Legal
Privacy Policy
Cited is operated by Sandstorm Digital, Dubai Media City, United Arab Emirates. This policy explains what we collect, why, who we share it with, and how to get it back or have it deleted. It covers cited.ae and the Cited application.
The short version
- We collect your email, the domains you ask us to measure, and the measurement results.
- If you connect Google Analytics, we read it. We never write to it, and we never sell or transfer that data.
- We do not sell personal data to anyone, and we do not use your data to train AI models.
- You can export or delete everything by emailing us, and we act within 30 days.
What we collect
Account information
Your email address, a hashed password, and your organisation name. Passwords are hashed with bcrypt and are never stored or transmitted in a readable form.
Project information
The domains you add, the brand names and aliases you supply, the competitors you track, the questions you choose to measure, and the market you select. When you use the scan feature we read the publicly available HTML of the homepage you give us, in the same way a search engine crawler would.
Measurement data
The responses AI assistants return for your tracked questions, which brands appear in them, the sources cited, the searches those engines ran, and what each request cost. This is generated by us on your behalf and is retained so you can see change over time.
Google Analytics data, only if you connect it
With your explicit authorisation we read aggregate reporting data from the Google Analytics 4 property you select: dates, traffic sources, landing pages, session counts, conversion counts and revenue totals. We do not read user-level identifiers, and we do not have permission to change anything in your property.
Payment information
Payments are processed by Stripe. We never see or store card numbers. We keep a Stripe customer reference, a subscription reference, your plan and its status.
Live demo on our website
If you use the public demo without an account, we store the domain you entered, the question you selected, the result, and a one-way cryptographic hash of your IP address. The hash exists to enforce fair-use limits and cannot be reversed to recover your address.
Technical logs
Standard server logs recording requests, errors and timings, kept for operational and security purposes. Cited uses one cookie, to keep you signed in. We do not use advertising or tracking cookies, and we do not run third-party analytics on cited.ae.
Google API Services: Limited Use disclosure
Cited's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We request the
analytics.readonlyscope solely to read reporting data from the Google Analytics property you select, so that we can attribute traffic and conversions arriving from AI assistants. - We do not transfer this data to third parties except as necessary to provide the service you asked for, to comply with applicable law, or as part of a merger or acquisition.
- We do not use this data for advertising, and we do not sell it.
- We do not allow humans to read this data, except with your explicit permission for a support request you have raised, where required for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.
- We do not use this data to develop, improve or train generalised artificial intelligence or machine learning models.
Your Google authorisation is stored encrypted at rest using AES-256-GCM. You can revoke it at any time from the Traffic screen inside Cited, or from your Google Account permissions page. Revoking it stops all future access immediately.
Why we process it
- To provide the service. Running measurement cycles, producing recommendations, and showing you results. This is necessary to perform our contract with you.
- To bill you. Managing subscriptions and enforcing plan limits. Also contractual necessity.
- To keep the service working and secure. Diagnosing faults, preventing abuse, enforcing fair use on the public demo. Our legitimate interest in running a reliable service.
- To contact you about your account, service changes, or security matters. Marketing email is separate and only with your consent, and every marketing message carries an unsubscribe link.
Who we share it with
We use a small number of processors, each doing one job:
| Provider | What they handle | Where |
|---|---|---|
| Render | Application hosting and database | United States |
| DataForSEO | Sends your tracked questions to AI engines | United States, EU |
| Anthropic | Generates question sets and reads answers | United States |
| Analytics data you authorise us to read | Global | |
| Stripe | Payment processing | United States, EU |
We do not sell personal data. We do not share it with advertisers. We would disclose data if legally required to do so, and we would tell you unless prohibited from doing so.
International transfers
We are based in the United Arab Emirates and our providers operate internationally, so your data is processed outside the UAE. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred, we rely on Standard Contractual Clauses or an equivalent safeguard offered by the provider concerned.
How long we keep it
- Account and project data: while your account is open, then 30 days after you close it.
- Measurement history: while your account is open. This is the point of the product, since a trend needs history.
- Google Analytics data: deleted when you disconnect, or when the account closes.
- Public demo records: 90 days.
- Billing records: as long as tax and accounting law requires, typically five years.
- Server logs: 30 days.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, receive a portable copy, object to processing, or withdraw consent. To exercise any of these, email omar@sandstormdigital.com. We respond within 30 days and do not charge for it.
Deleting a site inside Cited removes its questions, measurement history and recommendations immediately and permanently. Deleting your account removes everything associated with it.
Security
- All traffic is encrypted in transit with TLS.
- Passwords are hashed with bcrypt.
- Google refresh tokens are encrypted at rest with AES-256-GCM.
- Access to production systems is limited to staff who need it.
- We never store card details.
No system is perfectly secure. If we discover a breach affecting your personal data we will notify you and the relevant authorities as the law requires.
Children
Cited is a business tool and is not directed at anyone under 18. We do not knowingly collect their data.
Changes
If we make a material change we will email account holders and update the date at the top of this page. Continuing to use Cited after a change means you accept it.
Contact
Sandstorm Digital, Dubai Media City, Dubai, United Arab Emirates.
Privacy, security and data requests: omar@sandstormdigital.com
General enquiries: sandstormdigital.com/contact-us