Privacy Policy

1. What we collect

• Account identity: your Google account's name, email address, and profile picture, received when you sign in with Google.
• Search Console data: the properties you choose to sync and their performance metrics (queries, pages, clicks, impressions, click-through rate, position). Access is strictly read-only (webmasters.readonly); we never request permission to change anything.
• Product records: the task cards, citation checks, and reports the service generates for you, plus billing state for paid plans.
• Free-scan contact details: if you enter your email on our free website scan, we store that email address alongside the scanned domain and its report so we can send you the requested results. We do not add that address to a marketing list without a separate opt-in. The email field is optional — the scan works without it.

2. How we use it

Solely to run the product: detecting SEO opportunities in your data, generating recommendations, measuring before/after impact, sending your weekly digest email, and managing your subscription. We do not sell your data or use it for advertising, and one customer's data is never shown to another.

If you request a free-scan report by email, we use the address to send that report. We do not add scan-report recipients to a marketing list without a separate opt-in. You can ask us to delete the address by emailing support@citewins.com. We never sell scan emails or share them with third parties for their own marketing.

3. AI processing

To write recommendations, small filtered extracts of your metrics (at most 20 rows per request) and publicly available page content are sent to the AI model providers we use for generation. Raw Search Console exports are never passed to AI models wholesale. AI citation checks send only the public search query — none of your account data.

4. Retention

Granular daily metrics are kept for 90 days, then rolled up into weekly aggregates. Account and product records are kept while your account is active. If you revoke Google access or ask us to delete your account, we delete your stored data.

5. Service providers

We rely on a small number of specialist providers to operate CiteWins: secure cloud infrastructure for application and database hosting, AI model providers for generating recommendations, an email delivery service for your weekly digest, and a payments provider that acts as merchant of record — we never see or store your card details. Google provides sign-in and the Search Console API. Each provider processes only what it needs to perform its function for us, under terms that restrict it from using your data for its own purposes. A current list of subprocessors is available on request at support@citewins.com.

6. Google API Services disclosure

CiteWins' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cookies

We use one encrypted, essential session cookie to keep you signed in. No advertising or cross-site tracking cookies.

8. Your rights

You can revoke our Google access at any time, and you can request a copy or deletion of your stored data by emailing support@citewins.com. We respond within 30 days.