Privacy Policy
Jude Rosen, a sole proprietor trading as Citepoint runs citepoint.ai and the Citepoint app. This policy explains what personal information we collect, why, and what you can ask us to do with it, as required by the Protection of Personal Information Act 4 of 2013 (POPIA). We sell nothing to advertisers and we don't track people across the web.
Who's responsible
Jude Rosen is the responsible party and the information officer. Email hello@citepoint.ai about anything in this policy.
What we collect
Your account. Your email address, and your name and profile picture if you sign in with Google. Sign-in links and sessions are stored as hashes, not as usable tokens.
Your workspace. The domains, descriptions, competitors, prompts, pages, tools and settings you create, plus the pages and answers we generate for you.
Integration credentials. CMS and webhook credentials, your Google Search Console and Google Analytics tokens and your Gmail or Outlook token if you connect them, and the GitHub App installation you choose. These are encrypted before they're stored. The Search Console and Google Analytics permissions are read-only, and the Gmail and Outlook permissions only send email: we can't read your inbox.
API keys. Keys you create for the API, CLI and MCP server are stored as hashes. We show each one once.
Free scans. When someone runs the free scan we store the domain, the results and a one-way hash of their IP address, to limit abuse. If they give their email to unlock the full report, we store it with the scan and may send them the report and occasional product email, with an unsubscribe link in every one.
Outreach contacts. To pitch an article, we look for a contact address that the site publishes itself, and store it with the pitch. If a recipient opts out, we keep their address on a suppression list so they aren't emailed again.
Billing. Lemon Squeezy, our reseller, takes payment and holds card details, and collects what it needs to charge tax, such as your billing address, under its own privacy policy. We keep your Lemon Squeezy customer and subscription identifiers, your plan and its status.
Google Analytics. If you connect it, we read daily totals of sessions, key events and revenue by traffic source, and keep only the totals for AI assistants and for your whole site. No data about individual visitors.
Service logs. Ordinary request logs, including IP address and browser user agent, kept briefly to keep the service secure and working.
Visitors to your published pages
Pages and tools we host for you count visits on the server. For each day we record the page, where the visit came from (an AI assistant, a search engine, a link, or direct) and whether the request was an AI crawler. We store counts only.
No cookies, no tracking script, no profiles. We don't store visitors' IP addresses and can't identify individual visitors from these counts.
Cookies
Three, all necessary:
- a session cookie that keeps you signed in;
- a short-lived cookie while you sign in with Google or connect Search Console, Google Analytics or a mailbox, which prevents request forgery;
- a cookie remembering your light or dark theme.
No advertising or analytics cookies.
Why we use it, and on what basis
To run your account, do the work you ask for (research, writing, publishing, tracking), take payment, send service email, keep the service secure, meet our legal obligations and improve the product. Under POPIA we rely on your consent, on processing necessary to perform our contract with you, and on our legitimate interests in running and protecting the service.
We don't use your content to train AI models, and we don't sell personal information.
Direct marketing
We send service email: sign-in links, invites, billing and account notices. We'll only send marketing email if you ask for it, and every marketing email has an unsubscribe link, as POPIA requires.
Who we share it with
These operators process data for us:
| Operator | What it handles |
|---|---|
| Cloudflare | Hosting, database, queues, page delivery, and sign-in links, invites and notifications |
| Anthropic | Site analysis, writing pages and tools, asking your tracked questions on Claude |
| OpenAI | Researching and drafting pages, reading AI answers, and asking questions on ChatGPT when the app can't be read |
| DataForSEO | Answers from ChatGPT, Gemini, Perplexity, Google AI Overviews and AI Mode, and search volume |
| Sign-in, Search Console and Google Analytics data and sending email from Gmail if you connect them, and asking questions on Gemini when the app can't be read | |
| Microsoft | Sending email from Outlook or Microsoft 365 if you connect it |
| GitHub | Opening pull requests in the repositories you choose |
| Lemon Squeezy | Payments, subscriptions, sales tax and invoices, as our reseller |
Your prompts and page drafts go to AI providers so they can do the work. We also share information where the law requires it, and if the business is sold, in which case this policy continues to apply.
Sending information outside South Africa
These operators are outside South Africa. As section 72 of POPIA requires, each is bound by a written agreement that holds them to protection comparable to POPIA, and the transfers are necessary to perform our contract with you. Where the GDPR also applies, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Workspace data stays until you delete it or close your account, after which we delete it within 30 days, except records we must keep for tax and accounting. Service logs are kept briefly. Visit counts are aggregated and hold no personal information. Disconnecting Search Console or Google Analytics deletes its token and the data synced from it.
Security
Credentials and tokens are encrypted at rest. Sessions and sign-in links are stored hashed. Access to production data is limited to those who need it. If a breach affects your personal information, we'll notify you and the Information Regulator as POPIA requires. Tell us at hello@citepoint.ai if you suspect a problem.
Your rights
You may ask us to confirm what personal information we hold, give you a copy, correct or delete it, or stop processing it. You can also object to processing on legitimate-interest grounds. Most of it you can edit or delete yourself in the app. Email hello@citepoint.ai and we'll respond within 30 days. Requests under the Promotion of Access to Information Act go to the same address.
If you're unhappy with our response you may complain to the Information Regulator (South Africa): inforegulator.org.za/complaints or enquiries@inforegulator.org.za. If you're in the EU or UK, you may complain to your own data protection authority instead.
If you need a data processing agreement, email us and we'll send one.
Children
Citepoint is for businesses and isn't directed at anyone under 18. We don't knowingly process the personal information of children.
Changes
We'll post updates here and change the date at the top. If a change is significant, we'll email you.
Contact
Jude Rosen. Email hello@citepoint.ai.
See also the terms of service.