---
title: "Privacy policy — Cited"
url: "https://joincited.ai/privacy"
language: en
alternates:
  en: "https://joincited.ai/privacy"
  de: "https://joincited.ai/de/privacy"
  x-default: "https://joincited.ai/privacy"
---

[← Go to home page](https://joincited.ai/)

LEGAL

# Privacy Policy

Last updated: October 12, 2026

**On this page**

This policy explains what personal data we process when you use Cited (joincited.ai, app.joincited.ai).

## Controller

Digital Domination LLC, 523 Jackson Street, Unit #210, Saint Paul, Minnesota 55101, USA  
Email: <hey@joincited.ai>

## EU representative (Art. 27 GDPR)

Sandra Mannigel, email: <dsgvo@digitaldomination.xyz>.

## Using the service

When you use Cited, we process your IP address, the time, the page requested, the referrer and your browser identifier to run the service securely, compile visitor statistics and show prices in euros or US dollars (Art. 6(1)(f) GDPR). We delete the server logs within 14 days.

## Your account

For your account, we process what you enter when you sign up and the data that arises as you use the service, until you delete the account (Art. 6(1)(b) GDPR). The fields marked as required are the ones we need to set up your account or run the scan; everything else is optional. If you sign in with Google, Google sends us your name and email address. To prevent abuse, we log sign-in and signup attempts for up to twelve months (Art. 6(1)(f) GDPR).

## Monitoring queries to AI platforms

At its core, the service sends your prompts, with your brand and website details, to AI platforms and analyzes the answers (Art. 6(1)(b) GDPR). The recipients are OpenAI, Anthropic, Perplexity and Google (all USA), and DataForSEO (Estonia).

## Free scan

For the free scan, we process the brand name, an optional website URL and your email address, run the scan on the same AI platforms and email you the report (Art. 6(1)(b) GDPR). Only if you tick the box do we send you one more email later, with a recap of your result and an offer of a call (Art. 6(1)(a) GDPR); you can withdraw this consent at any time with effect for the future. We delete free-scan data within twelve months.

## Cookies and browser storage

We use only technically necessary cookies and browser storage (Section 25(2) No. 2 TDDDG).

## Service providers and US transfers

These service providers receive personal data. They act on our behalf (Art. 28 GDPR); Google, for sign-in, and Stripe also process data as controllers in their own right.

| Provider | Purpose | Region |
| --- | --- | --- |
| Hetzner Online GmbH | Hosting and backups | EU |
| Cloudflare, Inc. | Delivering and protecting the service, email forwarding | USA |
| Lettermint B.V. | Email delivery | EU |
| Neue Medien Münnich (ALL-INKL.COM) | Mailbox | EU |
| pCloud International AG | Encrypted backups | EU |
| OpenAI, L.L.C. | AI platform (monitoring queries) | USA |
| Anthropic, PBC | AI platform (monitoring queries) | USA |
| Perplexity AI, Inc. | AI platform (monitoring queries) | USA |
| Google LLC | AI platform (monitoring queries) | USA |
| DataForSEO OÜ | Querying the AI platforms | EU |
| [Google Ireland Limited](https://policies.google.com/privacy?hl=en) | Sign in with Google | EU |
| [Stripe Payments Europe, Ltd.](https://stripe.com/privacy) | Payments | EU |

Transfers to the US rely on the EU-US Data Privacy Framework (Art. 45 GDPR) or on Standard Contractual Clauses (Art. 46(2)(c) GDPR); we’ll send you a copy on request.

## Retention

We keep account and monitoring data until you delete your account, and records of support interventions for three years. We keep payment and invoice data for up to ten years to meet legal obligations (Art. 6(1)(c) GDPR). We delete encrypted backups within three years.

## Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Arts. 15–18 and 20 GDPR). You can export your data and delete your account yourself in the settings or simply send an email to <hey@joincited.ai>. You can also lodge a complaint with a data protection supervisory authority.

## Right to object

You can object to processing based on our legitimate interest (Art. 21 GDPR); an email is enough for that too.