports, corrections, monitoring), to respond when you contact us, to send service emails about your purchase or account, and to keep the service secure. We don't run ad trackers, we don't sell or rent your information, and we don't use your data to market other people's products.

3. Who processes it for us

Like every small company, we rely on a few processors, each receiving only what its job needs: Stripe (payments), Render (hosting), Cloudflare (DNS and email routing), cal.com (scheduling), Crisp (chat), the AI model providers we query to build reports (OpenAI, Anthropic, Google, Perplexity: they receive the questions we ask and, for the Page Check, content from the public page being checked), and DataForSEO (AI visibility data). Some processors operate outside your country; by using the service you accept that transfer.

4. How long we keep it

AI Page Check job data is deleted after about 180 days. Finished reports remain available at their private links so you can revisit them. Customer records (who bought what, invoices, correspondence) are kept as long as needed for the relationship and legal obligations, then deleted.

5. Your choices

Email us to ask what we hold about you, to correct it, or to have it deleted; we honor deletion requests except where a record must be kept (for example, invoices). California residents: this is also how you exercise your access and deletion rights under California law, and we don't sell personal information, so there's nothing to opt out of. Every non-essential email we send includes a way to opt out.

6. Security

Everything runs over HTTPS. Report links are private, unguessable, and excluded from search indexing. Credentials and API keys live server-side only. We hold no card data and no passwords, which means the worst categories of breach have nothing to find. If a breach ever affects your data, we'll tell you what happened and what we're doing about it.

7. Changes and contact

If this policy changes, the date above changes with it, and material changes get direct notice to active customers. Questions or requests: hello [at] rightcited [dot] com.