Privacy policy

Last updated: 28 October 2026

This policy explains what personal data CitedIn processes when you visit citedin.io and when you use the CitedIn app, why we process it, who helps us, and how you can exercise your rights. If you have connected your Google account, the section Google user data explains exactly what we do with it.

Who we are

CitedIn (citedin.io) is a service that makes one website easier to find on Google and in AI assistants. It measures how visible the site is in Google Search, Google AI Overviews and AI Mode, ChatGPT, Perplexity, Gemini and Copilot, finds what to fix, and prepares the changes as GitHub pull requests or WordPress drafts that the site’s owner reviews and approves.

• Controller: Pablo Bravo Villanueva
• Tax ID (NIF): 12436687N
• Registered office: Calle Linares 30, 4º D, 47010 Valladolid, Spain
• Contact email: info@viaondo.com
• Data protection officer: Not appointed (not required under article 37 GDPR)

CitedIn is in early access: accounts are created by invitation only and there are no paid plans yet.

What data we process

If you visit the website

You do not need to give us any data to browse citedin.io. The public website only sets one cookie, ci_lang, which remembers the language you choose for one year. To understand how the website is used, we measure visits with Pulse, a cookieless analytics tool that we built and host ourselves on Cloudflare. For each page viewed it records the page address, the site you came from, your browser, operating system, device type, screen size and language, and an approximate location (country, region and city) derived from your IP address, which is also used to calculate an anonymous visitor identifier that changes every day. It does not use cookies, does not keep your IP address, and we only look at the results as aggregate statistics. We do not use advertising tools or third-party trackers.

Like any web server, ours receives your IP address and the technical data your browser sends so that it can show you the pages. We do not use them to identify you or to build profiles.

If you use the free check or the free tools

When you run the free check or the llms.txt generator, we process the domain you enter and fetch that site’s public pages (such as its home page, robots.txt and sitemap) to show you the result. To prevent abuse we limit the number of checks per IP address and store, with each check, only a salted and truncated hash of the address, never the address itself. The form may be protected against bots with Cloudflare Turnstile, which checks signals from your browser and your IP address without using cookies for this purpose.

If you have an account

• Account data: your email address, your preferred language, and the workspaces you belong to.
• Sign-in: we do not use passwords. Sign-in goes through Cloudflare Access: you enter your email address, Cloudflare emails you a one-time code, and once you enter it, Cloudflare confirms your address to us. Cloudflare Access sets its own CF_Authorization cookie for that step. We then set a session cookie, __Host-ci_session, which keeps you signed in for up to 30 days.
• Sites you add: the domain, its settings, the questions (prompts), keywords and competitors you track, and the business profile we derive from the site’s public pages.
• Public page content: we crawl the public pages of your site, and of the competitors you name, and keep snapshots so that we can audit them, plan changes and check the result.
• Search results and AI answers: we ask search engines and AI assistants the questions you track and store their results and answers, to measure whether your site appears or is cited. These questions are about your market, not about you.
• Work and approvals: the changes we prepare, which ones you approve or reject and when, and how they performed afterwards.
• Service and security data: an activity log of actions in your workspace, counts of the data we buy for each site, and technical logs. Our logs contain codes and identifiers only: never page contents, AI answers, tokens, keys or email addresses.
• Emails: the weekly digest and service notices we send to your address.
• Messages: what you write to us when you ask a question or report a problem.

If you connect other services

Every connection is optional, is made by you, and can be removed at any time in Settings → Connections.

• Google Search Console (read-only scope webmasters.readonly, plus openid and email so we know which Google account you connected): the list of Search Console properties you can access and, for the property you select, its search performance (queries, pages, countries, devices, clicks, impressions, click-through rate and average position), its sitemaps and the indexing status of its pages. The access is read-only: CitedIn cannot change anything in your Search Console.
• Google Analytics (read-only scope analytics.readonly, only once we offer this connection and only if you make it): traffic reports for the property you select, such as visits that arrive from search engines and AI assistants, by landing page.
• Bing Webmaster Tools (through Microsoft sign-in or an API key you paste): your site’s search performance and its crawling and indexing data in Bing.
• GitHub (through the CitedIn GitHub App, which you install on the repositories you choose): for those repositories only, read and write access to their contents, pull requests and workflow files, read access to checks, statuses and Actions results, and notifications of pushes, pull requests and checks. We use it to read your site’s source code, open pull requests with the proposed changes, add a checks workflow if you accept it, and see whether each change passes its checks and is merged. CitedIn works on its own branches and does not push to your default branch.
• WordPress (through an Application Password you create in your WordPress profile): we read the posts, pages and settings we need and create or update drafts. We never press Publish for you.
• IndexNow and PageSpeed Insights: when one of your changes goes live, we notify the search engines that take part in IndexNow of the changed addresses, and we send public addresses of your site to Google’s PageSpeed Insights API to measure their speed. Only public page addresses are sent.

The credentials of these connections (access tokens, API keys, Application Passwords) are encrypted with AES-256-GCM before they are stored. The encryption key is kept as a secret of the application, outside the database. Credentials are only decrypted at the moment of a call to the service they belong to and are never written to logs.

