Controller and contact
Daniil Sokolov, an individual operating GetCitedByAI from Belgium, is the controller for the processing described here. Send privacy, access, correction, deletion, restriction, objection, portability, or security requests to support@getcitedbyai.io.
Data processed
- Account and authentication data: email address, optional name from Google, password hash, verification state, Google account identifier when selected, session records, and security-attempt records.
- Audit inputs and outputs: submitted URLs or pasted text, acquired page content, selected questions, model request and response bodies, evidence, findings, reports, audit history, and related identifiers.
- Support data: the content and contact details included in messages sent to support.
- Usage and operational data: allowlisted feature events, limited event properties, timestamps, environment and release information, identifiers and hashes used to operate, secure, diagnose, and meter the service.
- Billing data: Stripe customer, Checkout Session, payment-intent or invoice references; offer, credit quantity, amount, currency, status, receipt availability, and fulfilment records. Stripe, not GetCitedByAI, receives and processes full payment-card details in hosted Checkout.
Purposes and legal bases
Account, audit, support, and purchase data is processed as needed to take requested steps and perform the service contract. Security, abuse prevention, product reliability, limited product analytics, and the defence of legal claims rely on legitimate interests in operating a safe and useful service, balanced against the rights of affected people. Billing and tax records are also processed where necessary to comply with legal obligations. Google account data is requested only when the user chooses Google sign-in.
GetCitedByAI does not use audit content to make legal or similarly significant decisions about people and does not sell personal data.
Service providers and transfers
- Cloudflare provides the web and API runtime, database, object and vector storage, workflows, browser acquisition, email delivery, security, and operational analytics.
- OpenAI processes audit prompts and source-derived material to produce model outputs. Requests use
store: false, but GetCitedByAI does not claim that this is a zero-data-retention arrangement. - Google supplies optional OAuth sign-in and returns basic profile information when selected. With consent given in the cookie notice, Google Analytics 4 also processes page views and pseudonymous usage data.
- Stripe hosts Checkout, processes payment and tax information, and supplies transaction and receipt metadata when billing is enabled.
These providers may process data outside Belgium or the European Economic Area. Where GDPR transfer restrictions apply, GetCitedByAI relies on the provider's applicable contractual and legal transfer safeguards. Contact support for information relevant to a particular transfer.
Retention
- Production session cookies last up to 30 days. Server sessions expire after 30 days of inactivity and have a 90-day absolute limit. OAuth state and return cookies last no more than 10 minutes.
- Raw source content, accepted source commands, normalized or excluded content, and full locally retained model request and response bodies are scheduled for deletion after 30 days. Deletion can be deferred briefly when a healthy active run still requires the material.
- Validated reports, evidence references, audit history, account data, and workspace records are retained while the account remains active or as needed to provide the requested history. Purging raw source does not revalidate or remove the historical report.
- Billing, credit-ledger, tax, dispute, and receipt metadata is retained for accounting, fraud prevention, contract enforcement, and legal obligations.
- Support correspondence and operational telemetry are retained only as long as reasonably needed for the request, security, reliability, or legal purpose involved, taking provider retention settings into account.
Your rights
Subject to the GDPR and applicable exceptions, a person can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Requests are handled manually; there is no self-service account-deletion control. GetCitedByAI may need to verify identity and may retain data that must be kept by law or to establish, exercise, or defend legal claims.
Send a request to support@getcitedbyai.io. A person may also complain to the Belgian Data Protection Authority or another competent supervisory authority.
Changes
This policy will be updated when material processing changes. The date at the top identifies the current version. Material changes that require a new choice or notice will be presented before the affected processing begins.