Privacy policy

1. Who we are

Cited is operated by Aaron Morais, a sole proprietorship based in Toronto, Ontario, Canada. Our privacy officer, who is accountable for how we handle personal information, is Aaron Morais, the owner of the business. Reach them at morais.aaron@gmail.com. This policy is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25 and Canada's Anti-Spam Legislation (CASL).

2. Information we collect

• Scan requests: the website, business name, market, category and email address you submit, plus public facts and page content from that website and public business profiles.
• Accounts: your email address, sign-in events, the businesses, markets and questions you track, and your fix progress.
• Billing: Stripe collects payment details. We receive your customer and subscription identifiers, plan, billing interval, status, email and promotion code, never full card numbers.
• Email preferences: whether you opted in to lifecycle email, when, and any unsubscribe.
• People you forward fixes to: if you send fixes to your web person, we use their address only to send that email. We keep a one-way hash of it, not the address, plus their opt-out.
• Support: what you write in live chat or email to us.
• Technical and product records: IP-derived abuse signals (stored as one-way hashes), request times, browser and device type, errors, and key product events such as a scan request, checkout or plan change, which we record in our own database to run the service.

Do not submit passwords, health information or other sensitive personal information to a scan or chat.

3. How we use it

• run, store and email the scan and report you asked for;
• run weekly rescans, history, alerts and fixes on paid plans;
• create and secure accounts, bill subscriptions and give support;
• prevent abuse, fraud, unsafe URL access and runaway costs;
• debug and improve the service, and measure our marketing;
• meet legal, tax and accounting obligations and enforce our terms.

We do not sell personal information, rent email lists, or use your information for cross-context behavioural advertising or personalized ads. We make no decisions about you based solely on automated processing.

4. Service providers and transfers outside Canada

These providers process information on our behalf under their own contracts and privacy terms. They may use it only to provide their service to us.

Most of these providers store and process information outside Canada, mainly in the United States, and Crisp in the European Union. While it is there, it is protected by contract but can be accessed by courts, law enforcement and national security authorities under the laws of that country. We choose providers that commit by contract to protect the information they handle for us. Before personal information of Quebec residents goes outside Quebec, we assess how sensitive it is, why it goes there, how it is protected and the laws of the place it goes, as Quebec's Law 25 requires; we use a provider only if that protection is adequate. Each provider's region is on our subprocessor list.

We may also disclose information when the law requires it, to protect people or the service, to investigate fraud, or as part of a sale or reorganization of the business under confidentiality safeguards.

5. Email

We always send the email needed for what you asked for: the report you requested, sign-in links, receipts, payment problems and important account or policy notices. These are not marketing and do not need your consent.

Lifecycle email (a short follow-up series after a free scan, weekly change alerts, onboarding tips and reminders about real offers) goes out only with your consent: either you ticked the opt-in box on the scan form, which is never pre-ticked, or you are a paying customer, in which case we rely on your purchase and stop 6 months after your last paid invoice. Every lifecycle email identifies Cited, gives our mailing address and has a one-click unsubscribe that takes effect right away and in any case within 10 business days. Unsubscribing does not stop the report or account email above.

If you forward fixes to your web person, that email says who asked for it and lets them opt out of any further forwarded fixes.

6. Cookies and similar technology

Necessary, always on: sign-in cookies, an anonymous session cookie, the record of your privacy choices, Cloudflare Turnstile on the scan form, and the Crisp chat widget's own storage so a conversation stays open. We also keep any Google ad click identifier (gclid, gbraid or wbraid) from the link you arrived on in your browser and your anonymous session, and attach it to a checkout you start, so a purchase can be tied to the ad that led to it. We send it to Google only if you allow Marketing, and delete unused identifiers after 90 days. If you arrive through a customer's referral link or a partner organization's link, we remember that code or the partner's name (not who you are) for 60 or 90 days, so its discount applies and the partner can be credited if you subscribe.

Analytics, off until you allow it: PostHog loads only after you allow Analytics. It records pages, product events, device class, coarse country and a session replay with every form input and private report content masked. Google Analytics may then also set its cookies.