Google user data

• What we access: the Google data described above for Search Console and, once you connect it, Google Analytics, and the email address of the Google account you connect.
• What we use it for: only to show you your own site’s search performance and indexing status in CitedIn, and to plan and verify changes for your site, for example to choose which pages and queries to work on and to check whether a change was followed by more impressions or clicks.
• Who receives it: we do not sell Google user data and we do not transfer it to anyone, except as needed to provide those features to you (our hosting provider stores it, and the language models behind our AI gateway may receive excerpts, such as a page’s top queries, to write your analysis and plan), to comply with the law, or as part of a merger or acquisition, of which we would tell you first.
• What we never do with it: we do not use it for advertising, including retargeting, personalized or interest-based ads; we do not use it to determine creditworthiness or for lending; and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.
• Who can read it: no person reads your Google user data, except with your explicit consent for specific data (for example, when you ask for help with a report), when it is necessary for security purposes such as investigating abuse or a fault, to comply with the law, or when it has been aggregated and anonymized for internal operations.
• How to disconnect: in Settings → Connections, choose Disconnect on the Google connection; this revokes CitedIn’s access at Google and deletes the stored token from our database. You can also remove CitedIn’s access at any time from your Google account at myaccount.google.com/permissions.
• How to delete it: the Google data already imported stays with your site’s history until you delete the site or your account. You can ask us to delete it at any time by writing to info@viaondo.com; we delete it within 30 days.

Why we use the data and on what legal basis

Where the legal basis is legitimate interest, you can object to the processing as explained below.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Our AI writes drafts; a person reviews and approves every change before it reaches your site, except for the categories of mechanical changes that you choose to apply automatically.

Personal data on the sites you add

The public pages of the sites you add may contain personal data, such as the names of a team’s members. We process that content only to audit and improve the site on your instructions, and you are responsible for having the right to add the site. If you are named on a page that CitedIn has crawled and want to know more, write to info@viaondo.com.

How long we keep the data

• Account, workspaces and sites: while your account exists. When you delete a site, or ask us to delete your account, we delete the related data within 30 days.
• Connection credentials: until you disconnect the service; disconnecting deletes them immediately.
• Page snapshots, search results, AI answers and imported search data: as part of the site’s history while the site is in your account.
• Free check: the result and the hashed address for as long as needed to show the result and limit abuse, and no longer than 12 months.
• Technical logs: a few days.
• Messages: for as long as needed to handle them.
• Cookies: ci_lang one year; __Host-ci_session up to 30 days, renewed while you use the app.

Where the law requires us to keep data for longer, or while liability arising from the processing may be claimed, we keep it blocked and use it only for that purpose.

Who we share the data with

We do not sell your data or share it with third parties for marketing purposes. We only share it with the providers that help us deliver the service, under contract and only for that purpose, and with public authorities and courts where there is a legal obligation.

• Cloudflare, Inc.: runs the application and stores the database and files (Workers, D1, R2, Queues and Workflows), handles sign-in (Cloudflare Access), delivers our emails (Email Service) and protects forms against bots (Turnstile).
• treg.to: the data service we use to obtain search results, keyword data and the answers of AI assistants; it routes each request to the data provider behind it. It receives the questions, keywords and domains of each request, tagged only with an internal site identifier, never your email address or your credentials.
• Our AI gateway: operated by the controller himself; it routes requests to the language models we use to analyse pages and write drafts. They receive page content, search data excerpts and our instructions, never your email address or your credentials.
• Google, Microsoft (Bing), GitHub and your WordPress host: only when you connect them, to read or write the data described above. They process data under their own terms and privacy policies; for your Google account, Google acts as an independent controller under its privacy policy.
• IndexNow and Google PageSpeed Insights: receive public page addresses only.

International transfers

Some of our providers are based in the United States or run on a worldwide network. Cloudflare runs the application at the location nearest to each user, so data may be processed outside the European Economic Area under Cloudflare’s data processing agreement and its standard contractual clauses. Google, Microsoft and GitHub take part in the EU-US Data Privacy Framework. Whenever a provider processes data outside the European Economic Area, we only allow it with the safeguards required by the GDPR, such as a European Commission adequacy decision or standard contractual clauses.

Your rights

You can exercise the following rights at any time:

• access, to find out what data about you we process;
• rectification, to correct inaccurate or incomplete data;
• erasure, to ask us to delete your data;
• objection, to have us stop processing it where the basis is legitimate interest;
• restriction, to have us keep it without using it while a claim is resolved;
• portability, to receive the data you gave us in a structured, commonly used format.

To exercise them, write to info@viaondo.com stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month, which may be extended by two further months if the request is complex; in that case we will let you know.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency, AEPD (www.aepd.es).

Security

We apply technical and organizational measures appropriate to the risk, including:

• TLS encryption on all connections;
• isolation between workspaces: every request checks that you belong to the workspace whose data it asks for;
• connection credentials encrypted with AES-256-GCM, with the key kept outside the database;
• sign-in with one-time email codes, so there are no passwords to steal;
• files in private storage, with no public addresses;
• technical logs without page contents, AI answers, tokens, keys or email addresses;
• a person’s approval before any change reaches your site.

Minors

CitedIn is a service for professionals and is not aimed at minors. Accounts are for adults only.

Changes to this policy

We may update this policy when the service or the law changes. The date of the last update is shown at the top of this page. If the change is significant, we will tell account holders by email before it applies.