Privacy Policy

1. What we collect

• Account details: your name, email address and password (stored only as a secure hash), and for each sign-in session the IP address and browser it came from.
• Workspaces and teams: workspace names, members and their roles, and the email addresses of people you invite.
• What you add: websites, brand and competitor names, prompts, markets, topics, tags and settings. If you add your own AI provider key, we store it encrypted.
• Data we gather for you: the answers AI engines give to your prompts, the sources they cite, and public web pages (such as your site and the pages AI cites) that we read to build reports and briefs. This is public web content, not data about you.
• Google Search Console: only if you connect it. We read search queries and page statistics for the property you choose, to suggest prompts.
• Google Analytics: only if you connect it. For the properties you pick, we import the number of sessions that came from AI assistants per day, assistant and landing page, with how many were engaged and led to key events. Nothing about individual visitors.
• Billing: your plan, subscription status and the customer and subscription references from Polar, our payment provider. Card details go straight to Polar; we never see or store them.
• Free visibility check: if you use the free check on our website without an account, the website, brand name and market you enter, your email address, and a daily-changing scrambled code made from your IP address (to limit how many checks one visitor can run). We use your email only to send the confirmation link and the results.
• Outreach contacts: if a workspace turns on the contact finder and someone in it asks for a website's contacts, we read up to 12 public pages of that website and keep the business contact details published there: email addresses, links to its contact and about pages, and its social media profiles. We don't collect names, job titles or phone numbers, and we don't buy, enrich or verify addresses. Only that workspace sees them.
• AI traffic on your website: if you connect your website, we receive a record of each visit from a known AI crawler and each visit from someone who arrived from an AI assistant: the page, the crawler or browser name, the response status and the referring page. We keep the page path without its query string. For visits from AI assistants we turn the visitor's IP address and browser into a code made with a random key for that day, to count unique visitors, and never store the IP address. Each day's key is deleted after two days, so the codes can't be traced back. Other traffic to your website is never sent to us. For your website's visitors, you decide to collect this and we process it on your behalf.
• Shared reports: when someone opens a report link that a workspace shared, we count the link's views and when it was last opened. To stop abuse we also count how many reports each visitor network opened in the last few minutes, as a code made from the IP address with a secret key; the IP address itself isn't stored.
• Technical data: server logs with IP addresses and request details, kept for security and troubleshooting, and the cookies described in section 8.

2. Why we use it

• To provide the service you signed up for: your account, workspaces, checks, reports and emails about them (performance of our contract with you).
• To keep the service secure, prevent abuse such as repeated free trials, and fix problems (our legitimate interests).
• To let workspaces contact the publishers of websites that AI engines cite, about what those websites published (the legitimate interests of the workspace and of those publishers in being reachable). We limit this to contact details the website publishes, keep them for 30 days, and honor every objection.
• To handle billing, invoices and tax with Polar, and to meet legal obligations such as bookkeeping.
• To send service emails: account verification, password resets, invitations, trial reminders and billing notices. We don't send marketing emails without your consent.

3. Who helps us

We use these service providers, who process data only on our instructions and only as needed for their part of the service:

• Tencent Cloud hosts our servers and database (Singapore).
• Cloudflare provides DNS and stores our encrypted database backups.
• Amazon Web Services (Amazon SES) sends our emails.
• Polar processes payments, issues invoices and handles tax as our merchant of record.
• Apify runs the searches on AI engines and receives your prompts and markets. For the contact finder, it reads the public pages of the website a workspace asks about.
• DataForSEO runs searches on Google and AI engines (and asks Perplexity's and Claude's APIs) and receives your prompts and markets.
• Firecrawl fetches public web pages for analysis and receives the addresses of those pages.
• AI model providers (the provider we use, or the one you connect with your own key) receive answer texts, brand names and page content to rate sentiment, suggest competitors and prompts, and write briefs. They don't receive your account details.
• Google, only if you connect Search Console or Google Analytics. Google PageSpeed Insights also receives the addresses of pages you run a page health check on.
• IndexNow (used by Microsoft Bing and other search engines) receives the addresses of pages you submit to it.

We don't sell personal data and don't share it for advertising.

4. International transfers

Our servers are in Singapore, and several providers above are based in the United States. Where data protection law requires it, transfers are covered by appropriate safeguards, such as the European Commission's standard contractual clauses.

5. How long we keep it

• Account and workspace data: for as long as your account exists. You can delete prompts and projects at any time. A workspace whose trial or subscription ended and that stays read-only may be deleted; its owners and admins are emailed 30, 7 and 1 days before.
• Free visibility checks: unconfirmed requests are deleted after a day, the email address and IP code after two days, and the rest of the check after 180 days.
• Outreach contacts: deleted 30 days after they are found, straight away when the workspace deletes them, and all at once when the workspace turns the contact finder off.
• AI traffic on your website: single visits for 90 days, daily totals for 400 days, and all of it straight away when you disconnect the website.
• Shared reports: the per-visitor view counts for a day; a link and its view count until 30 days after it expires or is turned off.
• Database backups: kept for 14 days, then overwritten.
• Server logs: kept only as long as needed for security and troubleshooting.
• Billing records: kept as long as tax and accounting law requires.

When you ask us to delete your account, we delete your personal data within 30 days, and it disappears from backups within a further 14 days.

6. How we protect it

All traffic to GoGetCited is encrypted (HTTPS). Passwords are stored as secure hashes, and API keys and Search Console access tokens are encrypted in our database. Access to production systems is limited to the people who run the service.

7. Your rights

Depending on where you live (including under the EU and UK GDPR), you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent you have given. Email ardhika@futureleaderleague.com and we'll answer within 30 days. You can also complain to your data protection authority.

If the contact finder collected your contact details from a website and you object, email ardhika@futureleaderleague.com. We delete them from every workspace and add them to a list (an email address only as a scrambled code) so they are never collected again.

8. Cookies

We only use cookies that the service needs to work:

• a sign-in cookie that keeps you logged in;
• a cookie that remembers the last project you opened in each workspace.

Your light or dark theme choice is saved in your browser's storage. We don't use analytics or advertising cookies. Polar's checkout and customer portal, which run on polar.sh, set their own cookies.

9. Google user data

If you connect Google Search Console or Google Analytics, GoGetCited gets read-only access to the data of the properties you choose: Search Console only to suggest prompts and show search data inside your workspace, Google Analytics only to show the sessions AI assistants send you. We store the access token encrypted, don't use the data for advertising, and don't share it except with the service providers above as needed to run the service. You can disconnect at any time in your workspace settings or in your Google account; disconnecting Google Analytics deletes what was imported from it. GoGetCited's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Children

GoGetCited is a business service and is not meant for anyone under 16. We don't knowingly collect data from children.

11. Changes to this policy

We'll update this page when our practices change and change the date at the top. If a change is significant, we'll also tell you by email or in the app.

12. Contact

For privacy questions or requests, email ardhika@futureleaderleague.com.