Marketing, off until you allow it: lets Google Ads set conversion cookies and receive the ad click identifier so we can see which ads lead to scans and subscriptions. We never turn on ad personalization or remarketing, even with Marketing allowed.

Google before you choose: outside Quebec, Google's tag loads on every page in Consent Mode with analytics storage, ad storage, ad user data and ad personalization all denied. In that state it sets and reads no cookies, ad click identifiers are redacted, and it receives only limited cookieless signals (the page, time, browser type, your consent state and whether a scan or subscription was completed), along with your IP address as with any web request. Google uses them for aggregate, modelled conversion reporting.

Every visitor gets the same opt-in choices with everything optional off by default. Visitors in Quebec get stricter defaults until they allow Analytics or Marketing: Google's tag does not load at all, so it receives nothing, and the Crisp chat widget loads only when you choose to chat. Reopen “Privacy choices” at the bottom of any page to change or withdraw consent; PostHog stops recording as soon as you do.

7. How long we keep it

• Account, business, scan and report data: while your account is open. Deleting your account removes it. If your subscription has ended and you have not signed in for 24 months, we delete the account the same way.
• Free reports without an account: kept so the link keeps working, and deleted when you ask or 24 months after the last scan or visit.
• Raw provider responses inside scans, and our copies of raw payment notifications from Stripe: trimmed after 90 days.
• Ad click identifiers and detailed campaign tags: 90 days after your last visit.
• Product analytics events: 25 months.
• Email delivery events and lifecycle email logs: 13 months.
• Email preferences: while you consent, and 24 months after you unsubscribe or consent lapses.
• A hashed record of when and how you agreed to or withdrew from lifecycle email: 3 years after your last change, so we can show consent as anti-spam law requires.
• Hashed abuse-limit keys derived from IP addresses: 7 days.
• Operational logs: about 90 days.
• Encrypted backups: about 35 days.
• Hashed records of privacy requests: 3 years.
• Invoices and billing records: at least six years, as Canadian tax law requires, and deleted after seven. Stripe keeps its own records under its policy.

8. Your rights

You can ask to access, correct or delete your personal information, get a copy of the information you gave us in a structured, commonly used format (also sent, at your request, to another organization you name), or withdraw consent. When signed in, Settings lets you download a machine-readable copy of your data and permanently delete your account and reports yourself. Cancel any active subscription in the billing portal first. Deletion removes your account, businesses, scans, reports, analytics events and email preferences. It does not remove billing records we must keep (without your name or email), backups until they expire, a hashed record of the request, the hashed record of your email consent, or a hashed suppression entry that stops email to an address that bounced, complained or opted out.

For anything else, email morais.aaron@gmail.com. We may ask you to confirm you control the email address or business first, and we respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

If a page of ours names you or your business (for example a local “who AI recommends” page or a study), you can ask us to remove you or stop it being indexed. Email morais.aaron@gmail.com; we take you off every such page, and keep a note so a refresh never brings you back.

How we handle this inside Cited: the privacy officer approves who can access personal information (today only the two founders), answers every request and complaint, keeps a register of confidentiality incidents, and reviews our retention periods and providers at least once a year. A complaint to morais.aaron@gmail.com gets a written answer within 30 days.

9. Security

We use access controls, row-level database policies, encrypted transport, encrypted backups, managed secrets, signed payment webhooks, URL safety checks and abuse limits. Free reports use long, unguessable links and are not indexed, but anyone you share a link with can see that report. Don't share sign-in links. No service is perfectly secure. We record every confidentiality incident (any loss of, or unauthorized access to or disclosure of, personal information) in a register, even when no one is at risk. If one creates a real risk of serious harm, we notify you and the Privacy Commissioner of Canada, and for Quebec residents the Commission d'accès à l'information, as the law requires. Our trust and security page explains how we protect data and how to report a vulnerability.

10. Children

Cited is a service for businesses and is not directed to anyone under 18.

11. Changes

We will post changes here with a new effective date and, for material changes, tell account holders by email or in the product. See also our terms of service.